coulomb/tenant-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

TEN-IN-0005: declare audit-core egress, drain env and optional sender-token mount

Browse source 
Manifest half only; credential projection and rollout remain open.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 292700@bnt-lap001
Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341
This commit is contained in:
tegwick 2026-10-01 21:31:46 +02:00
parent 4fdbcf8ae1
commit 9fabfd7ebf
2 changed files with 44 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
intakes/intakes.md
View file

@ -164,5 +164,21 @@ notes:
hub message was marked read once this record existed.
author: tenant-engine
created: "2026-09-21"
- content: >-
2026-10-01: manifest half done in deploy/base/tenant-engine.yaml: egress
NetworkPolicy rule to audit-core:8080 (namespace AND pod label), the two
TENANT_ENGINE_AUDIT_CORE_* env vars, and an optional Secret volume
(tenant-engine-audit-core-sender, key token) mounted at
/var/run/secrets/audit-core-sender. Optional on purpose: a missing token
file makes the drain return retry, so mutations are unaffected until the
credential exists. Still open: (1) the credential operator must project the
tenant-engine sender token (minted 2026-09-15 at
platform/workloads/audit-core/senders, AUDIT-WP-0010-T02) into that Secret
in namespace tenant-engine via ExternalSecret; route is
`warden route show audit-core-senders` (owner ops-mason). (2) Roll out via
staged promotion and confirm 202s. (3) Update layer.yaml note. Not applied
live from this session.
author: tenant-engine
created: "2026-10-01"
state_hub_intake_id: "01a0c277-3408-7cdb-984d-c40f697966f0"
```