diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-packet-p4-source-review.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-packet-p4-source-review.json new file mode 100644 index 00000000..83742189 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-packet-p4-source-review.json @@ -0,0 +1,43 @@ +{ + "schema": "railiance-cluster.formal-custody-packet-source-owner-review.v1", + "review_id": "RCLUSTER17-SIGNER-PACKET-P4-20261016", + "reviewer": "railiance-cluster-owner (agent railiance-cluster, codex)", + "native_review_role": "cluster-runtime-storage-owner", + "decision": "approved", + "scope": "exact P4 source-selection/ownership/readiness-preparation join only; not completed native admission or live custody/rollout/founder approval", + "own_work_item": "RCLUSTER-WP-0017-T01", + "own_checkout": "/home/worsch/railiance-cluster", + "own_record_commit": "523669fba57c3785afc30b934ccdcb34a8871bf6", + "reviewed_at": "2026-10-16T18:36:31.649560+00:00", + "reviewed_proposal_id": "RPF35-PDP-SIGNER-NATIVE-PACKET-20261016-P4", + "reviewed_manifest_sha256": "sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3", + "platform_source_git_revision": "84c529f239c81e6d3ca337015700b03e3a862f53", + "rollout_r2_manifest_sha256": "sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59", + "source_projection_sha256": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "consumer_baseline_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b", + "comment": "INTENT Core Principles1 Runtime Not Workloads and2 Healthy by Verification support the exact P4 runtime/storage-only boundary under RCLUSTER-WP-0017-T01. All source-selection joins and corrected rollback/freeze scope reviewed fresh in the ownrepo checkout. Cluster owns runtime/storage/headroom/PV retention, never workload/Helm or GitOps Application controllers; Access, Platform and Secrets retain their own respective semantics. P4 fixes preserved P3 prose, keeps source scope/assembler unchanged, and explicitly leaves actual held window/fence/expiry/founder/CCR dispositions absent. This approves the source join only and cannot fill the completed-scope cluster native review slot.", + "checks": { + "all_manifest_file_hashes_verified": true, + "six_source_bundle_hashes_against_git_commit_verified": true, + "executed_source_bundle_digest_verified": true, + "native_plan_digest_verified": true, + "rollout_r2_source_projection_join_verified": true, + "selected_consumer_baseline_join_verified": true, + "corrected_exact_five_owner_roles_verified": true, + "actual_native_inputs_unfilled": true, + "independent_assembler_tests": "8passed0.914s; synthetic test reviews never native authority" + }, + "source_findings": [ + "README/remaining-inputs ownership audit assigns Application sync/freeze/restoration to Platform, signer workload/Helm/rollback to Access, consumer/trust to Secrets, runtime/storage/PV preservation/retention to cluster. Conditional Enablement covers only separately proposed actual ArgoCD installation/controller changes, excluded here.", + "P4 pins exact R5 commit84c529 and source bundle, rolloutR2 manifest5be7a7/chartdc042/image84/projection8ce375, pre-key baseline72521. Source selection is not installed/public-key trust or native stopped projection.", + "WaitForFirstConsumer stopped Helm semantics and ready rollback controls remain governed by reviewed rolloutR2; no P4 text grants current command execution or automatic predecessor restart.", + "Fresh exact native preflight/held window/fence/PV Retain/dispositions remain open; source review completion does not close T02/T03.", + "Absolute child120second timing and expiry, unknown-CAS/no-retry/forward-only recovery, retained outbox/evidence and strict failclosed trust remain unchanged." + ], + "completed_native_scope_sha256": null, + "native_admission": false, + "founder_approval": false, + "other_owner_assent": false, + "T01_source_scope_satisfied": true, + "T02_T03_native_scope_satisfied": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-rollout-r2-source-review.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-rollout-r2-source-review.json new file mode 100644 index 00000000..4b891a45 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/formal-rollout-r2-source-review.json @@ -0,0 +1,43 @@ +{ + "schema": "railiance-cluster.formal-rollout-source-owner-review.v1", + "review_id": "RCLUSTER17-SIGNER-ROLLOUT-R2-20261016", + "reviewer": "railiance-cluster-owner (agent railiance-cluster, codex)", + "native_review_role": "cluster-runtime-storage-owner", + "decision": "approved", + "scope": "exact rollout R2 runtime/storage and Helm maintenance source proposal only; no live action/current-fence/binding/custody/public-trust acceptance", + "own_work_item": "RCLUSTER-WP-0017-T01", + "own_checkout": "/home/worsch/railiance-cluster", + "own_record_commit": "523669fba57c3785afc30b934ccdcb34a8871bf6", + "reviewed_at": "2026-10-16T18:32:18.904019+00:00", + "reviewed_manifest_sha256": "sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59", + "rollout_proposal_id": "FLEX24-SIGNER-ROLLOUT-20261016-R1", + "rollout_revision": "R2", + "chart_git_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "image_git_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "platform_git_revision": "84c529f239c81e6d3ca337015700b03e3a862f53", + "source_projection_sha256": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "comment": "INTENT principles Runtime Not Workloads and Healthy by Verification support this precise runtime/storage source scope under RCLUSTER-WP-0017-T01. Actual Helm-rendered replicas0/1 make stopped candidate installation representable without a post-render spec mutation. Source Recreate/exact projection/no hooks/bounded request are consistent with runtime constraints. Cluster approves this exact source maintenance proposal only; Access release semantics and Platform Application freeze remain independently owned. Dated native snapshots and source projection grant no live fence or storage acceptance.", + "independent_verification": "rollout-r2-independent-verification.json", + "source_findings": [ + "All frozen manifest and exact archived input hashes verified; independent retained/stopped/ready renders byte-equal; Deployment differs only replica count; native encoded projection identical.", + "Stop explicitly --reset-values --no-hooks --wait=false; no atomic/force/cleanup-on-fail/reuse-values. This avoids WFFC PVC wait deadlock and automatic rollback to running predecessor. Exact chart has no hooks; source success is not actual fence.", + "Ready atomic/wait only after actual newly established stopped Helm revision independently captured and shown to be the rollback target with identical candidate template; never auto-rollback to observed running revision4. No executable current command is approved.", + "1Gi RWO local-path/Helmkeep request preserves actual PV UID/binding/claimRef/node-affinity and Retain readback as later independent gates; request is not hard quota, backup, node-loss durability or process exclusion.", + "Canonical local d52/source2b/current05a remains frozen; exact image84 provenance and chartdc0420 are distinct pins; no package placement/adoption inferred.", + "Exact caller/policy/registry/resources preserved;64MiB process bound and restart/lock/storage-failure proofs remain native gates.", + "Numeric integral YAML0.0/1.0 acceptance is an explicit Helm representation limit; unsafe bool/string/fractional/other numeric values refused by independent render cases." + ], + "required_later_controls": [ + "Authenticate exact completed successor scope, source/image/CCR/projection/trust/window/expiry and distinct founder/owner dispositions; frozen P2 is not upgraded.", + "Access fences consumer acceptance first and owns manual/CI/workload writers; Platform authenticates actual GitOps/Application freeze. Unknown writer, HPA, second signer or uncertain inventory holds fence.", + "Refresh cluster identity/node/current Helm revision+allowlisted configuration, quota/headroom/disk and sanitized native server dry-run/client diff. Reconcile admission/defaulting projection drift before CAS.", + "After stop, actual generation caught up, zero Deployment/UID-owned ReplicaSet spec/status replicas, no live/terminating owned/signer-SA/seed-mount pods; recheck fence+projection immediately before CAS; hold across custody/delivery/trust.", + "WFFC binding/start occurs only through separately approved transition with consumers still fenced; actual exact PV Retain before durable acceptance.", + "Ready120seconds and recovery decision600seconds; partial writes/timeouts/ambiguous CAS stay fenced preserving unknown/evidence; no auto CAS retry/remint, cursor reset, PVC deletion, seed restoration or unsigned trust fallback." + ], + "completed_native_scope_sha256": null, + "native_admission": false, + "founder_approval": false, + "other_owner_assent": false, + "frozen_r1_p2_changed": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/README.md b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/README.md new file mode 100644 index 00000000..805684fe --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/README.md @@ -0,0 +1,43 @@ +# Access signer rollout preparation R2 + +Existing work: FLEX-WP-0024-T06. Access deployment source preparation only. Native admission and execution remain withheld. Frozen rollout R1, stopped-chart R1/R2 and Platform P2 remain unchanged. + +## Exact separate pins + +- Chart/retained values/policy/registry: Access commit `dc042022f7c30671cf0a7605cf43ef6d96d04242`, `charts/flex-auth`, release `flex-auth-secrets-engine`, namespace `flex-auth`. Source archive file hashes are in render-evidence.json. +- Image: `forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f`, built from Access `84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0`. Independently verified ordinary main-push CI402 receipt is `../image-84c78e0/candidate-receipt.json`. The chart-only successor does not rebuild this image or change its source label. Policy and registry source bytes match the selected image revision. Chart/test/workplan-only changes do not trigger the existing image workflow. +- Projection implementation: committed Platform R5 `84c529f239c81e6d3ca337015700b03e3a862f53`, `scripts/flex_auth_signer_native.py` SHA256 `4fb9ce6608ad04c4f5dc98a95796dc88a08a2453dc15c0d40c5c688fc02f573f`. The renderer verifies this exact committed module before calling its projection/encoding implementation. +- Managed package remains local `d52f811ed5ec0be27c9c367e71d476125b3228be`, tree `d4fbad71bdc8ef870603526ccd1f53195d0322af`, readiness draft/no reef binding, with frozen extraction2b/current05a source/image. R2 is a separate proposed signer successor, not execution through the extraction-only contract or evidence of central/private availability, placement or runtime package adoption. + +Both `stopped-source-render.yaml` and `activation-source-render.yaml` are actual Helm renders with their corresponding exact values overlays. The complete parsed Deployment differs only in replicas0 versus1; no post-render scale/spec patch is used. The new chart accepts numeric exactly0/1, rejects unsafe replica values, retains Recreate and the source process lock. Helm cannot distinguish numeric integral YAML0.0/1.0 from0/1; this semantic limit is documented and tested in the stopped-chart proposal. + +The canonical encoded source projection is `source-projection.canonical.json`, SHA256 `8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c`. Its digest equals both R2 states and frozen rollout R1. It includes immutable image, exact caller flags, SA, pod UID/GID/fsGroup65532, read-only seed directory0440, reviewer projection and PVC mount. The pretty JSON file has a different byte hash; use canonical encoding for the native contract. A source projection is not a stopped native fence. The future observed stopped Deployment must match this exact projection after API admission/defaulting; drift requires explicit review. + +`source-render.diff` compares the ready proposal with retained values rendered by the same exact new chart. Service, ServiceAccount, RBAC and NetworkPolicy objects are unchanged. Existing caller mode enforce, audience flex-auth, binding `secrets-engine=system:serviceaccount:secrets-engine:secrets-engine`, Kubernetes API URL, lifecycle policy and registry paths and25m/32Mi requests/300m/192Mi limits are unchanged. No Secret or Ingress is generated. Seed/kid coordinates remain proposed; audit delivery stays disabled and no task source is enabled. + +Reproduce offline with `python3 prepare.py --image-receipt ../image-84c78e0/candidate-receipt.json` from this directory. The script uses disposable source archives and local Helm only. No native dry-run, apply, diff, token request or credential access occurred. + +## Owner split and proposed maintenance path + +Access owns workload/chart/Helm release, delivery mount semantics, competing manual/CI/workload writers, process/outbox fencing and rollback. Platform owns OpenBao custody/read delivery and existing ArgoCD Applications and their sync/freeze integration, with actual identified writer coordination with Access. Cluster owns runtime/node identity, admission, scheduling/headroom, local-path provisioning and actual PV retention. Enablement reviews an ArgoCD installation/controller configuration change only; this scope excludes such a change. No combined cluster/GitOps assent or other-owner review is authored here. + +The proposed argument arrays in command-plan.proposed.json use a future verified source-materialization root. They are review shapes, not runnable approved commands. The actual root/executor/window and native preflight receipts remain absent. Both transitions explicitly use `--reset-values` and `--no-hooks`: exact chart defaults plus retained file plus phase overlay, with no persisted override inheritance or hook execution. No hook annotation exists in any exact archived render. No `--reuse-values`, `--force`, `--cleanup-on-fail`, mutable tag, namespace creation, alternate policy or unsigned consumer fallback is included. + +1. Collect exact independent founder, Access, Platform, Secrets and cluster-runtime-storage dispositions for the completed successor scope. Authenticate actual Helm/workload and Application writers, freeze only those in scope with their owners, capture prior states/no in-flight operation/restoration criteria. Stop affected protected-consumer acceptance first. Any unknown writer, HPA, job, second signer-SA/seed-mount pod or missing owner disposition holds the fence closed. +2. Refresh actual target identity, Deployment UID/release revision and allowlisted nonsecret config, quota/storage/headroom and package availability. Review sanitized client diff and server dry-run of exact nonsecret resources; admission changes must be explicitly reconciled. Do not capture raw Helm values, Secret objects/annotations/errors, env, logs or tokens. Existing18:01/18:02UTC snapshots are dated inputs, not a reservation or live fence. +3. Under the approved maintenance path, Helm installs the exact candidate template at replicas0 using stopped-values.proposed.yaml. This new WaitForFirstConsumer PVC can remain Pending while stopped. Use `--wait=false` without `--atomic` for this transition: installed Helm help explicitly includes PVCs in wait and enables wait for atomic. Instead independently observe generation caught up, zero desired/status replicas, every UID-owned ReplicaSet at spec/status0 and no live or terminating UID-owned/signer-SA/seed-mount pods within the reviewed120-second stop budget. Helm command success alone is insufficient. A failure after partial apply preserves the fence and requires exact observed-state reconciliation; it must not automatically restore running predecessor05a. +4. Hold the same independently authenticated exclusive window through the separately approved Platform custody/read-lane ceremony, ESO delivery and independent Secrets public trust. Recheck native projection and all stopped-fence observations immediately before custody CAS. Exact founder entity, absolute expiry, source/CCR/image/trust/window hashes and five actual external scope-bound dispositions are mandatory; this packet fills none of them. Ambiguous CAS/readback/fsync outcomes keep original unknown evidence and fence; no remint or replay. +5. Capture the newly established stopped Helm revision and prove its rollback target remains replicas0 with identical exact candidate template. Only then may a separately approved ready transition use activation-values.proposed.yaml with atomic/wait120s: an automatic rollback must return to the reviewed stopped state, never the old running unsigned state. Protected consumers remain fenced during WaitForFirstConsumer binding/startup. Capture actual PVC/PV identifiers and have the authorized cluster owner set and verify exact PV Retain before durable acceptance. If binding cannot be safely completed in that window, stay stopped; do not guess a PV or extend the scope silently. +6. Require Ready within120seconds and recovery decision within600seconds, exact image/pod UID/SA/startup mount/UID/GID/kid verification and independent public-trust delivery. Then record native signed lifecycle ALLOW/DENY with original durable records and installed Secrets verifier; require caller negatives, wrong-tenant/task refusal, restart signature/sequence/cursor preservation and separately admitted actual lock/capacity/unwritable/fsync negatives. Initial proof causes no protected backend effect and claims no audit receiver acceptance. Reopen protected acceptance only after those distinct gates pass. + +## Dated resources, storage and rollback + +Cluster observation at18:01:45/18:02:04UTC16October2026 identified node92.205.62.239, kube-system UIDa553c742-0115-43d4-99a4-a5ca56fe0786, Deployment UIDf83a5f5c-7dd7-4aac-bc02-d447e423e6ae generation4 and running unsigned05a pod; Helm revision4 deployed. This is not stopped state or rollback authorization. No namespace ResourceQuota, LimitRange or PVC was present. Thus no namespace-enforced storage quota was observed then, rather than an invented numeric quota. Source receipts/hash references are in dated-metadata-inputs.json; refresh at the actual window. + +The exact new claim request is1Gi (1073741824 bytes), RWO, local-path, `flex-auth/flex-auth-secrets-engine-outbox`, with Helmkeep. Observed free filesystem bytes were125827354624 (about117.2GiB), exceeding this request by124753612800 bytes then; no reservation or hard quota follows. Observed requested node CPU3580m/4000m left420m; memory request9760Mi and limits were overcommitted. Ready state retains the old25m/32Mi request and Recreate avoids intentional surge, but current fit and disk remain cluster-owned native checks. + +Storage class local-path used WaitForFirstConsumer/Delete. Neither1Gi request nor RWO/Recreate provides a hard filesystem quota, backup, node-loss recovery or process exclusion. The independent source limit is64MiB/67108864 bytes and needs native failure/restart proof. Actual dynamically bound PV name/UID/claimRef UID cannot exist in this source packet. Capture exact actual binding, capacity/node affinity and cluster-owned Retain mutation/readback before durable acceptance. Helmkeep does not override Delete reclaim or protect manual deletion. Backup/restore and off-node evidence continuity remain open. + +Rollback keeps protected consumers fenced, stops candidate through exact reviewed replicas0 Helm path, observes all relevant pods gone and lock released, and retains PVC/log/cursor/signatures/receipts. Reconcile partial stop/upgrade failures before any restart. Restore the captured stopped revision only after checking exact current source/config and evidence-format compatibility. Historic observed revision4/current05a is an unsigned availability option only after separate reviewed compatibility disposition; it cannot satisfy the strict signed consumer or mutate new outbox evidence by assumption. If exclusion/format is uncertain, stay unavailable. No uninstall, PVC/PV deletion, cursor reset, caller/trust weakening, old-seed restore or automatic CAS retry. Compromise requires public trust withdrawal and separately approved forward-only successor. Restore each controller only through its actual owner's recorded criteria. + +Source preparation costs EUR0 incremental infrastructure. The proposed resource addition is one1Gi local-path request with unchanged workload resources. Founder native spend/risk-loss ceiling, outage and evidence-loss disposition remain absent. Neither source approval nor preapproved shell prefixes grant native authority. diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/activation-source-render.yaml b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/activation-source-render.yaml new file mode 100644 index 00000000..5c6b53e0 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/activation-source-render.yaml @@ -0,0 +1,237 @@ +--- +# Source: flex-auth/templates/networkpolicy.yaml +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: flex-auth-secrets-engine + policyTypes: + - Ingress + - Egress + egress: + - ports: + - port: 443 + protocol: TCP + - port: 6443 + protocol: TCP + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: secrets-engine + podSelector: + matchLabels: + app.kubernetes.io/name: secrets-engine + ports: + - port: 8080 + protocol: TCP +--- +# Source: flex-auth/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +automountServiceAccountToken: false +--- +# Source: flex-auth/templates/outbox-pvc.yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: flex-auth-secrets-engine-outbox + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + accessModes: + - ReadWriteOnce + storageClassName: "local-path" + resources: + requests: + storage: "1Gi" +--- +# Source: flex-auth/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flex-auth-secrets-engine-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +rules: + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +--- +# Source: flex-auth/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: flex-auth-secrets-engine-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flex-auth-secrets-engine-tokenreviewer +subjects: + - kind: ServiceAccount + name: flex-auth-secrets-engine + namespace: flex-auth +--- +# Source: flex-auth/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + selector: + app.kubernetes.io/name: flex-auth-secrets-engine + ports: + - name: http + port: 8080 + targetPort: http +--- +# Source: flex-auth/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + strategy: + type: Recreate + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: flex-auth-secrets-engine + template: + metadata: + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth + spec: + automountServiceAccountToken: false + serviceAccountName: flex-auth-secrets-engine + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - name: flex-auth + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f + imagePullPolicy: IfNotPresent + args: + - serve + - --addr + - 0.0.0.0:8080 + - --registry + - /opt/flex-auth/examples/secrets-engine/registry_snapshot.json + - --policy + - /opt/flex-auth/examples/secrets-engine/policy_package.md + - --envelope-signing-key-file + - "/var/run/secrets/decision-envelope-signing/seed" + - --envelope-signing-kid + - "flex-auth-lifecycle-20261016-r1" + - --outbox-max-bytes + - "67108864" + - --outbox-dir + - "/var/lib/flex-auth/outbox" + - --emission-source + - "flex-auth.secrets-engine" + - --caller-audience + - "flex-auth" + - --caller-auth-mode + - "enforce" + - --caller-kubernetes-url + - "https://10.43.0.1" + - --caller-binding + - "secrets-engine=system:serviceaccount:secrets-engine:secrets-engine" + ports: + - name: http + containerPort: 8080 + livenessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 20 + readinessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 5 + resources: + limits: + cpu: 300m + memory: 192Mi + requests: + cpu: 25m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: "/var/run/secrets/decision-envelope-signing" + name: flex-auth-envelope-signing + readOnly: true + - mountPath: "/var/lib/flex-auth/outbox" + name: flex-auth-outbox + - mountPath: /var/run/secrets/flex-auth-reviewer + name: flex-auth-reviewer + readOnly: true + volumes: + - name: flex-auth-envelope-signing + secret: + secretName: "flex-auth-secrets-engine-envelope-signing" + defaultMode: 0440 + items: + - key: "seed" + path: seed + - name: flex-auth-outbox + persistentVolumeClaim: + claimName: "flex-auth-secrets-engine-outbox" + - name: flex-auth-reviewer + projected: + defaultMode: 0440 + sources: + - serviceAccountToken: + expirationSeconds: 3600 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/activation-values.proposed.yaml b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/activation-values.proposed.yaml new file mode 100644 index 00000000..96960c73 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/activation-values.proposed.yaml @@ -0,0 +1,20 @@ +image: + repository: forgejo.coulomb.social/coulomb/flex-auth + digest: sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f +replicaCount: 1 +envelopeSigning: + enabled: true + kid: flex-auth-lifecycle-20261016-r1 + secretName: flex-auth-secrets-engine-envelope-signing + secretKey: seed + mountPath: /var/run/secrets/decision-envelope-signing +outbox: + enabled: true + source: flex-auth.secrets-engine + mountPath: /var/lib/flex-auth/outbox + size: 1Gi + maxBytes: 67108864 + storageClassName: local-path + existingClaim: '' +auditDelivery: + enabled: false diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/command-plan.proposed.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/command-plan.proposed.json new file mode 100644 index 00000000..2e297507 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/command-plan.proposed.json @@ -0,0 +1,80 @@ +{ + "schema": "access-engine.signer-helm-maintenance-plan.v1", + "state": "unapproved argument shapes; no invocation ready", + "verified_source_root": null, + "frozen_rollout_root": null, + "executor": null, + "chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "stop": { + "argv": [ + "helm", + "upgrade", + "flex-auth-secrets-engine", + "OWNER_REVIEWED_VERIFIED_SOURCE_ROOT/charts/flex-auth", + "--namespace", + "flex-auth", + "-f", + "OWNER_REVIEWED_VERIFIED_SOURCE_ROOT/values/secrets-engine.yaml", + "-f", + "OWNER_REVIEWED_FROZEN_ROLLOUT_R2_ROOT/stopped-values.proposed.yaml", + "--wait=false", + "--timeout", + "120s", + "--reset-values", + "--no-hooks" + ], + "atomic": false, + "reason": "Helm wait includes PVCs; WaitForFirstConsumer unbound claim must not block maintenance stop", + "required_followup": "within120s observedGeneration caught up and all UID-owned/SA/seed-mount pods absent; source projection match; retain unknown partial failures fenced", + "forbidden_flags": [ + "--atomic", + "--wait=true", + "--force", + "--cleanup-on-fail", + "--reuse-values" + ] + }, + "ready": { + "argv": [ + "helm", + "upgrade", + "flex-auth-secrets-engine", + "OWNER_REVIEWED_VERIFIED_SOURCE_ROOT/charts/flex-auth", + "--namespace", + "flex-auth", + "-f", + "OWNER_REVIEWED_VERIFIED_SOURCE_ROOT/values/secrets-engine.yaml", + "-f", + "OWNER_REVIEWED_FROZEN_ROLLOUT_R2_ROOT/activation-values.proposed.yaml", + "--atomic", + "--wait", + "--timeout", + "120s", + "--reset-values", + "--no-hooks" + ], + "preconditions": [ + "exact newly recorded stopped Helm rollback revision verified", + "separate custody/read delivery/public trust/native scope admitted", + "protected consumers still fenced", + "runtime binding/provisioning/headroom authorized; exact PV Retain before durable acceptance" + ], + "automatic_rollback_target_revision": null, + "forbidden_flags": [ + "--force", + "--cleanup-on-fail", + "--reuse-values" + ] + }, + "previous_observed_revision": { + "revision": 4, + "observed_at": "2026-10-16T18:02:04.834187+00:00", + "authorization": "none; refresh/config/format compatibility review required before any rollback" + }, + "sanitization": "future execution wrapper suppresses raw Helm/Kubernetes object/error values; returns allowlisted receipt only", + "no_live_execution": true, + "values_semantics": "--reset-values discards persisted overrides and starts from exact chart defaults plus retained values file and frozen phase overlay; allowlisted current/native diff remains mandatory", + "hook_semantics": "--no-hooks explicitly skips hook execution in both transitions; exact archived source renders contain no helm.sh/hook annotations", + "source_hook_absence_verified": true +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/dated-metadata-inputs.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/dated-metadata-inputs.json new file mode 100644 index 00000000..545a6a56 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/dated-metadata-inputs.json @@ -0,0 +1,23 @@ +{ + "schema": "access-engine.signer-dated-inputs.v1", + "new_observations_made": false, + "refresh_at_actual_window": true, + "inputs": { + "cluster-review-r1/runtime-observation.json": "sha256:63a637ea32aadc3358ba55dc5b46f86c67df3d6c80ea00e3aee68bfa38fd3e58", + "cluster-review-r1/prechange-resources.json": "sha256:4886fe8a899e949c17464a8271b09830917dd3e9251fb97e17076291d8f4842d", + "cluster-review-r1/review.json": "sha256:959b526cb77f530de15aa6f3172e26971803e8ae67e6945d996de0621f657c8a", + "image-84c78e0/candidate-receipt.json": "sha256:af8e032d28776722ccf2bfe0f884577e568d8d0fb3713aa869e1d7d1c77c576f" + }, + "dated_observations": { + "runtime": "2026-10-16T18:01:45Z", + "resources": "2026-10-16T18:02:04.834187+00:00", + "namespace_quota": "No ResourceQuota or LimitRange observed; not unlimited physical capacity or native approval", + "free_bytes": 125827354624, + "pvc_request_bytes": 1073741824, + "free_minus_request_bytes": 124753612800, + "helm_revision": 4, + "deployment_uid": "f83a5f5c-7dd7-4aac-bc02-d447e423e6ae", + "kube_system_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786" + }, + "limits": "Source-only preparation uses prior independently retained selected metadata; these are neither current resource reservations nor a stopped/native exclusive-window receipt." +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/exclusive-window.proposed.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/exclusive-window.proposed.json new file mode 100644 index 00000000..44323f0f --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/exclusive-window.proposed.json @@ -0,0 +1,84 @@ +{ + "schema": "access-engine.signer-exclusive-window-proposal.v2", + "proposal_id": "FLEX24-SIGNER-ROLLOUT-20261016-R1", + "status": "proposed-incomplete-native-window-not-held", + "owner_work": "FLEX-WP-0024-T06", + "target": { + "cluster": "railiance01", + "node_ip": "92.205.62.239", + "kube_system_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786", + "namespace": "flex-auth", + "deployment": "flex-auth-secrets-engine", + "observed_predecessor_deployment_uid": "f83a5f5c-7dd7-4aac-bc02-d447e423e6ae", + "service_account": "flex-auth-secrets-engine" + }, + "executor": null, + "abort_owner": "founder", + "access_preparation_owner": "access-engine", + "founder_disposition": null, + "absolute_window_start": null, + "absolute_window_end": null, + "ready_timeout_seconds": 120, + "recovery_decision_seconds": 600, + "competing_controllers": null, + "actual_prechange_helm_revision": null, + "consumer_stop_receipt": null, + "native_stopped_fence_receipt": null, + "conditions": [ + "Protected consumers fenced before template/stop or custody changes", + "Exact Deployment replicas0; observedGeneration equals generation; no status replicas", + "All owned ReplicaSets spec/status replicas0; no live or terminating owned pods", + "No signer-SA or seed-mount pods anywhere in target namespace; no HPA targeting signer", + "Access freezes actual Helm/CI/workload writers; Platform authenticates/freezes actual in-scope Application sync writers. Record identity/revision/prior state/no in-flight operation/restore criteria; no controller-installation change.", + "Native stopped Deployment projection equals reviewed source projection immediately before custody CAS", + "Remain fenced until independently authenticated public trust/delivery/runtime proof", + "Any uncertain write/readback/identity/volume or readiness outcome keeps fence closed", + "Stopped Helm transition uses wait=false without atomic while WaitForFirstConsumer PVC is unbound; separate stop/fence observations are required", + "Ready atomic transition may only target a recorded current stopped rollback revision, with consumers fenced and exact binding/Retain verified before durable acceptance" + ], + "storage": { + "pvc": "flex-auth-secrets-engine-outbox", + "request": "1Gi", + "request_bytes": 1073741824, + "outbox_hard_ceiling_bytes": 67108864, + "storage_class": "local-path", + "helm_keep": true, + "pv_reclaim_required": "Retain", + "pv_name": null, + "pv_uid": null, + "claim_uid": null, + "namespace_storage_quota_remaining_bytes": null, + "node_free_filesystem_bytes": null, + "binding": "WaitForFirstConsumer; exact actual binding and Retain verification required before durable acceptance", + "dated_namespace_quota_observation": "No ResourceQuota or LimitRange observed at18:01:45UTC; no numeric quota was present, refresh required", + "dated_node_free_filesystem_bytes": 125827354624, + "dated_free_minus_request_bytes": 124753612800 + }, + "cost": { + "source_preparation_incremental_eur": 0, + "native_spend_authority": false, + "native_incremental_resources": "one1Gi local-path request; unchanged25m/32Mi workload request", + "risk_loss_ceiling_eur": null + }, + "authority_granted": false, + "revision": "R2", + "owner_dispositions": { + "founder": null, + "access-engine-owner": null, + "railiance-platform-owner": null, + "secrets-engine-owner": null, + "cluster-runtime-storage-owner": null + }, + "owner_scope": { + "access-engine-owner": "workload/chart/Helm release and competing workload/manual/CI writers, signer mount/process/outbox fencing and rollback", + "railiance-platform-owner": "OpenBao custody/read delivery and existing ArgoCD Applications and their sync/freeze integration", + "cluster-runtime-storage-owner": "runtime/node identity, admission/scheduling/headroom, provisioning and exact actual PV retention", + "enablement": "only an ArgoCD installation/controller configuration change, excluded from this scope" + }, + "dated_prechange_helm_revision": 4, + "actual_stopped_helm_revision": null, + "source_projection_sha256": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "live_window_held": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/manifest.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/manifest.json new file mode 100644 index 00000000..7f70a1d4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/manifest.json @@ -0,0 +1,34 @@ +{ + "schema": "access-engine.signer-rollout-preparation.v2", + "proposal_id": "FLEX24-SIGNER-ROLLOUT-20261016-R1", + "revision": "R2", + "role": "access-engine-deployment-preparation-only", + "owner_work": "FLEX-WP-0024-T06", + "chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53", + "source_projection_sha256": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "prior_R1_manifest_sha256": "sha256:6b9292aab59f9ca8012be00f50027ded6a12018a3b36b011ef953d448e75e3dc", + "disposition": "source-checks-pass-native-gates-open", + "native_window_held": false, + "native_stopped_fence_verified": false, + "other_owner_assent": false, + "execution_authorized": false, + "files": { + "README.md": "sha256:bae015d61c04fb761ea468a422b9fbb4ecae404b898c0eab2653ad2cae7b8370", + "activation-source-render.yaml": "sha256:b7edecb8ec50a6d2db7623a3d962dbece46de81d3809d5f73b3aca20ff76b8c7", + "activation-values.proposed.yaml": "sha256:e76a30967add800ed8b588368757e7a5fa0ce4d8305ef658b5a4a08e377eb5b8", + "command-plan.proposed.json": "sha256:6e8dfd087dee349dde04995b84a1e2dd4aaa74a26150b23e6f8fd9313632f089", + "dated-metadata-inputs.json": "sha256:68fc91c39ce8ef9029b37867f4e77d043e8c8fd42eedfe3c9e703509f6d6028e", + "exclusive-window.proposed.json": "sha256:15a063dfe1b4237c458ce3e12ec1a19e87bf2a3b98f97fbe7dcdcdb8d121a675", + "owner-source-review.json": "sha256:b125d139273b88a8ed4e09f8fccf59fcd11ec75b49ee1e6593598543aeed38a9", + "prepare.py": "sha256:c7dbaac542f1e9c3c869e896f848eed16769b93e29a4ef1c3031d71e10c3dcd7", + "render-evidence.json": "sha256:bc1084fe03491b713b3a73b970082735324a0d99a27e07845515d8878525b626", + "retained-source-render.yaml": "sha256:f979f7d05d5b0a54e3b8ac7c413aa4d401139f991b43412cdbde3d63249b0dd9", + "source-deployment-projection.json": "sha256:056b6bf842713fb9a328dae901401d6867da47da68bfb8a4904bb0d7b8d9e912", + "source-projection.canonical.json": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "source-render.diff": "sha256:d510bbe9ff280f49f86ad67355774fbf76e32c36c129bd593b4be5b257dccd67", + "stopped-source-render.yaml": "sha256:03b631f0fe17c63494c14619199f69f2a2a9ab245d00f1ec441248868b24c071", + "stopped-values.proposed.yaml": "sha256:6e6f4bdd6ed1f9994f87e51b24186ba923515419b30d9c187c288f7db05e3a77" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/owner-source-review.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/owner-source-review.json new file mode 100644 index 00000000..d71aa170 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/owner-source-review.json @@ -0,0 +1,33 @@ +{ + "schema": "access-engine.signer-rollout-source-review.v1", + "proposal_id": "FLEX24-SIGNER-ROLLOUT-20261016-R1", + "revision": "R2", + "reviewer_role": "access-engine-owner", + "existing_own_work": "FLEX-WP-0024-T06", + "disposition": "approve-source-preparation-only-for-independent-review", + "scope": "retained Access Helm release/chart/values/image, signer mount, single-writer/outbox source fencing and rollback proposal only", + "input_hashes": { + "prepare.py": "sha256:c7dbaac542f1e9c3c869e896f848eed16769b93e29a4ef1c3031d71e10c3dcd7", + "README.md": "sha256:bae015d61c04fb761ea468a422b9fbb4ecae404b898c0eab2653ad2cae7b8370", + "render-evidence.json": "sha256:bc1084fe03491b713b3a73b970082735324a0d99a27e07845515d8878525b626", + "exclusive-window.proposed.json": "sha256:15a063dfe1b4237c458ce3e12ec1a19e87bf2a3b98f97fbe7dcdcdb8d121a675", + "command-plan.proposed.json": "sha256:6e8dfd087dee349dde04995b84a1e2dd4aaa74a26150b23e6f8fd9313632f089", + "dated-metadata-inputs.json": "sha256:68fc91c39ce8ef9029b37867f4e77d043e8c8fd42eedfe3c9e703509f6d6028e", + "source-projection.canonical.json": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c" + }, + "source_checks": { + "actual_helm_replicas0_and1": true, + "only_deployment_replicas_differs_between_states": true, + "platform_R5_projection_hash_matches_frozen_R1": true, + "unchanged_caller_policy_registry_resources": true, + "nondeployment_resources_unchanged_except_new_PVC": true, + "ordinary_verified_image84_selected_separately_from_chart_dc0420": true, + "no_hooks_in_source_and_explicit_no_hooks_reset_values": true + }, + "held_native_window": false, + "native_stopped_fence": false, + "native_disposition": "withheld: exact completed authenticated scope, independent owner/founder dispositions, runtime/controller/storage/custody/trust/session/record gates remain open", + "other_owner_assents_authored": false, + "execution_authorized": false, + "source_preparation_incremental_eur": 0 +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/prepare.py b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/prepare.py new file mode 100644 index 00000000..a7cf6894 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/prepare.py @@ -0,0 +1,136 @@ +#!/usr/bin/env python3 +"""Offline source render only. Image receipt is deliberately a separate input.""" +import argparse +import difflib +import hashlib +import importlib.util +import io +import json +from pathlib import Path +import re +import subprocess +import sys +import tarfile +import tempfile +import yaml + +HERE = Path(__file__).resolve().parent +SOURCE = Path('/home/worsch/access-engine') +REVISION = 'dc042022f7c30671cf0a7605cf43ef6d96d04242' +IMAGE_REVISION = '84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0' +PLATFORM_REVISION = '84c529f239c81e6d3ca337015700b03e3a862f53' +NATIVE_SHA256 = 'sha256:4fb9ce6608ad04c4f5dc98a95796dc88a08a2453dc15c0d40c5c688fc02f573f' +NATIVE = Path('/home/worsch/railiance-platform/scripts/flex_auth_signer_native.py') +PATHS = ['charts/flex-auth', 'values/secrets-engine.yaml', + 'examples/secrets-engine/policy_package.md', 'examples/secrets-engine/registry_snapshot.json'] + +def sha(data): + return 'sha256:' + hashlib.sha256(data).hexdigest() + +def write_json(name, value): + (HERE / name).write_text(json.dumps(value, indent=2) + '\n') + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--image-receipt', type=Path) + args = parser.parse_args() + assert args.image_receipt, 'verified separately pinned immutable image receipt required' + receipt = json.loads(args.image_receipt.read_text()) + assert receipt['source_revision'] == IMAGE_REVISION + assert receipt['ordinary_push'] is True and receipt['terminal_status'] == 'success' + digest = receipt['manifest_digest'] + assert receipt['publisher_receipt']['revision'] == IMAGE_REVISION + assert receipt['publisher_receipt']['manifest_digest'] == digest + assert receipt['independent_public_registry_package']['explicit_revision_label'] == IMAGE_REVISION + assert receipt['independent_public_registry_package']['sole_manifest_digest'] == digest + assert receipt['immutable_image'] == 'forgejo.coulomb.social/coulomb/flex-auth@' + digest + assert re.fullmatch(r'sha256:[0-9a-f]{64}', digest) and digest != 'sha256:' + '0' * 64 + overlay = { + 'image': {'repository': 'forgejo.coulomb.social/coulomb/flex-auth', 'digest': digest}, + 'replicaCount': 1, + 'envelopeSigning': {'enabled': True, 'kid': 'flex-auth-lifecycle-20261016-r1', + 'secretName': 'flex-auth-secrets-engine-envelope-signing', 'secretKey': 'seed', + 'mountPath': '/var/run/secrets/decision-envelope-signing'}, + 'outbox': {'enabled': True, 'source': 'flex-auth.secrets-engine', + 'mountPath': '/var/lib/flex-auth/outbox', 'size': '1Gi', 'maxBytes': 67108864, + 'storageClassName': 'local-path', 'existingClaim': ''}, + 'auditDelivery': {'enabled': False}, + } + (HERE / 'activation-values.proposed.yaml').write_text(yaml.safe_dump(overlay, sort_keys=False)) + stopped_overlay = dict(overlay, replicaCount=0) + (HERE / 'stopped-values.proposed.yaml').write_text(yaml.safe_dump(stopped_overlay, sort_keys=False)) + archive = subprocess.run(['git', '-C', str(SOURCE), 'archive', REVISION, *PATHS], + capture_output=True, check=True).stdout + with tempfile.TemporaryDirectory(prefix='access-signer-rollout-r2-') as directory: + source = Path(directory) + with tarfile.open(fileobj=io.BytesIO(archive)) as tar: + files = {m.name: sha(tar.extractfile(m).read()) for m in tar.getmembers() if m.isfile()} + tar.extractall(source, filter='data') + base = ['helm', 'template', 'flex-auth-secrets-engine', str(source / 'charts/flex-auth'), + '--namespace', 'flex-auth', '-f', str(source / 'values/secrets-engine.yaml')] + retained = subprocess.run(base, capture_output=True, check=True, text=True).stdout + def render(replicas): + return subprocess.run(base + ['-f', str(HERE / ('activation-values.proposed.yaml' if replicas else 'stopped-values.proposed.yaml'))], capture_output=True, check=True, text=True).stdout + ready, stopped = render(1), render(0) + # No PodTemplate mutation: Helm alone renders the maintenance state. + (HERE / 'retained-source-render.yaml').write_text(retained) + (HERE / 'activation-source-render.yaml').write_text(ready) + (HERE / 'stopped-source-render.yaml').write_text(stopped) + (HERE / 'source-render.diff').write_text(''.join(difflib.unified_diff(retained.splitlines(True), + ready.splitlines(True), fromfile='retained-values-chart-dc0420', tofile='proposed-signer-image84-chart-dc0420'))) + # Call the actual committed Platform algorithm, rather than copy its projection. + committed_native = subprocess.run(['git', '-C', str(NATIVE.parents[1]), 'show', PLATFORM_REVISION + ':scripts/flex_auth_signer_native.py'], capture_output=True, check=True).stdout + assert sha(committed_native) == sha(NATIVE.read_bytes()) == NATIVE_SHA256 + sys.path.insert(0, str(NATIVE.parent)) + spec = importlib.util.spec_from_file_location('rollout_native_projection', NATIVE) + native = importlib.util.module_from_spec(spec) + spec.loader.exec_module(native) + docs = [d for d in yaml.safe_load_all(ready) if d] + dep = next(d for d in docs if d['kind'] == 'Deployment') + stopped_dep = next(d for d in yaml.safe_load_all(stopped) if d and d['kind'] == 'Deployment') + projection = native.deployment_projection(dep) + assert projection == native.deployment_projection(stopped_dep) + normalized = json.loads(json.dumps(dep)) + normalized['spec']['replicas'] = 0 + assert normalized == stopped_dep + assert sha((HERE.parent / 'rollout-r1/manifest.json').read_bytes()) == 'sha256:6b9292aab59f9ca8012be00f50027ded6a12018a3b36b011ef953d448e75e3dc' + assert native.digest(native.encoded(projection)) == 'sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c' + c = dep['spec']['template']['spec']['containers'][0] + old = next(d for d in yaml.safe_load_all(retained) if d and d['kind'] == 'Deployment') + oldc = old['spec']['template']['spec']['containers'][0] + assert c['resources'] == oldc['resources'] + for flag in ['--caller-audience', '--caller-auth-mode', '--caller-binding', '--caller-kubernetes-url', '--policy', '--registry']: + assert c['args'][c['args'].index(flag)+1] == oldc['args'][oldc['args'].index(flag)+1] + assert dep['spec']['strategy'] == {'type': 'Recreate'} + assert all(d['kind'] != 'Secret' for d in docs) + assert all(d['kind'] != 'Ingress' for d in docs) + other = lambda ds: [d for d in ds if d['kind'] not in ('Deployment', 'PersistentVolumeClaim')] + assert other(docs) == other([d for d in yaml.safe_load_all(retained) if d]) + write_json('source-deployment-projection.json', projection) + (HERE / 'source-projection.canonical.json').write_bytes(native.encoded(projection)) + for path in PATHS[2:]: + image_bytes = subprocess.run(['git', '-C', str(SOURCE), 'show', IMAGE_REVISION + ':' + path], capture_output=True, check=True).stdout + assert sha(image_bytes) == files[path], 'image and chart source policy/registry differ' + write_json('render-evidence.json', { + 'schema': 'access-engine.signer-rollout-source-render.v2', + 'source_revision': REVISION, 'image_source_revision': IMAGE_REVISION, + 'platform_source_revision': PLATFORM_REVISION, 'source_files': files, + 'package_revision': 'd52f811ed5ec0be27c9c367e71d476125b3228be', + 'package_baseline': 'extraction2b/current05a; unchanged, not this activation successor', + 'image_state': 'separately-pinned-verified-ordinary-ci-source-candidate', + 'image_receipt_sha256': sha(args.image_receipt.read_bytes()), + 'source_rendered_projection_sha256': native.digest(native.encoded(projection)), + 'deployment_projection_sha256': native.digest(native.encoded(projection)), + 'projection_algorithm_sha256': sha(NATIVE.read_bytes()), + 'native_stopped_projection_verified': False, + 'native_admission': False, 'execution_authorized': False, + 'source_checks': {'both_states_actual_helm_render': True, 'caller_policy_registry_resources_unchanged': True, + 'nondeployment_resources_unchanged_except_new_pvc': True, + 'replicas0_and1_projection_equal': True, 'no_secret_generated': True}, + 'artifacts': {name: sha((HERE / name).read_bytes()) for name in [ + 'activation-values.proposed.yaml', 'stopped-values.proposed.yaml', 'source-projection.canonical.json', 'retained-source-render.yaml', 'activation-source-render.yaml', + 'stopped-source-render.yaml', 'source-render.diff', 'source-deployment-projection.json']}, + }) + +if __name__ == '__main__': + main() diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/render-evidence.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/render-evidence.json new file mode 100644 index 00000000..7713ef6e --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/render-evidence.json @@ -0,0 +1,47 @@ +{ + "schema": "access-engine.signer-rollout-source-render.v2", + "source_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "image_source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "platform_source_revision": "84c529f239c81e6d3ca337015700b03e3a862f53", + "source_files": { + "charts/flex-auth/Chart.yaml": "sha256:e8e00d968a8ba2783f81312cebe27f0315e29f0b663033886d4104bab6a1b455", + "charts/flex-auth/templates/_helpers.tpl": "sha256:1e4a3ef486202b54d245060d2ee357880ee5b117732b2152bb4f75b489e0dc81", + "charts/flex-auth/templates/deployment.yaml": "sha256:26e29618b9110bdd9d8aa73aae432a95c757a4f46e567ce4fe429c60bd519026", + "charts/flex-auth/templates/networkpolicy.yaml": "sha256:53d8ae1851b66c8c9f990fc56bc8ad9076741e2684f39470a7e1583b093d9c14", + "charts/flex-auth/templates/outbox-pvc.yaml": "sha256:284a78b0fd10537490f4f62e58c0cd85eb07b4222e932eb098c1bc5ddda8387d", + "charts/flex-auth/templates/rbac.yaml": "sha256:07033364ec9624f25e0a4ebaac9c29bc25edac93fde2c514fd946596e428e580", + "charts/flex-auth/templates/service.yaml": "sha256:9af858c02268d0492352ebe09efe7b6750711d48624a054b05e85707bf6a4e97", + "charts/flex-auth/templates/serviceaccount.yaml": "sha256:a62caa647b4a55f0092214c6a200bd3a6f34fa97d8989c55a387429a487bd6c8", + "charts/flex-auth/values.yaml": "sha256:0d5c3fa0c52d87ff6350d8f92527814b74bb8b7adadc92ded71856d9c83b1b03", + "examples/secrets-engine/policy_package.md": "sha256:657fa9312c9dcabee059ec31c89ee13396fe9aa54d852edc9e6559a74bbc139a", + "examples/secrets-engine/registry_snapshot.json": "sha256:37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c", + "values/secrets-engine.yaml": "sha256:567189d14467815a77df5ad7e0f22e7184c8e5bb9f814cbc0fbb99102b3cfd55" + }, + "package_revision": "d52f811ed5ec0be27c9c367e71d476125b3228be", + "package_baseline": "extraction2b/current05a; unchanged, not this activation successor", + "image_state": "separately-pinned-verified-ordinary-ci-source-candidate", + "image_receipt_sha256": "sha256:af8e032d28776722ccf2bfe0f884577e568d8d0fb3713aa869e1d7d1c77c576f", + "source_rendered_projection_sha256": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "deployment_projection_sha256": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "projection_algorithm_sha256": "sha256:4fb9ce6608ad04c4f5dc98a95796dc88a08a2453dc15c0d40c5c688fc02f573f", + "native_stopped_projection_verified": false, + "native_admission": false, + "execution_authorized": false, + "source_checks": { + "both_states_actual_helm_render": true, + "caller_policy_registry_resources_unchanged": true, + "nondeployment_resources_unchanged_except_new_pvc": true, + "replicas0_and1_projection_equal": true, + "no_secret_generated": true + }, + "artifacts": { + "activation-values.proposed.yaml": "sha256:e76a30967add800ed8b588368757e7a5fa0ce4d8305ef658b5a4a08e377eb5b8", + "stopped-values.proposed.yaml": "sha256:6e6f4bdd6ed1f9994f87e51b24186ba923515419b30d9c187c288f7db05e3a77", + "source-projection.canonical.json": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "retained-source-render.yaml": "sha256:f979f7d05d5b0a54e3b8ac7c413aa4d401139f991b43412cdbde3d63249b0dd9", + "activation-source-render.yaml": "sha256:b7edecb8ec50a6d2db7623a3d962dbece46de81d3809d5f73b3aca20ff76b8c7", + "stopped-source-render.yaml": "sha256:03b631f0fe17c63494c14619199f69f2a2a9ab245d00f1ec441248868b24c071", + "source-render.diff": "sha256:d510bbe9ff280f49f86ad67355774fbf76e32c36c129bd593b4be5b257dccd67", + "source-deployment-projection.json": "sha256:056b6bf842713fb9a328dae901401d6867da47da68bfb8a4904bb0d7b8d9e912" + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/retained-source-render.yaml b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/retained-source-render.yaml new file mode 100644 index 00000000..44d6f4e4 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/retained-source-render.yaml @@ -0,0 +1,191 @@ +--- +# Source: flex-auth/templates/networkpolicy.yaml +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: flex-auth-secrets-engine + policyTypes: + - Ingress + - Egress + egress: + - ports: + - port: 443 + protocol: TCP + - port: 6443 + protocol: TCP + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: secrets-engine + podSelector: + matchLabels: + app.kubernetes.io/name: secrets-engine + ports: + - port: 8080 + protocol: TCP +--- +# Source: flex-auth/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +automountServiceAccountToken: false +--- +# Source: flex-auth/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flex-auth-secrets-engine-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +rules: + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +--- +# Source: flex-auth/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: flex-auth-secrets-engine-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flex-auth-secrets-engine-tokenreviewer +subjects: + - kind: ServiceAccount + name: flex-auth-secrets-engine + namespace: flex-auth +--- +# Source: flex-auth/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + selector: + app.kubernetes.io/name: flex-auth-secrets-engine + ports: + - name: http + port: 8080 + targetPort: http +--- +# Source: flex-auth/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: flex-auth-secrets-engine + template: + metadata: + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth + spec: + automountServiceAccountToken: false + serviceAccountName: flex-auth-secrets-engine + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - name: flex-auth + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd + imagePullPolicy: IfNotPresent + args: + - serve + - --addr + - 0.0.0.0:8080 + - --registry + - /opt/flex-auth/examples/secrets-engine/registry_snapshot.json + - --policy + - /opt/flex-auth/examples/secrets-engine/policy_package.md + - --caller-audience + - "flex-auth" + - --caller-auth-mode + - "enforce" + - --caller-kubernetes-url + - "https://10.43.0.1" + - --caller-binding + - "secrets-engine=system:serviceaccount:secrets-engine:secrets-engine" + ports: + - name: http + containerPort: 8080 + livenessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 20 + readinessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 5 + resources: + limits: + cpu: 300m + memory: 192Mi + requests: + cpu: 25m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /var/run/secrets/flex-auth-reviewer + name: flex-auth-reviewer + readOnly: true + volumes: + - name: flex-auth-reviewer + projected: + defaultMode: 0440 + sources: + - serviceAccountToken: + expirationSeconds: 3600 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-deployment-projection.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-deployment-projection.json new file mode 100644 index 00000000..6882e3a3 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-deployment-projection.json @@ -0,0 +1,102 @@ +{ + "service_account": "flex-auth-secrets-engine", + "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f", + "args": [ + "serve", + "--addr", + "0.0.0.0:8080", + "--registry", + "/opt/flex-auth/examples/secrets-engine/registry_snapshot.json", + "--policy", + "/opt/flex-auth/examples/secrets-engine/policy_package.md", + "--envelope-signing-key-file", + "/var/run/secrets/decision-envelope-signing/seed", + "--envelope-signing-kid", + "flex-auth-lifecycle-20261016-r1", + "--outbox-max-bytes", + "67108864", + "--outbox-dir", + "/var/lib/flex-auth/outbox", + "--emission-source", + "flex-auth.secrets-engine", + "--caller-audience", + "flex-auth", + "--caller-auth-mode", + "enforce", + "--caller-kubernetes-url", + "https://10.43.0.1", + "--caller-binding", + "secrets-engine=system:serviceaccount:secrets-engine:secrets-engine" + ], + "volume_mounts": [ + { + "mountPath": "/var/run/secrets/decision-envelope-signing", + "name": "flex-auth-envelope-signing", + "readOnly": true + }, + { + "mountPath": "/var/lib/flex-auth/outbox", + "name": "flex-auth-outbox" + }, + { + "mountPath": "/var/run/secrets/flex-auth-reviewer", + "name": "flex-auth-reviewer", + "readOnly": true + } + ], + "volumes": [ + { + "name": "flex-auth-envelope-signing", + "secret": { + "secretName": "flex-auth-secrets-engine-envelope-signing", + "defaultMode": 288, + "items": [ + { + "key": "seed", + "path": "seed" + } + ] + } + }, + { + "name": "flex-auth-outbox", + "persistentVolumeClaim": { + "claimName": "flex-auth-secrets-engine-outbox" + } + }, + { + "name": "flex-auth-reviewer", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "expirationSeconds": 3600, + "path": "token" + } + }, + { + "configMap": { + "name": "kube-root-ca.crt", + "items": [ + { + "key": "ca.crt", + "path": "ca.crt" + } + ] + } + } + ] + } + } + ], + "security_context": { + "runAsNonRoot": true, + "runAsUser": 65532, + "runAsGroup": 65532, + "fsGroup": 65532, + "seccompProfile": { + "type": "RuntimeDefault" + } + } +} diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-projection.canonical.json b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-projection.canonical.json new file mode 100644 index 00000000..f183fdb1 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-projection.canonical.json @@ -0,0 +1 @@ +{"args":["serve","--addr","0.0.0.0:8080","--registry","/opt/flex-auth/examples/secrets-engine/registry_snapshot.json","--policy","/opt/flex-auth/examples/secrets-engine/policy_package.md","--envelope-signing-key-file","/var/run/secrets/decision-envelope-signing/seed","--envelope-signing-kid","flex-auth-lifecycle-20261016-r1","--outbox-max-bytes","67108864","--outbox-dir","/var/lib/flex-auth/outbox","--emission-source","flex-auth.secrets-engine","--caller-audience","flex-auth","--caller-auth-mode","enforce","--caller-kubernetes-url","https://10.43.0.1","--caller-binding","secrets-engine=system:serviceaccount:secrets-engine:secrets-engine"],"image":"forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f","security_context":{"fsGroup":65532,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}},"service_account":"flex-auth-secrets-engine","volume_mounts":[{"mountPath":"/var/run/secrets/decision-envelope-signing","name":"flex-auth-envelope-signing","readOnly":true},{"mountPath":"/var/lib/flex-auth/outbox","name":"flex-auth-outbox"},{"mountPath":"/var/run/secrets/flex-auth-reviewer","name":"flex-auth-reviewer","readOnly":true}],"volumes":[{"name":"flex-auth-envelope-signing","secret":{"defaultMode":288,"items":[{"key":"seed","path":"seed"}],"secretName":"flex-auth-secrets-engine-envelope-signing"}},{"name":"flex-auth-outbox","persistentVolumeClaim":{"claimName":"flex-auth-secrets-engine-outbox"}},{"name":"flex-auth-reviewer","projected":{"defaultMode":288,"sources":[{"serviceAccountToken":{"expirationSeconds":3600,"path":"token"}},{"configMap":{"items":[{"key":"ca.crt","path":"ca.crt"}],"name":"kube-root-ca.crt"}}]}}]} \ No newline at end of file diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-render.diff b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-render.diff new file mode 100644 index 00000000..a7220607 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/source-render.diff @@ -0,0 +1,89 @@ +--- retained-values-chart-dc0420 ++++ proposed-signer-image84-chart-dc0420 +@@ -44,6 +44,25 @@ + app.kubernetes.io/part-of: flex-auth + automountServiceAccountToken: false + --- ++# Source: flex-auth/templates/outbox-pvc.yaml ++apiVersion: v1 ++kind: PersistentVolumeClaim ++metadata: ++ name: flex-auth-secrets-engine-outbox ++ annotations: ++ helm.sh/resource-policy: keep ++ labels: ++ app.kubernetes.io/name: flex-auth-secrets-engine ++ app.kubernetes.io/instance: flex-auth-secrets-engine ++ app.kubernetes.io/part-of: flex-auth ++spec: ++ accessModes: ++ - ReadWriteOnce ++ storageClassName: "local-path" ++ resources: ++ requests: ++ storage: "1Gi" ++--- + # Source: flex-auth/templates/rbac.yaml + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole +@@ -106,6 +125,8 @@ + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth + spec: ++ strategy: ++ type: Recreate + replicas: 1 + selector: + matchLabels: +@@ -128,7 +149,7 @@ + type: RuntimeDefault + containers: + - name: flex-auth +- image: forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd ++ image: forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f + imagePullPolicy: IfNotPresent + args: + - serve +@@ -138,6 +159,16 @@ + - /opt/flex-auth/examples/secrets-engine/registry_snapshot.json + - --policy + - /opt/flex-auth/examples/secrets-engine/policy_package.md ++ - --envelope-signing-key-file ++ - "/var/run/secrets/decision-envelope-signing/seed" ++ - --envelope-signing-kid ++ - "flex-auth-lifecycle-20261016-r1" ++ - --outbox-max-bytes ++ - "67108864" ++ - --outbox-dir ++ - "/var/lib/flex-auth/outbox" ++ - --emission-source ++ - "flex-auth.secrets-engine" + - --caller-audience + - "flex-auth" + - --caller-auth-mode +@@ -173,10 +204,25 @@ + - ALL + readOnlyRootFilesystem: true + volumeMounts: ++ - mountPath: "/var/run/secrets/decision-envelope-signing" ++ name: flex-auth-envelope-signing ++ readOnly: true ++ - mountPath: "/var/lib/flex-auth/outbox" ++ name: flex-auth-outbox + - mountPath: /var/run/secrets/flex-auth-reviewer + name: flex-auth-reviewer + readOnly: true + volumes: ++ - name: flex-auth-envelope-signing ++ secret: ++ secretName: "flex-auth-secrets-engine-envelope-signing" ++ defaultMode: 0440 ++ items: ++ - key: "seed" ++ path: seed ++ - name: flex-auth-outbox ++ persistentVolumeClaim: ++ claimName: "flex-auth-secrets-engine-outbox" + - name: flex-auth-reviewer + projected: + defaultMode: 0440 diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/stopped-source-render.yaml b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/stopped-source-render.yaml new file mode 100644 index 00000000..3357fd79 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/stopped-source-render.yaml @@ -0,0 +1,237 @@ +--- +# Source: flex-auth/templates/networkpolicy.yaml +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + podSelector: + matchLabels: + app.kubernetes.io/name: flex-auth-secrets-engine + policyTypes: + - Ingress + - Egress + egress: + - ports: + - port: 443 + protocol: TCP + - port: 6443 + protocol: TCP + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: secrets-engine + podSelector: + matchLabels: + app.kubernetes.io/name: secrets-engine + ports: + - port: 8080 + protocol: TCP +--- +# Source: flex-auth/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +automountServiceAccountToken: false +--- +# Source: flex-auth/templates/outbox-pvc.yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: flex-auth-secrets-engine-outbox + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + accessModes: + - ReadWriteOnce + storageClassName: "local-path" + resources: + requests: + storage: "1Gi" +--- +# Source: flex-auth/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flex-auth-secrets-engine-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +rules: + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +--- +# Source: flex-auth/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: flex-auth-secrets-engine-tokenreviewer + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: flex-auth-secrets-engine-tokenreviewer +subjects: + - kind: ServiceAccount + name: flex-auth-secrets-engine + namespace: flex-auth +--- +# Source: flex-auth/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + selector: + app.kubernetes.io/name: flex-auth-secrets-engine + ports: + - name: http + port: 8080 + targetPort: http +--- +# Source: flex-auth/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: flex-auth-secrets-engine + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth +spec: + strategy: + type: Recreate + replicas: 0 + selector: + matchLabels: + app.kubernetes.io/name: flex-auth-secrets-engine + template: + metadata: + labels: + app.kubernetes.io/name: flex-auth-secrets-engine + app.kubernetes.io/instance: flex-auth-secrets-engine + app.kubernetes.io/part-of: flex-auth + spec: + automountServiceAccountToken: false + serviceAccountName: flex-auth-secrets-engine + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - name: flex-auth + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f + imagePullPolicy: IfNotPresent + args: + - serve + - --addr + - 0.0.0.0:8080 + - --registry + - /opt/flex-auth/examples/secrets-engine/registry_snapshot.json + - --policy + - /opt/flex-auth/examples/secrets-engine/policy_package.md + - --envelope-signing-key-file + - "/var/run/secrets/decision-envelope-signing/seed" + - --envelope-signing-kid + - "flex-auth-lifecycle-20261016-r1" + - --outbox-max-bytes + - "67108864" + - --outbox-dir + - "/var/lib/flex-auth/outbox" + - --emission-source + - "flex-auth.secrets-engine" + - --caller-audience + - "flex-auth" + - --caller-auth-mode + - "enforce" + - --caller-kubernetes-url + - "https://10.43.0.1" + - --caller-binding + - "secrets-engine=system:serviceaccount:secrets-engine:secrets-engine" + ports: + - name: http + containerPort: 8080 + livenessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 20 + readinessProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 5 + resources: + limits: + cpu: 300m + memory: 192Mi + requests: + cpu: 25m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: "/var/run/secrets/decision-envelope-signing" + name: flex-auth-envelope-signing + readOnly: true + - mountPath: "/var/lib/flex-auth/outbox" + name: flex-auth-outbox + - mountPath: /var/run/secrets/flex-auth-reviewer + name: flex-auth-reviewer + readOnly: true + volumes: + - name: flex-auth-envelope-signing + secret: + secretName: "flex-auth-secrets-engine-envelope-signing" + defaultMode: 0440 + items: + - key: "seed" + path: seed + - name: flex-auth-outbox + persistentVolumeClaim: + claimName: "flex-auth-secrets-engine-outbox" + - name: flex-auth-reviewer + projected: + defaultMode: 0440 + sources: + - serviceAccountToken: + expirationSeconds: 3600 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt diff --git a/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/stopped-values.proposed.yaml b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/stopped-values.proposed.yaml new file mode 100644 index 00000000..bd87934d --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/stopped-values.proposed.yaml @@ -0,0 +1,20 @@ +image: + repository: forgejo.coulomb.social/coulomb/flex-auth + digest: sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f +replicaCount: 0 +envelopeSigning: + enabled: true + kid: flex-auth-lifecycle-20261016-r1 + secretName: flex-auth-secrets-engine-envelope-signing + secretKey: seed + mountPath: /var/run/secrets/decision-envelope-signing +outbox: + enabled: true + source: flex-auth.secrets-engine + mountPath: /var/lib/flex-auth/outbox + size: 1Gi + maxBytes: 67108864 + storageClassName: local-path + existingClaim: '' +auditDelivery: + enabled: false diff --git a/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-50de8be.json b/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-50de8be.json new file mode 100644 index 00000000..5f47bf7a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/checkpoint-sync-50de8be.json @@ -0,0 +1,16 @@ +{ + "session_id": 79088, + "exit_code": 0, + "source_revision": "50de8be7f9c03e22ccd377ebd64c54171ecd2248", + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 7, + "info": 4 + }, + "bindings": "89/89", + "pushed": true, + "generated_only_commit_refused": true, + "unrelated_staging_preserved": true, + "native_acceptance": false +} diff --git a/docs/changes/netkingdom-target-2026-10-16/native-preparation-successor-review.json b/docs/changes/netkingdom-target-2026-10-16/native-preparation-successor-review.json new file mode 100644 index 00000000..2a59e208 --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/native-preparation-successor-review.json @@ -0,0 +1,23 @@ +{ + "checked_at": "2026-10-16T18:36:16.650310+00:00", + "rollout_r2": { + "manifest_sha256": "sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59", + "all_manifest_hashes_verified": true, + "fresh_root_helm_renders_byte_identical": true, + "chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242", + "image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0", + "projection": "sha256:8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c", + "source_only": true, + "native_fence": false + }, + "platform_p4": { + "manifest_sha256": "sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3", + "all_manifest_hashes_verified": true, + "root_p3_assembler_tests": 8, + "p4_executor_tests_scope_byte_identical": true, + "p3_finding": "README stale cluster controller ownership corrected in preserved P4 successor", + "native_authority_fields_null": true, + "approval_authenticated": false + }, + "closed_tsa_gates": 0 +} diff --git a/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-adapter-r2/native-packet-p4/README.md b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-adapter-r2/native-packet-p4/README.md new file mode 100644 index 00000000..0ea8320a --- /dev/null +++ b/docs/changes/netkingdom-target-2026-10-16/platform-signer-custody/native-adapter-r2/native-packet-p4/README.md @@ -0,0 +1,48 @@ +# Exact Platform custody packet P4 + +`RPF35-PDP-SIGNER-NATIVE-PACKET-20261016-P4` proposes one attended bootstrap under native action `RPF35-PDP-SIGNER-NATIVE-20261016-R1`. It selects the existing legacy flex-auth repository's immutable candidate `forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f`, source `84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0`. Ordinary publisher402 and both Smoke401 jobs succeeded; independent public package metadata reports the same sole digest and explicit revision label. P1/P2 candidate/source/review and failed400 evidence stay unchanged. Candidate provenance grants no runtime/custody/trust admission. + +`evidence-pins.json` binds exact committed Platform R5 `84c529f239c81e6d3ca337015700b03e3a862f53` source modules/plan, installed routing receipt, published candidate and local package d52/tree d4fb. Package baseline2b/current05a remains frozen; its local draft resolution is not adoption of84 or signer activation. `admission-scope.incomplete.json` is approval-free preparation and intentionally cannot execute. Missing nulls require the separate inputs below. Proposed failclosed pre-key consumer baseline and source projection, if filled, are pinned for review; they do not attest live installation or actual native fence. No new public key/fingerprint exists before custody. + +## Next actual scoped owner-review inputs + +1. Platform + founder: independently disposition exact CCR0050/read-policy/role/delivery scope and distinct one-use CAS0 writer scope. Current CCR remains proposed with bound_claims_confirmed=false; its current hash is evidence only and is not inserted as an approved CCR hash. After separately authorized apply/readback, bind exact approved/binding-confirmed bytes in ccr_sha256. Verify dedicated ESO SA/namespace/audience, exact policy, role15m ttl/max/explicit-max/no-default, no metadata/list/sibling/write grants. Source status edits are not native binding evidence. +2. Access (workload/Helm), Platform (GitOps Application/sync-freeze integration), and cluster-runtime-storage-owner (runtime/storage/headroom), each within its separate scope: review exact P4 rollout source render and candidate image/kid/caller/mount/security/outbox values. Approve actual stopped deployment/frozen competing writers, stopped consumer, zero signer-SA/seed-mount/owned or terminating pods, no HPA, all owned ReplicaSets0 and deployment observed generation caught up. Supply authenticated exact future native deployment_projection artifact computed by the committed projection function and show it equals the proposed hash. A local source projection cannot establish these current observations. Supply exclusive-window artifact/hash naming founder executor/abort owner, competing controllers, readiness120s abort and recovery10m holdfenced. PVC1Gi/local-path/Helmkeep plus actual dynamically bound PV Retain, headroom/server-dry-run/client-diff and rollback are distinct approvals. +3. Secrets: review exact built-wheel/helper/verifier/config/empty-trust baseline and planned install location. Pre-key empty trust is proposed failclosed and grants no signer acceptance. After authenticating Platform's public receipt, independently admit new key/kid/publickey fingerprint and successor trust, never discover from KV/responder. Fingerprint is SHA256 of canonical unpadded base64url public-key ASCII43bytes. Bounded TokenRequest/callerfile custody/installed trust/named-pod literal-loopback session remain separate approvals; no session is minted here. +4. Founder/Platform: independently identify exact non-root OpenBao founder entity UUID, trusted runtime/dependencies/private custody directory, exact fixed command and admission file hash. No agent token lookup/login is required to prepare it. The child later verifies auth/netkingdom/platform-admin/entity and backend identity. Existing supervised record and Warden containment do not establish same-UID hostile-code isolation. +5. Five distinct owner dispositions (Platform, Access, Secrets, cluster-runtime-storage-owner, founder) must bind the completed approval-free scope SHA256, including exact approved CCR, source/image/projection/trust/window/expiry/entity. Platform's packet assent is preparation only. Collect actual external reference strings after their reviews; never manufacture them. Founder disposition must approve the exact private file hash and command/source plus high-risk custody/outage/loss scope. +6. Select a future absolute UTC expires_at after coordinating the ceremony, not by auto-filling now+120. Reviews may finish before its window. Warden OIDC precedes child without proven timing bound; child must start at5