From c377f0d12c59b68376061e8f8609b9171eefbec5 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 16 Aug 2026 09:45:46 +0200 Subject: [PATCH] Mark flex-auth drain-plan row 23 on target FLEX-WP-0011-T03: runtime already lives on railiance01; coulombcore has no flex-auth namespace. Wave 7.3 is only an identity-endpoint follow-up. --- docs/coulombcore-drain-placement-plan.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/coulombcore-drain-placement-plan.md b/docs/coulombcore-drain-placement-plan.md index a6eaa2f..436e5be 100644 --- a/docs/coulombcore-drain-placement-plan.md +++ b/docs/coulombcore-drain-placement-plan.md @@ -54,7 +54,7 @@ Wave 8 coulombcore phoenix → railiance02 ─── CUST-WP-0054-T09 | 20 | **Authelia** | coulombcore | railiance01 | Identity front door | `key-cape` / `railiance-platform` | 7 | grandfathered | | 21 | **privacyIDEA** | coulombcore | railiance01 | MFA backend | `key-cape` | 7 | grandfathered | | 22 | **lldap** | coulombcore | railiance01 | LDAP directory | `key-cape` / `railiance-platform` | 7 | grandfathered | -| 23 | **flex-auth** | coulombcore | railiance01 | Policy registry follows identity | `flex-auth` | 7 | grandfathered | +| 23 | **flex-auth** | railiance01 `flex-auth` ns | railiance01 (retain) | Host drain complete 2026-08-16 (`FLEX-WP-0011-T03`): runtime already on railiance01; coulombcore has no `flex-auth` namespace or Deployments. Identity-endpoint follow-up stays with Wave 7 if KeyCape/OpenBao move. | `FLEX-WP-0011` | — | **on target** | | 24 | **Fleet mesh transit tunnels** | railiance01 systemd → coulombcore ClusterIPs | railiance01-local services | Retire when Waves 2+4 complete (hub + issue-core local) | `CUST-WP-0054-T02` | 2–4 | **interim active** | | 25 | **CNPG operator** | coulombcore (boundary note) | railiance01 | Platform operator moves with Wave 2+ workloads | `railiance-platform` | 2–7 | grandfathered | | 26 | **coulombcore host identity** | coulombcore | railiance02 | Machine phoenix after Wave 7 | `CUST-WP-0054-T09`, `CUST-WP-0054-T08` | 8 | wait | @@ -146,7 +146,7 @@ Each uses staged-promotion unless listed under **Documented exceptions**. | --- | --- | --- | | 7.1 | OpenBao staged-promotion to railiance01 | Unseal automation (`NET-WP-0020`) proven | | 7.2 | KeyCape / Authelia / privacyIDEA / lldap migration | OIDC login smoke on railiance01 | -| 7.3 | flex-auth registry points at new identity endpoints | Credential lanes re-pointed | +| 7.3 | flex-auth identity-endpoint re-point after OpenBao/KeyCape move | Host drain is done (row 23 **on target**, 2026-08-16). Remaining work is only if Wave 7 identity issuers change; there is no coulombcore flex-auth left to migrate. | | 7.4 | CCR/applier paths verified | No production secret reads from coulombcore OpenBao | **Gate:** `CUST-WP-0054-T09` cannot start until Wave 7 completes.