Retain native preflight and independent signer rollout reviews
This commit is contained in:
codex
parent
3291a660ae
commit
cf59a5f9ab
25 changed files with 7950 additions and 0 deletions
|
|
@ -0,0 +1,49 @@
|
|||
{
|
||||
"schema": "access-engine.bounded-native-plan-review.v1",
|
||||
"reviewer": "access-engine-owner (agent access-engine, codex)",
|
||||
"review_role": "access-engine-owner",
|
||||
"work_item": "FLEX-WP-0024-T06",
|
||||
"proposal_id": "FLEX24-SIGNER-ROLLOUT-20261016-R1",
|
||||
"decision": "approved",
|
||||
"scope": "Exact Access-owned R2/P4 workload/Helm, known writer acknowledgement, single-writer/outbox and stopped-only rollback plan, with execution-supplement.md mandatory. Owner plan review only; no live scope disposition or founder authority.",
|
||||
"reviewed_at": "2026-10-16T19:09:30.558245+00:00",
|
||||
"intent_basis": "Access Engine is Engine/PDP, owns decision production and its record; caller identity, protected enforcement, custody, Platform Applications and cluster storage remain independently owned.",
|
||||
"frozen_input_sha256": {
|
||||
"access-native-admission/rollout-r2/manifest.json": "5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
|
||||
"platform-signer-custody/native-adapter-r2/native-packet-p4/manifest.json": "9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3",
|
||||
"native-preflight-r1/live-preflight.json": "7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b",
|
||||
"native-preflight-r1/cluster-native-plan-review.json": "76e5e3c10cf62d93c801c08f0275f84cd523010f58a7c5db595dee2081ffa572"
|
||||
},
|
||||
"chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
|
||||
"image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
||||
"image_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
||||
"deployment_projection_sha256": "8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c",
|
||||
"execution_supplement_sha256": "2622cf68d33f5e5f4ede68655c250f70a8132ed03cb4b7c33bdbeec86100e25d",
|
||||
"verification_sha256": "05e88b9c4362a9655be7ac19533fa3079558e7d2b57c446b90729a40cc88766f",
|
||||
"findings_resolved_by_supplement": [
|
||||
"Names actual Helm/source/CI and legacy alternate paths; owner/founder acknowledgement establishes bounded manual window without hypothetical-writer proof",
|
||||
"Supplies exact stopped-only history rollback shape and requires no concurrent Helm recovery during in-flight atomic rollback",
|
||||
"Separates independent 120-second stop/readiness gates from Helm automatic rollback duration and 600-second founder recovery decision",
|
||||
"Retains native persistence negative proofs as separate admitted acceptance work, without destructive failure injection authorization"
|
||||
],
|
||||
"source_change_required": false,
|
||||
"actual_prechange_helm_revision": 4,
|
||||
"actual_stopped_helm_revision": null,
|
||||
"held_window": false,
|
||||
"native_fence": false,
|
||||
"execution_authorized": false,
|
||||
"completed_external_scope_disposition": false,
|
||||
"native_custody_trust_caller_admitted": false,
|
||||
"unresolved_authority": {
|
||||
"founder_entity": null,
|
||||
"founder_disposition": null,
|
||||
"executor": null,
|
||||
"absolute_window_start": null,
|
||||
"absolute_window_end": null,
|
||||
"expiry": null,
|
||||
"risk_loss_ceiling_eur": null,
|
||||
"custody_public_trust_caller_bindings": null
|
||||
},
|
||||
"other_owner_assents_authored": false,
|
||||
"task_status": "progress; owner plan review complete, actual native admission/execution remains open"
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
# Access native execution proposal supplement
|
||||
|
||||
Existing owner work: `FLEX-WP-0024-T06`. Proposal `FLEX24-SIGNER-ROLLOUT-20261016-R1`, frozen rollout R2 and Platform packet P4. This supplement completes the Access plan review; it grants no live action and changes no frozen resource, custody scope or protected effect.
|
||||
|
||||
Use the exact stop/ready argv in frozen R2 `command-plan.proposed.json`, with one verified materialized source root at Access `dc042022f7c30671cf0a7605cf43ef6d96d04242` and the frozen rollout directory. Verify every archived source/value/render digest first. Image remains independently pinned to `84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0` / OCI `sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f`. No source change or new image is required by this review.
|
||||
|
||||
## Actual writer paths and the maintenance acknowledgement
|
||||
|
||||
Access's writer is the operator executing Helm against release `flex-auth-secrets-engine` in namespace `flex-auth`, selecting `charts/flex-auth`, `values/secrets-engine.yaml` and the exact stopped/activation overlay. Access/founder acknowledgement must name the executor, absolute start/end, no competing manual Helm/scale/rollout/apply for this release, no in-flight release operation, prior Helm revision/status, and restoration criteria. That acknowledgement establishes the bounded manual window; it does not require proving absence of hypothetical writers across the estate.
|
||||
|
||||
Reviewed source has three CI workflows: `.forgejo/workflows/image.yaml` publishes immutable images using `tools/publish-runtime-images.sh`; `.forgejo/workflows/ci-smoke.yaml` probes runners; `.github/workflows/ci.yml` runs source checks. None performs a workload Helm upgrade or kubectl apply. Do not invent a CI deployment controller or disable unrelated image publication. For any additional actual deployment job identified by the executor, record its job/revision/prior state and hold it for this release during the window.
|
||||
|
||||
The dated preflight has no HPA, Job, CronJob, DaemonSet or StatefulSet in `flex-auth`. The existing Deployment and its UID-owned ReplicaSets remain the known pod writers; keep Kubernetes reconciliation active to implement replicas zero. Platform independently identifies and holds the affected Argo Application sync writers, records their prior state and absence of an in-flight sync, and restores them through its own criteria. Access does not claim that owner disposition. Refresh these known paths at window entry; new actual competing state requires reconciliation before advancing.
|
||||
|
||||
`deploy/README.md` emergency `kubectl apply` / `rollout undo` instructions refer to tenant/user consumers. `railiance/app.toml` generic Helm rollback, canary and previous-stable pins also cover other releases. None is the signer rollback recipe. Tenant/user/canary/readback/informed-decision workloads stay outside this change.
|
||||
|
||||
## Stop, start and recovery decisions
|
||||
|
||||
1. Verify the completed exact founder and owner scope, consumer fence, target identity and current nonsecret release metadata. The existing public receipt admits all seven exact resources through server dry-run, with exact source projection; it observes the old running unsigned 05a workload at Helm revision 4. It does not install the stopped candidate or reserve a window. Do not use revision 4 as the ready transition's rollback target.
|
||||
2. Start the stop clock immediately before the frozen stop invocation. Use reset-values/no-hooks/wait=false, without atomic. Within 120 seconds establish the installed candidate Deployment replicas zero, observedGeneration caught up, zero desired/status replicas across its UID-owned ReplicaSets, no live or terminating owned/signer-SA/seed-mount pods and no new actual competing writer. Compare the stopped native projection with `8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c`. Record the new exact deployed stopped Helm revision and its metadata/projection. A Pending WFFC claim is allowed. If stop fails or its state is unknown, keep consumers fenced, do not invoke custody, preserve the partial outcome and reconcile observed state; never auto-start the predecessor.
|
||||
3. Hold the acknowledged window and repeat the stopped fence/projection immediately before Platform's independently approved custody CAS. Custody key/trust/caller admission, founder identity/expiry and actual window remain unresolved here. Ambiguous custody outcomes preserve evidence and remain fenced; no retry/remint authorization follows.
|
||||
4. Before start verify the recorded stopped revision is still the latest deployed release, exact candidate configuration matches and no intervening Helm operation exists. The ready command's `--atomic --wait --timeout 120s` may roll back only to this exact stopped revision. Keep protected consumers fenced. Start an independent readiness clock immediately before the ready invocation: Ready must be observed within 120 seconds including WFFC provisioning/startup. Helm may spend additional time performing its automatic rollback; its return is not proof that the 120-second readiness gate passed. Do not issue a competing Helm stop/rollback while that operation is in flight or assume killing the client cancels server changes. Observe and reconcile the resulting release/workload state before another mutation.
|
||||
5. A stop/readiness failure or unknown outcome triggers the named abort owner/founder recovery decision within 600 seconds of the failure/deadline, or earlier if the absolute admitted window expires. This is a decision deadline, not permission to restart after expiry or an availability guarantee. The safe decision is continued consumer fence and stopped/unavailable signer; record any unresolved live pod explicitly. No deadline extends custody, trust or action authority.
|
||||
6. If the ready failure's automatic rollback did not demonstrably restore the stopped state, an independently authorized recovery invocation may use the exact frozen stop command against the same candidate source/config, after the prior Helm operation is reconciled. This resets replicas zero with no waiting on an unbound claim. If an explicit Helm history rollback is chosen instead, verify its recorded target below and retain the same independent 120-second stop observation. Neither path may target revision 4/current05a by assumption.
|
||||
|
||||
Explicit history rollback argument shape (not ready for execution until `STOPPED_REVISION` is observed and approved):
|
||||
|
||||
```json
|
||||
["helm", "rollback", "flex-auth-secrets-engine", "STOPPED_REVISION", "--namespace", "flex-auth", "--wait=false", "--timeout", "120s", "--no-hooks"]
|
||||
```
|
||||
|
||||
Before this invocation compare the exact target revision to the stopped source projection, immutable image, policy/registry, signing coordinates, PVC and zero replicas using a reviewed allowlisted metadata/projection path. No raw release values, Secret objects, annotations, logs or unfiltered errors enter receipts. No force, cleanup-on-fail, uninstall, delete, cursor reset, unsigned fallback, seed restore or CAS replay. Failed or partial rollback is retained as such; no success by command return alone.
|
||||
|
||||
## Persistence and acceptance
|
||||
|
||||
Recreate, replicas at most one and Linux nonblocking flock provide complementary source controls. Flock is acquired before outbox recovery and held until Close/process exit; deleting `writer.lock`, recreating paths or bypassing the process would invalidate exclusion. RWO is not a process lock. Native restart, sequence/cursor/signature parity and isolated lock/capacity/unwritable/fsync negative receipts remain acceptance gates; this review does not authorize destructive failure injection against the sole production journal. Their eventual exact safe execution procedure requires separate scoped review.
|
||||
|
||||
The journal ceiling is 67108864 bytes, record/atomic batch bound 2097152 bytes and cursor bound 4096 bytes. Commit failure prevents release of every effect; unconfirmed truncate/fsync recovery fences the writer. The 1Gi local-path request is not a hard quota or backup. WFFC binding must produce exact PVC UID/PV name/UID/claimRef/capacity/nodeAffinity; cluster owner separately authorizes and verifies Retain before durable acceptance. Preserve claim, PV, journal, cursor, signatures and receipts across every stop or rollback. No evidence migration to unsigned05a is approved.
|
||||
|
||||
Ready and `/healthz` only prove process availability. Before protected acceptance, require independently admitted public trust/delivery/caller; native lifecycle ALLOW/DENY records and installed Secrets verification; forged/altered/unsigned/wrong-pin/expired/caller negatives; preserved restart evidence and the separately admitted negative tests. No task source is enabled, `execute-ccr` remains denied, no backend effect or audit receiver acceptance is claimed. EUR0 source review is established; actual spend/risk-loss/outage/evidence-loss authority and all five final external dispositions remain absent.
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"blocked_blob_ids": [],
|
||||
"scanned_blobs": 16,
|
||||
"scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
|
||||
"scanner_version": "8.30.1",
|
||||
"scope": "changed-staged-blobs",
|
||||
"status": "clean"
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"schema": "access-engine.public-digest-format-successor.v1",
|
||||
"reason": "Normal unchanged staged-blob scanner rejected original public source-hash map; exact hash values now carry explicit sha256 type prefixes. No detector finding content was exposed.",
|
||||
"original_verification_sha256": "0c6ffb3a641428c311fa0cb348016ea0b63f6ea96a053aa746841ab39fa384e8",
|
||||
"original_verification_git_blob": "327447b9e476ea8344cc3bad62da33736eb63c3d",
|
||||
"original_local_backup": "/tmp/access-native-plan-review-verification-original-0c6ffb3a641428c3.json",
|
||||
"prior_review_sha256": "a2c7a62f35a9f467012b9e646c5e5aa5a22e181c8b10a79e68c254c1a830af8a",
|
||||
"prior_manifest_sha256": "2acb218f34c726e4d56ccd3515dd45fe8809ece731fe77039c6ca93fba5952c2",
|
||||
"changed_maps": [
|
||||
"reviewed_source_sha256",
|
||||
"image_runtime_source_sha256"
|
||||
],
|
||||
"hash_values_unchanged": true,
|
||||
"review_semantics_unchanged": true,
|
||||
"frozen_R2_P4_unchanged": true,
|
||||
"canonical_own_record_change_required": false,
|
||||
"canonical_record_reason": "Existing workplan binds frozen R2/P4/source/projection, not successor verification or review-file hashes.",
|
||||
"root_index_modified": false
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"owner_commit": "d328a2601095686f74376d87791bff01e2a3a2a3",
|
||||
"owner_commit_paths": [
|
||||
"workplans/FLEX-WP-0024-decision-envelope-authenticity.md"
|
||||
],
|
||||
"sync_return_code": 0,
|
||||
"sync_stdout_sha256": "1b0b0b7b02fd25fb21ceb7c1a30c70632221db1c73183c868db765e9915dc7e8",
|
||||
"sync_stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
||||
"head_after_sync": "d328a2601095686f74376d87791bff01e2a3a2a3",
|
||||
"upstream": "d328a2601095686f74376d87791bff01e2a3a2a3",
|
||||
"brief_index_exactly_restored": true,
|
||||
"brief_worktree_exactly_restored": true,
|
||||
"work_records_before_sha256": "f713204e5c524f22e4a831fa480bf0e2018e206cd48f55fbf9d5472bfca104a5",
|
||||
"work_records_after_sha256": "f713204e5c524f22e4a831fa480bf0e2018e206cd48f55fbf9d5472bfca104a5",
|
||||
"workplan_after_sha256": "cc94a493c23c16a3baa718b75ef5d48a596c6386c11534d50fd4839a6f0448f2",
|
||||
"status": "M .custodian-brief.md\n M WORK-RECORDS.md\n",
|
||||
"manual_push": false,
|
||||
"no_writeback_scope": "Disables C15/C23 status repairs only; brief generation/auto-commit and normal publication still run."
|
||||
}
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
{
|
||||
"schema": "access-engine.native-plan-offline-verification.v1",
|
||||
"frozen_input_sha256": {
|
||||
"access-native-admission/rollout-r2/manifest.json": "5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
|
||||
"platform-signer-custody/native-adapter-r2/native-packet-p4/manifest.json": "9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3",
|
||||
"native-preflight-r1/live-preflight.json": "7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b",
|
||||
"native-preflight-r1/cluster-native-plan-review.json": "76e5e3c10cf62d93c801c08f0275f84cd523010f58a7c5db595dee2081ffa572"
|
||||
},
|
||||
"chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
|
||||
"image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
||||
"reviewed_source_sha256": {
|
||||
"AGENTS.md": "sha256:18539e6301fdbe63928b6e79ba90b316337ffc47c3baa9950729309ef4356f54",
|
||||
"INTENT.md": "sha256:f6c14f5f824fb86ac06368fb9c52e60d627ee42810817a45723d34a6a9a178a5",
|
||||
"SCOPE.md": "sha256:dd1484a32a313135e69f16dbc833d768467491438bbb1d9127c2b098061edb60",
|
||||
".forgejo/workflows/image.yaml": "sha256:18307ce17027b263ac0703a9e82fba8d14b672ca8bc9dee4c90b3aed2decd58e",
|
||||
".forgejo/workflows/ci-smoke.yaml": "sha256:c17729b2144648fa92871e1c94bcb6bd8f64a4b533577ede9457593758e2b7ab",
|
||||
".github/workflows/ci.yml": "sha256:421bf5c0ef4706e9c04dcf14f326dff9d26870f45110058346834199ae5467a8",
|
||||
"Makefile": "sha256:aa32fe04336d4613835629d969ec8c49782d61ee0e2a62f09fd67d19796f58b7",
|
||||
"deploy/README.md": "sha256:11de09b5690437241f2f3ad7371deb9624e607701a22287dd1efa7d65a7ee7d5",
|
||||
"railiance/app.toml": "sha256:b4674d874e5485eaff6f95f1896bf61a89f03441089dc4d824f3859660e5ed0f",
|
||||
"tools/publish-runtime-images.sh": "sha256:1e95ed70e55b04943613f89e241ad4c25094a26cabefbed6c1bdedb8deedf630",
|
||||
"internal/emission/outbox.go": "sha256:10b7ffa6899d2e89c4c36150f063a348eaf15cfce7a95e814af71b6ffd511ba0",
|
||||
"internal/emission/lock_linux.go": "sha256:604743d6d2427ae8cc8f64cc5fae4934a4c1cf0ed24fbae171bea270ed668f6f",
|
||||
"internal/emission/lock_other.go": "sha256:271a879de3d43036ce69a5db0f8c2ad401d7cce5ceab1fa721959516a1576493",
|
||||
"internal/emission/delivery.go": "sha256:9bd2147108fafade36850ec2e00f0fe602471748af7d94c7b2f54e69658f95f1",
|
||||
"internal/decision/engine.go": "sha256:be6ea0e81422dba6b6d2124530263bf6fd4025c8dcac9360c619adbff0ac0bbd",
|
||||
"cmd/access-engine/main.go": "sha256:da6d185ac971aaa652a6b242f5c46007f8b0089e71e6d6b499bd7925b1377758",
|
||||
"workplans/FLEX-WP-0024-decision-envelope-authenticity.md": "sha256:3a3fc05528eb869204811d90d12ef5a3ac3b6d537b5b7a8cccbc15b6483a002f"
|
||||
},
|
||||
"image_runtime_source_sha256": {
|
||||
"internal/emission/outbox.go": "sha256:10b7ffa6899d2e89c4c36150f063a348eaf15cfce7a95e814af71b6ffd511ba0",
|
||||
"internal/emission/lock_linux.go": "sha256:604743d6d2427ae8cc8f64cc5fae4934a4c1cf0ed24fbae171bea270ed668f6f",
|
||||
"internal/emission/lock_other.go": "sha256:271a879de3d43036ce69a5db0f8c2ad401d7cce5ceab1fa721959516a1576493",
|
||||
"internal/emission/delivery.go": "sha256:9bd2147108fafade36850ec2e00f0fe602471748af7d94c7b2f54e69658f95f1",
|
||||
"internal/decision/engine.go": "sha256:be6ea0e81422dba6b6d2124530263bf6fd4025c8dcac9360c619adbff0ac0bbd",
|
||||
"cmd/access-engine/main.go": "sha256:da6d185ac971aaa652a6b242f5c46007f8b0089e71e6d6b499bd7925b1377758"
|
||||
},
|
||||
"frozen_manifest_file_hashes_verified": true,
|
||||
"chart_source_hashes_verified": true,
|
||||
"actual_exact_helm_renders_equal_frozen_bytes": true,
|
||||
"stopped_ready_only_replicas_differ": true,
|
||||
"runtime_sources_identical_chart_and_image": true,
|
||||
"reviewed_repo_ci_has_no_helm_upgrade_or_kubectl_apply": true,
|
||||
"dated_namespace_competing_controller_observations": {
|
||||
"hpa": {
|
||||
"exit_code": 0,
|
||||
"ok": true,
|
||||
"rows": [],
|
||||
"stderr_present": false
|
||||
},
|
||||
"jobs": {
|
||||
"exit_code": 0,
|
||||
"ok": true,
|
||||
"rows": [],
|
||||
"stderr_present": false
|
||||
},
|
||||
"cronjobs": {
|
||||
"exit_code": 0,
|
||||
"ok": true,
|
||||
"rows": [],
|
||||
"stderr_present": false
|
||||
},
|
||||
"daemonsets": {
|
||||
"exit_code": 0,
|
||||
"ok": true,
|
||||
"rows": [],
|
||||
"stderr_present": false
|
||||
},
|
||||
"statefulsets": {
|
||||
"exit_code": 0,
|
||||
"ok": true,
|
||||
"rows": [],
|
||||
"stderr_present": false
|
||||
}
|
||||
},
|
||||
"observation_time": "2026-10-16T18:53:06.325922+00:00",
|
||||
"live_execution": false,
|
||||
"no_credential_or_kubeconfig_access": true
|
||||
}
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
"""Offline parse public resource streams; never concatenate JSON as one object."""
|
||||
import json,re
|
||||
from decimal import Decimal
|
||||
|
||||
def objects(value):
|
||||
if value is None:return []
|
||||
if type(value) is dict:return [value]
|
||||
if type(value) is not str:raise ValueError('resource stream type')
|
||||
out=[];decoder=json.JSONDecoder();offset=0
|
||||
while offset<len(value):
|
||||
while offset<len(value) and value[offset].isspace():offset+=1
|
||||
if offset==len(value):break
|
||||
item,length=decoder.raw_decode(value,offset)
|
||||
if type(item) is not dict:raise ValueError('resource object required')
|
||||
out.append(item);offset=length
|
||||
return out
|
||||
|
||||
def quantity(value,kind):
|
||||
if value is None:return Decimal(0)
|
||||
match=re.fullmatch(r'([0-9]+(?:\.[0-9]+)?)([A-Za-z]*)',str(value))
|
||||
if not match:raise ValueError('unsupported quantity')
|
||||
number,suffix=match.groups();number=Decimal(number)
|
||||
factors={'':1,'n':Decimal('0.000000001'),'u':Decimal('0.000001'),'m':Decimal('0.001'),'k':1000,'M':1000000,'G':1000000000,'Ki':1024,'Mi':1024**2,'Gi':1024**3,'Ti':1024**4}
|
||||
if suffix not in factors:raise ValueError('unsupported quantity suffix')
|
||||
return number*factors[suffix]*(1000 if kind=='cpu' else 1)
|
||||
|
||||
def analyze(receipt,supplement=None):
|
||||
rows=(supplement['pods']['rows'] if supplement else receipt['observations']['resource_requests']['rows'])
|
||||
nodes=(supplement['nodes']['rows'] if supplement else receipt['observations']['nodes']['rows'])
|
||||
node=next(n for n in nodes if any(a.get('address')=='92.205.62.239' for a in n['status.addresses']))
|
||||
totals={r:Decimal(0) for r in ['cpu','memory']};count=0;multi=0;init_count=0;pod_level_count=0;sidecars=0
|
||||
for row in rows:
|
||||
if row['status.phase'] in ['Succeeded','Failed'] or row['spec.nodeName']!=node['metadata.name']:continue
|
||||
count+=1;containers=objects(row['spec.containers[*].resources']);init=objects(row['spec.initContainers[*].resources']);multi+=len(containers)>1;init_count+=bool(init)
|
||||
if row.get('spec.resources'):pod_level_count+=1
|
||||
restartable=bool(row.get('spec.initContainers[*].restartPolicy'));sidecars+=restartable
|
||||
for resource in totals:
|
||||
app=sum((quantity(x.get('requests',{}).get(resource),resource) for x in containers),Decimal(0))
|
||||
init_requests=[quantity(x.get('requests',{}).get(resource),resource) for x in init]
|
||||
# Sum of app+all init is a conservative bound for restartable init.
|
||||
effective=app+sum(init_requests,Decimal(0)) if restartable else max([app]+init_requests)
|
||||
if row.get('spec.resources'):effective=max(effective,quantity(row['spec.resources'].get('requests',{}).get(resource),resource))
|
||||
effective+=quantity((row.get('spec.overhead') or {}).get(resource),resource)
|
||||
totals[resource]+=effective
|
||||
capacity={r:quantity(node['status.allocatable'][r],r) for r in totals}
|
||||
return {'node':node['metadata.name'],'nonterminal_bound_pods':count,'multicontainer_pods':multi,'pods_with_init_resources':init_count,'pods_with_pod_level_resources':pod_level_count,'pods_with_restartable_init_fields':sidecars,'supplement_used':bool(supplement),'requested_cpu_m':str(totals['cpu']),'allocatable_cpu_m':str(capacity['cpu']),'unrequested_cpu_m':str(capacity['cpu']-totals['cpu']),'requested_memory_bytes':str(totals['memory']),'allocatable_memory_bytes':str(capacity['memory']),'unrequested_memory_bytes':str(capacity['memory']-totals['memory']),'assumptions':[] if supplement else ['Init restartPolicy and pod-level resources not collected; scheduler totals provisional.'],'method':'exclude terminal/unbound/other-node Pods; sum regular requests; per-resource maximum init request; overhead; conservative sum if restartable init present; max with pod-level requests'}
|
||||
if __name__=='__main__':
|
||||
import sys
|
||||
from pathlib import Path
|
||||
p=Path(sys.argv[1]);s=Path(sys.argv[2]) if len(sys.argv)>2 else None
|
||||
print(json.dumps(analyze(json.loads(p.read_text()),json.loads(s.read_text()) if s else None),indent=2))
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
{
|
||||
"schema": "railiance-cluster.bounded-native-plan-review.v1",
|
||||
"reviewer": "railiance-cluster-owner (agent railiance-cluster, codex)",
|
||||
"review_role": "cluster-runtime-storage-owner",
|
||||
"work_item": "RCLUSTER-WP-0017-T02",
|
||||
"decision": "approved",
|
||||
"scope": "Exact runtime/storage execution plan for R2/P4, contingent on mandatory observed execution gates below; this is an owner plan review, not founder approval or a completed native-admission scope disposition.",
|
||||
"intent_basis": "railiance-cluster INTENT Core Principles Runtime Not Workloads, Healthy by Verification, Consistent Baseline and Managed Access.",
|
||||
"reviewed_at": "2026-10-16T19:04:18.311316+00:00",
|
||||
"exact_revisions": {
|
||||
"rollout_r2_manifest_sha256": "5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
|
||||
"packet_p4_manifest_sha256": "9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3",
|
||||
"platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53",
|
||||
"chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
|
||||
"image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
||||
"image_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
||||
"deployment_projection_sha256": "8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c"
|
||||
},
|
||||
"evidence": {
|
||||
"live_preflight_sha256": "7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b",
|
||||
"observed_at": "2026-10-16T18:53:06.325922+00:00",
|
||||
"completed_at": "2026-10-16T18:53:12.327339+00:00",
|
||||
"all_seven_exact_resources_server_admitted": true,
|
||||
"admitted_stopped_replicas": 0,
|
||||
"admitted_projection_exact": true,
|
||||
"actual_signer_stopped": false,
|
||||
"held_fence": false,
|
||||
"persistent_mutations": false
|
||||
},
|
||||
"observed_runtime": {
|
||||
"node_ip": "92.205.62.239",
|
||||
"node_uid": "0659e49e-6539-480a-8b0f-2969dd88cb05",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"node_ready": true,
|
||||
"memory_pressure": false,
|
||||
"disk_pressure": false,
|
||||
"pid_pressure": false,
|
||||
"observed_cpu_m": 1539,
|
||||
"observed_memory_mi": 8989,
|
||||
"namespace_quota_count": 0,
|
||||
"namespace_limitrange_count": 0,
|
||||
"namespace_pvc_count": 0,
|
||||
"signer_deployment_uid": "f83a5f5c-7dd7-4aac-bc02-d447e423e6ae",
|
||||
"signer_deployment_generation": 4,
|
||||
"signer_current_replicas": 1,
|
||||
"helm_deployed_revision": 4
|
||||
},
|
||||
"storage_disposition": {
|
||||
"claim": "flex-auth/flex-auth-secrets-engine-outbox",
|
||||
"request_bytes": 1073741824,
|
||||
"access_mode": "ReadWriteOnce",
|
||||
"storage_class": "local-path",
|
||||
"binding_mode": "WaitForFirstConsumer",
|
||||
"class_reclaim_policy": "Delete",
|
||||
"free_bytes_observed": 125704314880,
|
||||
"free_less_request_bytes": 124630573056,
|
||||
"scope": "One additional1Gi node-local request; no quota, reservation, replication or backup is established.",
|
||||
"actual_pv": null,
|
||||
"actual_pv_retain": false,
|
||||
"native_outbox_max_bytes": 67108864,
|
||||
"outbox_native_acceptance": false
|
||||
},
|
||||
"mandatory_execution_gates": [
|
||||
"Founder exact scoped ADMINISTER authority, executor/abort owner, absolute window and EUR spend/risk-loss/outage/local-evidence-loss disposition; no authority comes from this review.",
|
||||
"Immediately refresh same node/cluster, node Ready/no pressure, scheduling constraints, resource fit and free disk before stop/start; these are dated observations without reservation.",
|
||||
"Access authenticates workload/Helm/manual/CI writers and Platform authenticates affected Application writers; freeze only reviewed writers, preserve prior state/restoration criteria; no inferred cluster ownership of controllers.",
|
||||
"Before custody require actually installed stopped candidate, observedGeneration caught up, Deployment desired/status0, all UID-owned ReplicaSets desired/status0, no live/terminating UID-owned/signer-SA/seed-mount Pods, no HPA/unreviewed workload writer, and exact observed native projection equal8ce375f. Dry-run replicas0 is insufficient.",
|
||||
"Stopped Helm transition uses reviewed reset-values/no-hooks/wait=false without atomic; WFFC claim may remain Pending. No automatic rollback to unsigned running predecessor. Access independently establishes exact stopped Helm revision as ready-transition rollback target.",
|
||||
"Before ready, require independent custody/public trust/caller delivery approvals and protected consumers fenced. Candidate Ready within120s; failure/unknown holds stopped/failclosed and founder recovery decision within600s.",
|
||||
"After controlled WFFC binding capture exact PVC UID and PV name/UID/claimRef UID/capacity/nodeAffinity; independently review and obtain exact runtime/storage authority to set/readback Retain before durable evidence acceptance. No guessed/preselected PV or Delete-policy durable acceptance.",
|
||||
"Retain/PVC1Gi/RWO/Recreate/OS lock do not prove backup, node-loss recovery, filesystem hard quota or competing-process exclusion; require native restart/signature/sequence/cursor/lock/capacity/unwritable/fsync negative proofs separately.",
|
||||
"Abort/rollback preserves PVC/PV/outbox/cursor/receipts; no delete/uninstall/reset/old-seed restore/CAS remint/retry. Access controls workload/Helm rollback, Platform Applications/custody, Secrets failclosed/trust, cluster runtime/storage preservation only."
|
||||
],
|
||||
"not_authorized": [
|
||||
"Workload/Helm or Application mutation",
|
||||
"Actual stop/create/start/PVC/PV mutation",
|
||||
"Credential read, TokenRequest, custody or public trust admission",
|
||||
"Completed five-role native scope disposition; founder entity/expiry/window/trust/approved CCR remain unbound"
|
||||
],
|
||||
"task_status": "T02 progress: real read-only admission/runtime proof reviewed; live held-window and exact execution disposition remain open. T03 remains todo."
|
||||
}
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
{
|
||||
"schema": "netkingdom.coordinator-public-preflight-review.v1",
|
||||
"scope": "Read-only public metadata and seven server-dry-run resources; no native activation",
|
||||
"files": {
|
||||
"preflight.py": "sha256:1011e5872ebee718e969b7012b17c0737e10eaaed804e0c4ae254024d8ad5248",
|
||||
"payload.json": "sha256:c78879355d9f451d9dbf2c36cd74e35c996cc24d1e3d79c2a9dc6238baa5dde8",
|
||||
"test_preflight.py": "sha256:cdf21c8af88e0e7d22dfb717d41c59726bdab8e157dcace369f71a5af5ed810f",
|
||||
"verification.json": "sha256:a7c771d4fa711c1b59d6836103d7758862a35c89f1bd2e0b668db35179f6429f",
|
||||
"probe.py": "sha256:f10f5e6feb3c5fe9304af80249d8f3b61064c8da500035b215f9849ffb18dd6e",
|
||||
"formatter-probe.json": "sha256:0b546b6a0c35a5ab59a66522ff108d7a3757c340794c361e7575f0a520da766d",
|
||||
"run.py": "sha256:9923bc6ecdc0951d11debea727dedc9ff30b2b9abe152db9aa1020b6a6ef0114",
|
||||
"live-preflight.json": "sha256:7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b"
|
||||
},
|
||||
"independent_checks": {
|
||||
"focused_tests_passed": 6,
|
||||
"exact_frozen_resource_count": 7,
|
||||
"frozen_resources_match": true,
|
||||
"frozen_projection_match": true,
|
||||
"pinned_platform_projection_ast_match": true,
|
||||
"actual_metadata_formatter_and_target_identity_passed": true
|
||||
},
|
||||
"results": {
|
||||
"server_dry_run_accepted": 7,
|
||||
"stopped_replicas": 0,
|
||||
"admitted_projection_matches_frozen": true,
|
||||
"held_fence": false,
|
||||
"persistent_security_mutations": false
|
||||
},
|
||||
"remaining": [
|
||||
"Native owner dispositions and founder exact authorization",
|
||||
"Authenticated exclusive writer window",
|
||||
"Actual stopped-state observation before custody",
|
||||
"Actual PVC binding and PV retention",
|
||||
"Actual public-key trust and caller delivery",
|
||||
"Native signed consumer and durable outbox acceptance",
|
||||
"Independent audit source/cadence admission"
|
||||
],
|
||||
"limits": [
|
||||
"Client apply server-dry-run is not proof of Helm upgrade equivalence",
|
||||
"Public metadata receipt is dated, not a reservation",
|
||||
"Scheduling totals are a dated request allocation; actual usage, pending work and the execution-window checks remain distinct."
|
||||
],
|
||||
"supplement": {
|
||||
"reviewed": true,
|
||||
"executed_by": "coordinator",
|
||||
"files": {
|
||||
"supplement.py": "sha256:6de3b981e46c3504362038236777da2d44d8126f444490093a66e5d5a4827738",
|
||||
"analyze_resources.py": "sha256:a6f1b76649c494563bc1c70cd949744d706da4a2045d0d9e6ff0b621b86cb022",
|
||||
"test_resources.py": "sha256:64079b8d52e9fd8e12b21614b1d9caa1f0a3d4e062c8f653f7fd5f8518ad7111",
|
||||
"scheduling-supplement.json": "sha256:f4622831c5ed47cd710cde7fd34eeaef92629a2b58bc32c7808efa865e98c6ca",
|
||||
"scheduling-analysis.json": "sha256:91f538031e0a3475c797e762128479d2dc36154957715f4016e67a3e15089e7a"
|
||||
},
|
||||
"focused_parser_tests_passed": 5,
|
||||
"scheduled_cpu_m": "3580",
|
||||
"allocatable_cpu_m": "4000",
|
||||
"unrequested_cpu_m": "420",
|
||||
"pod_level_requests_present": false,
|
||||
"restartable_init_present": false,
|
||||
"taints_present": false,
|
||||
"unschedulable": false,
|
||||
"reservation": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
{
|
||||
"node_query_ok": true,
|
||||
"cluster_query_ok": true,
|
||||
"array_object_format_valid": true,
|
||||
"exact_target_address": true,
|
||||
"cluster_identity": true,
|
||||
"stdout_sanitized": true,
|
||||
"transport": {
|
||||
"exit_code": 0,
|
||||
"stderr_present": false
|
||||
},
|
||||
"probe_sha256": "f10f5e6feb3c5fe9304af80249d8f3b61064c8da500035b215f9849ffb18dd6e"
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,465 @@
|
|||
{
|
||||
"source_pins": {
|
||||
"chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
|
||||
"image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
||||
"platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53",
|
||||
"stopped_render_sha256": "03b631f0fe17c63494c14619199f69f2a2a9ab245d00f1ec441248868b24c071"
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"apiVersion": "networking.k8s.io/v1",
|
||||
"kind": "NetworkPolicy",
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine"
|
||||
}
|
||||
},
|
||||
"policyTypes": [
|
||||
"Ingress",
|
||||
"Egress"
|
||||
],
|
||||
"egress": [
|
||||
{
|
||||
"ports": [
|
||||
{
|
||||
"port": 443,
|
||||
"protocol": "TCP"
|
||||
},
|
||||
{
|
||||
"port": 6443,
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"ingress": [
|
||||
{
|
||||
"from": [
|
||||
{
|
||||
"namespaceSelector": {
|
||||
"matchLabels": {
|
||||
"kubernetes.io/metadata.name": "secrets-engine"
|
||||
}
|
||||
},
|
||||
"podSelector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "secrets-engine"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"port": 8080,
|
||||
"protocol": "TCP"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "ServiceAccount",
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"automountServiceAccountToken": false
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine-outbox",
|
||||
"annotations": {
|
||||
"helm.sh/resource-policy": "keep"
|
||||
},
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"accessModes": [
|
||||
"ReadWriteOnce"
|
||||
],
|
||||
"storageClassName": "local-path",
|
||||
"resources": {
|
||||
"requests": {
|
||||
"storage": "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRole",
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine-tokenreviewer",
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"rules": [
|
||||
{
|
||||
"apiGroups": [
|
||||
"authentication.k8s.io"
|
||||
],
|
||||
"resources": [
|
||||
"tokenreviews"
|
||||
],
|
||||
"verbs": [
|
||||
"create"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "rbac.authorization.k8s.io/v1",
|
||||
"kind": "ClusterRoleBinding",
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine-tokenreviewer",
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"roleRef": {
|
||||
"apiGroup": "rbac.authorization.k8s.io",
|
||||
"kind": "ClusterRole",
|
||||
"name": "flex-auth-secrets-engine-tokenreviewer"
|
||||
},
|
||||
"subjects": [
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"namespace": "flex-auth"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"apiVersion": "v1",
|
||||
"kind": "Service",
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"selector": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine"
|
||||
},
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"port": 8080,
|
||||
"targetPort": "http"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"apiVersion": "apps/v1",
|
||||
"kind": "Deployment",
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"strategy": {
|
||||
"type": "Recreate"
|
||||
},
|
||||
"replicas": 0,
|
||||
"selector": {
|
||||
"matchLabels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine"
|
||||
}
|
||||
},
|
||||
"template": {
|
||||
"metadata": {
|
||||
"labels": {
|
||||
"app.kubernetes.io/name": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/instance": "flex-auth-secrets-engine",
|
||||
"app.kubernetes.io/part-of": "flex-auth"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"automountServiceAccountToken": false,
|
||||
"serviceAccountName": "flex-auth-secrets-engine",
|
||||
"securityContext": {
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 65532,
|
||||
"runAsGroup": 65532,
|
||||
"fsGroup": 65532,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
},
|
||||
"containers": [
|
||||
{
|
||||
"name": "flex-auth",
|
||||
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
||||
"imagePullPolicy": "IfNotPresent",
|
||||
"args": [
|
||||
"serve",
|
||||
"--addr",
|
||||
"0.0.0.0:8080",
|
||||
"--registry",
|
||||
"/opt/flex-auth/examples/secrets-engine/registry_snapshot.json",
|
||||
"--policy",
|
||||
"/opt/flex-auth/examples/secrets-engine/policy_package.md",
|
||||
"--envelope-signing-key-file",
|
||||
"/var/run/secrets/decision-envelope-signing/seed",
|
||||
"--envelope-signing-kid",
|
||||
"flex-auth-lifecycle-20261016-r1",
|
||||
"--outbox-max-bytes",
|
||||
"67108864",
|
||||
"--outbox-dir",
|
||||
"/var/lib/flex-auth/outbox",
|
||||
"--emission-source",
|
||||
"flex-auth.secrets-engine",
|
||||
"--caller-audience",
|
||||
"flex-auth",
|
||||
"--caller-auth-mode",
|
||||
"enforce",
|
||||
"--caller-kubernetes-url",
|
||||
"https://10.43.0.1",
|
||||
"--caller-binding",
|
||||
"secrets-engine=system:serviceaccount:secrets-engine:secrets-engine"
|
||||
],
|
||||
"ports": [
|
||||
{
|
||||
"name": "http",
|
||||
"containerPort": 8080
|
||||
}
|
||||
],
|
||||
"livenessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 20
|
||||
},
|
||||
"readinessProbe": {
|
||||
"httpGet": {
|
||||
"path": "/healthz",
|
||||
"port": "http"
|
||||
},
|
||||
"periodSeconds": 5
|
||||
},
|
||||
"resources": {
|
||||
"limits": {
|
||||
"cpu": "300m",
|
||||
"memory": "192Mi"
|
||||
},
|
||||
"requests": {
|
||||
"cpu": "25m",
|
||||
"memory": "32Mi"
|
||||
}
|
||||
},
|
||||
"securityContext": {
|
||||
"allowPrivilegeEscalation": false,
|
||||
"capabilities": {
|
||||
"drop": [
|
||||
"ALL"
|
||||
]
|
||||
},
|
||||
"readOnlyRootFilesystem": true
|
||||
},
|
||||
"volumeMounts": [
|
||||
{
|
||||
"mountPath": "/var/run/secrets/decision-envelope-signing",
|
||||
"name": "flex-auth-envelope-signing",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/lib/flex-auth/outbox",
|
||||
"name": "flex-auth-outbox"
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/flex-auth-reviewer",
|
||||
"name": "flex-auth-reviewer",
|
||||
"readOnly": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"volumes": [
|
||||
{
|
||||
"name": "flex-auth-envelope-signing",
|
||||
"secret": {
|
||||
"secretName": "flex-auth-secrets-engine-envelope-signing",
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "seed",
|
||||
"path": "seed"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "flex-auth-outbox",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "flex-auth-secrets-engine-outbox"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "flex-auth-reviewer",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"name": "kube-root-ca.crt",
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"expected_projection": {
|
||||
"service_account": "flex-auth-secrets-engine",
|
||||
"image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
||||
"args": [
|
||||
"serve",
|
||||
"--addr",
|
||||
"0.0.0.0:8080",
|
||||
"--registry",
|
||||
"/opt/flex-auth/examples/secrets-engine/registry_snapshot.json",
|
||||
"--policy",
|
||||
"/opt/flex-auth/examples/secrets-engine/policy_package.md",
|
||||
"--envelope-signing-key-file",
|
||||
"/var/run/secrets/decision-envelope-signing/seed",
|
||||
"--envelope-signing-kid",
|
||||
"flex-auth-lifecycle-20261016-r1",
|
||||
"--outbox-max-bytes",
|
||||
"67108864",
|
||||
"--outbox-dir",
|
||||
"/var/lib/flex-auth/outbox",
|
||||
"--emission-source",
|
||||
"flex-auth.secrets-engine",
|
||||
"--caller-audience",
|
||||
"flex-auth",
|
||||
"--caller-auth-mode",
|
||||
"enforce",
|
||||
"--caller-kubernetes-url",
|
||||
"https://10.43.0.1",
|
||||
"--caller-binding",
|
||||
"secrets-engine=system:serviceaccount:secrets-engine:secrets-engine"
|
||||
],
|
||||
"volume_mounts": [
|
||||
{
|
||||
"mountPath": "/var/run/secrets/decision-envelope-signing",
|
||||
"name": "flex-auth-envelope-signing",
|
||||
"readOnly": true
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/lib/flex-auth/outbox",
|
||||
"name": "flex-auth-outbox"
|
||||
},
|
||||
{
|
||||
"mountPath": "/var/run/secrets/flex-auth-reviewer",
|
||||
"name": "flex-auth-reviewer",
|
||||
"readOnly": true
|
||||
}
|
||||
],
|
||||
"volumes": [
|
||||
{
|
||||
"name": "flex-auth-envelope-signing",
|
||||
"secret": {
|
||||
"secretName": "flex-auth-secrets-engine-envelope-signing",
|
||||
"defaultMode": 288,
|
||||
"items": [
|
||||
{
|
||||
"key": "seed",
|
||||
"path": "seed"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "flex-auth-outbox",
|
||||
"persistentVolumeClaim": {
|
||||
"claimName": "flex-auth-secrets-engine-outbox"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "flex-auth-reviewer",
|
||||
"projected": {
|
||||
"defaultMode": 288,
|
||||
"sources": [
|
||||
{
|
||||
"serviceAccountToken": {
|
||||
"expirationSeconds": 3600,
|
||||
"path": "token"
|
||||
}
|
||||
},
|
||||
{
|
||||
"configMap": {
|
||||
"name": "kube-root-ca.crt",
|
||||
"items": [
|
||||
{
|
||||
"key": "ca.crt",
|
||||
"path": "ca.crt"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"security_context": {
|
||||
"runAsNonRoot": true,
|
||||
"runAsUser": 65532,
|
||||
"runAsGroup": 65532,
|
||||
"fsGroup": 65532,
|
||||
"seccompProfile": {
|
||||
"type": "RuntimeDefault"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,121 @@
|
|||
"""Stdin-only public metadata and exact server-dry-run; never persist raw output.
|
||||
Local coordinator supplies frozen JSON manifests. No SSH credential inspection.
|
||||
"""
|
||||
import datetime, hashlib, json, os, subprocess
|
||||
|
||||
def digest(x):
|
||||
return hashlib.sha256(json.dumps(x,sort_keys=True,separators=(',',':')).encode()).hexdigest()
|
||||
|
||||
def invoke(argv, stdin=None):
|
||||
try:
|
||||
r=subprocess.run(argv,input=stdin,capture_output=True,text=True,timeout=35,env={**os.environ,'KUBECONFIG':'/etc/rancher/k3s/k3s.yaml'})
|
||||
return r.returncode,r.stdout,bool(r.stderr)
|
||||
except (OSError,subprocess.TimeoutExpired):
|
||||
return -1,'',True
|
||||
|
||||
def query(resource, fields, namespace=None, name=None, allns=False):
|
||||
argv=['kubectl','get',resource]
|
||||
if namespace: argv+=['-n',namespace]
|
||||
if name: argv+=[name]
|
||||
if allns: argv+=['-A']
|
||||
template=('{range .items[*]}' if not name else '')+'{"\\u001e"}'.join('{.'+f+'}' for f in fields)+'{"\\n"}'+('{end}' if not name else '')
|
||||
rc,out,err=invoke(argv+['-o','jsonpath='+template])
|
||||
rows=[]
|
||||
if rc==0:
|
||||
for line in out.split('\n'):
|
||||
if not line: continue
|
||||
parts=line.split('\x1e')
|
||||
if len(parts)!=len(fields):return {'ok':False,'failure':'metadata-shape','stderr_present':err}
|
||||
row={}
|
||||
for key,value in zip(fields,parts):
|
||||
try: row[key]=json.loads(value) if value else None
|
||||
except ValueError: row[key]=value
|
||||
rows.append(row)
|
||||
return {'ok':rc==0,'exit_code':rc,'stderr_present':err,'rows':rows}
|
||||
|
||||
def require(condition,message):
|
||||
if not condition:raise ValueError(message)
|
||||
|
||||
# Exact AST source extracted from pinned Platform module SHA256
|
||||
# 4fb9ce6608ad04c4f5dc98a95796dc88a08a2453dc15c0d40c5c688fc02f573f
|
||||
def deployment_projection(deployment):
|
||||
spec=deployment['spec']['template']['spec'];containers=spec.get('containers',[])
|
||||
require(type(containers) is list and len(containers)==1 and not spec.get('initContainers'),'single fixed signer container required')
|
||||
item=containers[0]
|
||||
# Never hash arbitrary env values or an entire Secret/spec response.
|
||||
return {'service_account':spec.get('serviceAccountName'),'image':item.get('image'),
|
||||
'args':item.get('args'),'volume_mounts':item.get('volumeMounts',[]),
|
||||
'volumes':spec.get('volumes',[]),'security_context':spec.get('securityContext')}
|
||||
|
||||
|
||||
def run(payload):
|
||||
receipt={'schema':'netkingdom.native-public-preflight.v1','observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'source_pins':payload['source_pins'],'persistent_mutations':False,'held_fence':False,'observations':{}}
|
||||
obs=receipt['observations']
|
||||
obs['nodes']=query('nodes',['metadata.name','metadata.uid','status.addresses','status.allocatable','status.conditions[*].type','status.conditions[*].status','status.conditions[*].reason'])
|
||||
obs['cluster']=query('namespace',['metadata.name','metadata.uid'],name='kube-system')
|
||||
nodes=obs['nodes'].get('rows',[]);cluster=obs['cluster'].get('rows',[])
|
||||
valid_node=any(type(row.get('status.addresses')) is list and any(type(address) is dict and address.get('address')=='92.205.62.239' and address.get('type') in {'InternalIP','ExternalIP'} for address in row['status.addresses']) for row in nodes if type(row) is dict)
|
||||
if not obs['nodes'].get('ok') or not obs['cluster'].get('ok') or not valid_node or len(cluster)!=1 or type(cluster[0]) is not dict or cluster[0].get('metadata.uid')!='a553c742-0115-43d4-99a4-a5ca56fe0786':
|
||||
receipt['refused']='target-identity';return receipt
|
||||
# conditions contain only public node health, no annotations/secret/env/config.
|
||||
common=['metadata.name','metadata.namespace','metadata.uid','metadata.generation','metadata.ownerReferences','metadata.deletionTimestamp']
|
||||
obs['deployment']=query('deployment',common+['spec.replicas','spec.strategy','status.observedGeneration','status.replicas','status.readyReplicas','spec.template.spec.serviceAccountName','spec.template.spec.containers[*].image','spec.template.spec.containers[*].resources'],namespace='flex-auth',name='flex-auth-secrets-engine')
|
||||
obs['replicasets']=query('replicasets',common+['spec.replicas','status.replicas'],namespace='flex-auth')
|
||||
obs['pods']=query('pods',common+['status.phase','spec.nodeName','spec.serviceAccountName','spec.volumes[*].secret.secretName','spec.volumes[*].persistentVolumeClaim.claimName','spec.containers[*].image'],namespace='flex-auth')
|
||||
obs['hpa']=query('hpa',common+['spec.scaleTargetRef','spec.minReplicas','spec.maxReplicas'],namespace='flex-auth')
|
||||
# Only identity/owner/SA/volume references from potential workload writers.
|
||||
for resource in ['jobs','cronjobs','statefulsets','daemonsets']:
|
||||
obs[resource]=query(resource,common,namespace='flex-auth')
|
||||
obs['quota']=query('resourcequota',['metadata.name','spec.hard','status.hard','status.used'],namespace='flex-auth')
|
||||
obs['limits']=query('limitrange',['metadata.name','spec.limits'],namespace='flex-auth')
|
||||
obs['pvc']=query('pvc',common+['spec.storageClassName','spec.accessModes','spec.resources.requests.storage','spec.volumeName','status.phase','status.capacity'],namespace='flex-auth')
|
||||
obs['storageclass']=query('storageclass',['metadata.name','metadata.uid','provisioner','reclaimPolicy','volumeBindingMode','allowVolumeExpansion'],name='local-path')
|
||||
obs['applications']=query('applications.argoproj.io',common+['spec.destination','spec.syncPolicy.automated','status.operationState.phase','status.sync.status','status.resources[*].kind','status.resources[*].namespace','status.resources[*].name'],namespace='argocd')
|
||||
# Metrics and allocation JSONPath select only resource fields of all pods.
|
||||
obs['resource_requests']=query('pods',['metadata.namespace','metadata.name','spec.nodeName','status.phase','spec.containers[*].resources','spec.initContainers[*].resources','spec.overhead'],allns=True)
|
||||
rc,out,err=invoke(['kubectl','top','nodes','--no-headers']);obs['node_usage']={'ok':rc==0,'exit_code':rc,'stderr_present':err,'public_metrics':out.strip() if rc==0 else None}
|
||||
rc,out,err=invoke(['df','-B1','--output=size,used,avail,pcent,target','/var/lib/rancher/k3s/storage']);obs['storage_free']={'ok':rc==0,'exit_code':rc,'stderr_present':err,'public_filesystem_metrics':out.strip() if rc==0 else None}
|
||||
# helm history returns release metadata, no values/manifests/Secret reads by wrapper.
|
||||
rc,out,err=invoke(['helm','history','flex-auth-secrets-engine','-n','flex-auth','--output','json','--max','10'])
|
||||
history={'ok':rc==0,'exit_code':rc,'stderr_present':err}
|
||||
try: history['revisions']=[{k:x.get(k) for k in ('revision','updated','status','chart','app_version')} for x in json.loads(out)] if rc==0 else []
|
||||
except (ValueError,TypeError):history={'ok':False,'failure':'history-shape'}
|
||||
obs['helm_history']=history
|
||||
# Sanitized client comparison: no arbitrary live args or projection fields emitted.
|
||||
mapping={'service_account':'spec.template.spec.serviceAccountName','image':'spec.template.spec.containers[0].image','args':'spec.template.spec.containers[0].args','volume_mounts':'spec.template.spec.containers[0].volumeMounts','volumes':'spec.template.spec.volumes','security_context':'spec.template.spec.securityContext'}
|
||||
live=query('deployment',list(mapping.values()),namespace='flex-auth',name='flex-auth-secrets-engine')
|
||||
if live['ok'] and len(live['rows'])==1:
|
||||
current={k:live['rows'][0][path] for k,path in mapping.items()}
|
||||
for key in ['volume_mounts','volumes']:current[key]=current[key] or []
|
||||
obs['client_projection_diff']={'ok':True,'live_sha256':digest(current),'candidate_sha256':digest(payload['expected_projection']),'differing_fields':[k for k in current if current[k]!=payload['expected_projection'][k]],'field_digests':{k:{'live':digest(current[k]),'candidate':digest(payload['expected_projection'][k])} for k in current}}
|
||||
else:obs['client_projection_diff']={'ok':False}
|
||||
receipt['dry_runs']=[]
|
||||
for obj in payload['resources']:
|
||||
kind=obj['kind'];name=obj['metadata']['name']
|
||||
if kind not in {'ServiceAccount','Role','RoleBinding','ClusterRole','ClusterRoleBinding','Service','Deployment','NetworkPolicy','PersistentVolumeClaim'} or obj['metadata'].get('namespace','flex-auth')!='flex-auth':
|
||||
receipt['refused']='resource-allowlist';return receipt
|
||||
fields=list(mapping.values())+['spec.replicas']
|
||||
selected='jsonpath='+('{"\\u001e"}'.join('{.'+f+'}' for f in fields)) if kind=='Deployment' else 'name'
|
||||
rc,out,err=invoke(['kubectl','apply','--dry-run=server','--validate=strict','-n','flex-auth','-f','-','-o',selected],json.dumps(obj))
|
||||
row={'kind':kind,'name':name,'exit_code':rc,'stderr_present':err,'admitted':rc==0}
|
||||
if rc==0:
|
||||
try:
|
||||
if kind=='Deployment':
|
||||
raw=out.strip().split('\x1e')
|
||||
if len(raw)!=len(fields):raise ValueError('projection-shape')
|
||||
values=[]
|
||||
for value in raw:
|
||||
try:values.append(json.loads(value) if value else None)
|
||||
except ValueError:values.append(value)
|
||||
p=dict(zip(mapping,values[:-1]))
|
||||
row.update(replicas=values[-1],projection_sha256=digest(p),expected_projection_sha256=digest(payload['expected_projection']),projection_matches=p==payload['expected_projection'],differing_projection_fields=[k for k in p if p[k]!=payload['expected_projection'].get(k)])
|
||||
except (ValueError,TypeError,KeyError):row.update(admitted=False,failure='admission-shape')
|
||||
receipt['dry_runs'].append(row)
|
||||
receipt['completed_at']=datetime.datetime.now(datetime.timezone.utc).isoformat()
|
||||
receipt['limitations']=['Dated metadata and dry-run only; no held writer fence or native owner disposition.','Helm values/manifests/config/env/annotations/Secrets not fetched. Live args only compared and hashed.','Application workload refs and current writer hints do not authenticate manual/CI writers.','No actual PVC binding/PV Retain, stop/create/start/custody or token request.','kubectl apply dry-run is admission evidence, not Helm upgrade execution equivalence.']
|
||||
return receipt
|
||||
|
||||
if __name__=='__main__':
|
||||
try: result=run(PAYLOAD)
|
||||
except Exception: result={'schema':'netkingdom.native-public-preflight.v1','refused':'sanitized-wrapper-failure','persistent_mutations':False,'held_fence':False}
|
||||
print(json.dumps(result,sort_keys=True))
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
"""Identity-only actual kubectl JSONPath parser proof, for coordinator execution."""
|
||||
import hashlib,json,subprocess
|
||||
from pathlib import Path
|
||||
P=Path(__file__).parent
|
||||
source=(P/'preflight.py').read_text().split("if __name__=='__main__':")[0]
|
||||
source+='''
|
||||
try:
|
||||
nodes=query('nodes',['metadata.name','status.addresses','status.conditions[*].type','status.conditions[*].status','status.conditions[*].reason'])
|
||||
cluster=query('namespace',['metadata.name','metadata.uid'],name='kube-system')
|
||||
rows=nodes.get('rows',[]);clusters=cluster.get('rows',[])
|
||||
result={'node_query_ok':nodes.get('ok'),'cluster_query_ok':cluster.get('ok'),'array_object_format_valid':bool(rows) and all(type(x.get('status.addresses')) is list for x in rows),'exact_target_address':any(a.get('address')=='92.205.62.239' and a.get('type') in {'InternalIP','ExternalIP'} for row in rows for a in (row.get('status.addresses') if type(row.get('status.addresses')) is list else []) if type(a) is dict),'cluster_identity':len(clusters)==1 and clusters[0].get('metadata.uid')=='a553c742-0115-43d4-99a4-a5ca56fe0786','stdout_sanitized':True}
|
||||
except Exception:result={'refused':'sanitized-formatter-probe-failure'}
|
||||
print(json.dumps(result))
|
||||
'''
|
||||
try:
|
||||
r=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=12','railiance01','python3','-'],input=source,capture_output=True,text=True,timeout=100)
|
||||
try:result=json.loads(r.stdout) if r.returncode==0 else {'refused':'sanitized-ssh-failure'}
|
||||
except ValueError:result={'refused':'sanitized-output-shape'}
|
||||
result['transport']={'exit_code':r.returncode,'stderr_present':bool(r.stderr)}
|
||||
except (OSError,subprocess.TimeoutExpired):result={'refused':'sanitized-probe-unconfirmed'}
|
||||
result['probe_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
|
||||
(P/'formatter-probe.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps(result))
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
"""Coordinator invokes after wrapper review. No remote file, shell interpolation or credential reads."""
|
||||
import datetime,hashlib,json,subprocess
|
||||
from pathlib import Path
|
||||
P=Path(__file__).parent
|
||||
source=(P/'preflight.py').read_text();payload=(P/'payload.json').read_text()
|
||||
program='PAYLOAD='+repr(json.loads(payload))+'\n'+source
|
||||
try:
|
||||
r=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=12','railiance01','python3','-'],input=program,capture_output=True,text=True,timeout=480)
|
||||
try:result=json.loads(r.stdout) if r.returncode==0 else {'refused':'sanitized-ssh-failure'}
|
||||
except ValueError:result={'refused':'sanitized-remote-output-shape'}
|
||||
result['transport']={'exit_code':r.returncode,'stderr_present':bool(r.stderr)}
|
||||
except (OSError,subprocess.TimeoutExpired):result={'refused':'sanitized-transport-unconfirmed'}
|
||||
result['collector_sha256']=hashlib.sha256(source.encode()).hexdigest()
|
||||
result['payload_sha256']=hashlib.sha256(payload.encode()).hexdigest()
|
||||
result['local_completed_at']=datetime.datetime.now(datetime.timezone.utc).isoformat()
|
||||
(P/'live-preflight.json').write_text(json.dumps(result,indent=2,sort_keys=True)+'\n')
|
||||
print(json.dumps({'receipt':str(P/'live-preflight.json'),'refused':result.get('refused'),'dry_runs':result.get('dry_runs',[]),'held_fence':result.get('held_fence',False)}))
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"node": "239.62.205.92.host.secureserver.net",
|
||||
"nonterminal_bound_pods": 91,
|
||||
"multicontainer_pods": 6,
|
||||
"pods_with_init_resources": 19,
|
||||
"pods_with_pod_level_resources": 0,
|
||||
"pods_with_restartable_init_fields": 0,
|
||||
"supplement_used": true,
|
||||
"requested_cpu_m": "3580.000",
|
||||
"allocatable_cpu_m": "4000",
|
||||
"unrequested_cpu_m": "420.000",
|
||||
"requested_memory_bytes": "10234101760",
|
||||
"allocatable_memory_bytes": "16770080768",
|
||||
"unrequested_memory_bytes": "6535979008",
|
||||
"assumptions": [],
|
||||
"method": "exclude terminal/unbound/other-node Pods; sum regular requests; per-resource maximum init request; overhead; conservative sum if restartable init present; max with pod-level requests"
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,26 @@
|
|||
"""Coordinator-executed public scheduling fields only, no full Pod/env/config reads."""
|
||||
import hashlib,json,subprocess
|
||||
from pathlib import Path
|
||||
P=Path(__file__).parent
|
||||
source=(P/'preflight.py').read_text().split("if __name__=='__main__':")[0]
|
||||
assert hashlib.sha256((P/'preflight.py').read_bytes()).hexdigest()=='1011e5872ebee718e969b7012b17c0737e10eaaed804e0c4ae254024d8ad5248'
|
||||
source+='''
|
||||
try:
|
||||
nodes=query('nodes',['metadata.name','metadata.uid','status.addresses','spec.unschedulable','spec.taints','status.allocatable','status.nodeInfo.kubeletVersion'])
|
||||
cluster=query('namespace',['metadata.name','metadata.uid'],name='kube-system')
|
||||
rows=nodes.get('rows',[]);clusters=cluster.get('rows',[])
|
||||
valid=nodes.get('ok') and cluster.get('ok') and len(clusters)==1 and clusters[0].get('metadata.uid')=='a553c742-0115-43d4-99a4-a5ca56fe0786' and any(a.get('address')=='92.205.62.239' and a.get('type') in {'InternalIP','ExternalIP'} for row in rows for a in (row.get('status.addresses') if type(row.get('status.addresses')) is list else []) if type(a) is dict)
|
||||
result={'observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'nodes':nodes,'cluster':cluster,'held_fence':False,'persistent_mutations':False}
|
||||
if not valid:result={'refused':'target-identity','persistent_mutations':False}
|
||||
else:result['pods']=query('pods',['metadata.namespace','metadata.name','metadata.uid','spec.nodeName','status.phase','spec.resources','spec.initContainers[*].restartPolicy','spec.containers[*].resources','spec.initContainers[*].resources','spec.overhead'],allns=True)
|
||||
except Exception:result={'refused':'sanitized-supplement-failure'}
|
||||
print(json.dumps(result))
|
||||
'''
|
||||
try:
|
||||
r=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=12','railiance01','python3','-'],input=source,capture_output=True,text=True,timeout=140)
|
||||
try:result=json.loads(r.stdout) if r.returncode==0 else {'refused':'sanitized-ssh-failure'}
|
||||
except ValueError:result={'refused':'sanitized-output-shape'}
|
||||
result['transport']={'exit_code':r.returncode,'stderr_present':bool(r.stderr)}
|
||||
except (OSError,subprocess.TimeoutExpired):result={'refused':'sanitized-supplement-unconfirmed'}
|
||||
result['supplement_sha256']=hashlib.sha256(Path(__file__).read_bytes()).hexdigest()
|
||||
(P/'scheduling-supplement.json').write_text(json.dumps(result,indent=2)+'\n');print(json.dumps({'receipt':str(P/'scheduling-supplement.json'),'refused':result.get('refused'),'node_ok':result.get('nodes',{}).get('ok'),'pod_ok':result.get('pods',{}).get('ok')}))
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
import importlib.util,json,unittest
|
||||
from pathlib import Path
|
||||
P=Path(__file__).parent
|
||||
spec=importlib.util.spec_from_file_location('preflight',P/'preflight.py');m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
||||
payload=json.loads((P/'payload.json').read_text())
|
||||
class Checks(unittest.TestCase):
|
||||
def setUp(self):self.original=m.invoke
|
||||
def tearDown(self):m.invoke=self.original
|
||||
def test_explicit_fields_and_shape(self):
|
||||
calls=[]
|
||||
def fake(argv,stdin=None):calls.append(argv);return 0,'alpha\x1e["beta"]\n',False
|
||||
m.invoke=fake
|
||||
result=m.query('pods',['metadata.name','spec.containers[*].image'],namespace='flex-auth')
|
||||
self.assertEqual(result['rows'],[{'metadata.name':'alpha','spec.containers[*].image':['beta']}])
|
||||
self.assertIn('-o',calls[0]);self.assertTrue(calls[0][-1].startswith('jsonpath='))
|
||||
def test_error_suppression(self):
|
||||
m.invoke=lambda *a:(1,'SENTINEL_SECRET',True)
|
||||
self.assertNotIn('SENTINEL_SECRET',json.dumps(m.query('pods',['metadata.name'])))
|
||||
def test_fail_closed_identity(self):
|
||||
m.invoke=lambda *a:(1,'SENTINEL_SECRET',True)
|
||||
result=m.run(payload)
|
||||
self.assertEqual(result['refused'],'target-identity');self.assertNotIn('SENTINEL_SECRET',json.dumps(result))
|
||||
def test_exact_address_and_cluster_shape(self):
|
||||
original_query=m.query
|
||||
for addresses,cluster in [([{'type':'Hostname','address':'92.205.62.239'}],[{'metadata.uid':'a553c742-0115-43d4-99a4-a5ca56fe0786'}]),([{'type':'InternalIP','address':'192.205.62.239'}],[{'metadata.uid':'a553c742-0115-43d4-99a4-a5ca56fe0786'}]),([{'type':'InternalIP','address':'92.205.62.239'}],[])]:
|
||||
calls=[]
|
||||
def query(resource,fields,**kw):
|
||||
calls.append(resource)
|
||||
return {'ok':True,'rows':[{'status.addresses':addresses}]} if resource=='nodes' else {'ok':True,'rows':cluster}
|
||||
m.query=query
|
||||
try:
|
||||
result=m.run(payload);self.assertEqual(result['refused'],'target-identity');self.assertEqual(calls,['nodes','namespace'])
|
||||
finally:m.query=original_query
|
||||
def test_exact_projection(self):
|
||||
deploy=next(x for x in payload['resources'] if x['kind']=='Deployment')
|
||||
self.assertEqual(m.deployment_projection(deploy),payload['expected_projection'])
|
||||
def test_mock_admission_no_secret_error_leak(self):
|
||||
original_query=m.query
|
||||
def query(resource,fields,**kw):
|
||||
if resource=='nodes':return {'ok':True,'rows':[{'status.addresses':[{'type':'InternalIP','address':'92.205.62.239'}]}]}
|
||||
if resource=='namespace':return {'ok':True,'rows':[{'metadata.uid':'a553c742-0115-43d4-99a4-a5ca56fe0786'}]}
|
||||
return {'ok':True,'rows':[]}
|
||||
m.query=query
|
||||
calls=[]
|
||||
def fake(argv,stdin=None):
|
||||
calls.append(argv)
|
||||
if argv[0]=='helm':return 0,'[]',False
|
||||
if '--dry-run=server' in argv:
|
||||
obj=json.loads(stdin)
|
||||
if obj['kind']=='Deployment':
|
||||
values=list(m.deployment_projection(obj).values())+[obj['spec']['replicas']]
|
||||
return 0,'\x1e'.join(json.dumps(v) for v in values),False
|
||||
return 0,obj['kind']+'/'+obj['metadata']['name'],False
|
||||
return 1,'SENTINEL_SECRET',True
|
||||
m.invoke=fake
|
||||
try:
|
||||
result=m.run(payload)
|
||||
self.assertTrue(all(x['admitted'] for x in result['dry_runs']))
|
||||
deploy=next(x for x in result['dry_runs'] if x['kind']=='Deployment')
|
||||
self.assertTrue(deploy['projection_matches']);self.assertEqual(deploy['replicas'],0)
|
||||
self.assertFalse(result['held_fence']);self.assertNotIn('SENTINEL_SECRET',json.dumps(result))
|
||||
self.assertTrue(all('--dry-run=server' in c for c in calls if c[0]=='kubectl' and c[1]=='apply'))
|
||||
finally:m.query=original_query
|
||||
if __name__=='__main__':unittest.main()
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
import unittest
|
||||
from decimal import Decimal
|
||||
from analyze_resources import objects,quantity,analyze
|
||||
class Checks(unittest.TestCase):
|
||||
def test_adjacent(self):self.assertEqual(objects('{} {"requests":{"cpu":"10m"}}'),[{}, {'requests':{'cpu':'10m'}}])
|
||||
def test_bad_stream(self):
|
||||
for text in ['{} secret','{} []','null']:
|
||||
with self.assertRaises(ValueError):objects(text)
|
||||
def test_units(self):
|
||||
self.assertEqual(quantity('1','cpu'),1000);self.assertEqual(quantity('25m','cpu'),25);self.assertEqual(quantity('32Mi','memory'),33554432)
|
||||
def test_scheduler(self):
|
||||
def row(phase='Running'):
|
||||
return {'status.phase':phase,'spec.nodeName':'node','spec.containers[*].resources':'{"requests":{"cpu":"10m","memory":"1Mi"}} {"requests":{"cpu":"20m"}}','spec.initContainers[*].resources':{'requests':{'cpu':'100m'}},'spec.overhead':{'cpu':'2m'},'spec.initContainers[*].restartPolicy':None,'spec.resources':None}
|
||||
supplement={'nodes':{'rows':[{'metadata.name':'node','status.addresses':[{'address':'92.205.62.239'}],'status.allocatable':{'cpu':'1','memory':'1Gi'}}]},'pods':{'rows':[row(),row('Succeeded')]}}
|
||||
result=analyze({},supplement);self.assertEqual(Decimal(result['requested_cpu_m']),102);self.assertEqual(result['nonterminal_bound_pods'],1)
|
||||
def test_restartable_conservative(self):
|
||||
r={'status.phase':'Running','spec.nodeName':'n','spec.containers[*].resources':{'requests':{'cpu':'20m'}},'spec.initContainers[*].resources':{'requests':{'cpu':'100m'}},'spec.overhead':None,'spec.initContainers[*].restartPolicy':'Always','spec.resources':None}
|
||||
s={'nodes':{'rows':[{'metadata.name':'n','status.addresses':[{'address':'92.205.62.239'}],'status.allocatable':{'cpu':'1','memory':'1Gi'}}]},'pods':{'rows':[r]}}
|
||||
self.assertEqual(Decimal(analyze({},s)['requested_cpu_m']),120)
|
||||
if __name__=='__main__':unittest.main()
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
"files": {
|
||||
"preflight.py": "1011e5872ebee718e969b7012b17c0737e10eaaed804e0c4ae254024d8ad5248",
|
||||
"payload.json": "c78879355d9f451d9dbf2c36cd74e35c996cc24d1e3d79c2a9dc6238baa5dde8",
|
||||
"run.py": "9923bc6ecdc0951d11debea727dedc9ff30b2b9abe152db9aa1020b6a6ef0114",
|
||||
"test_preflight.py": "cdf21c8af88e0e7d22dfb717d41c59726bdab8e157dcace369f71a5af5ed810f"
|
||||
},
|
||||
"frozen_resources_equal": true,
|
||||
"frozen_projection_equal": true,
|
||||
"platform_module_sha256": "4fb9ce6608ad04c4f5dc98a95796dc88a08a2453dc15c0d40c5c688fc02f573f",
|
||||
"platform_projection_ast_equal": true,
|
||||
"focused_tests_passed": 6,
|
||||
"local_kubectl_format_check": {
|
||||
"status": "unavailable-offline",
|
||||
"kubeconfig": "/dev/null",
|
||||
"reason": "client dry-run still attempted discovery on localhost and connection refused; no credential files read",
|
||||
"raw_stderr_suppressed": true,
|
||||
"followup": "Coordinator validates JSONPath using identity-only existing metadata before full wrapper. Synthetic string separator test alone is not actual client proof."
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,328 @@
|
|||
{
|
||||
"applications": {
|
||||
"eso-token-renewer": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76246569",
|
||||
"uid": "b10d1e31-08da-4364-b537-4e166eeeb25e"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "eso-token-renewer-worker-5c86dt7fm7",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "CronJob",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/eso-token-renewer",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"informed-decision": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76247431",
|
||||
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-c81577741a09",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-workload-registry",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision-workload",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-lifecycle-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRole",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRoleBinding",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "312ab97e876e17341bf16f9e95397e14c2ac2720"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"openbao-secretstore": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "openbao-secretstore",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76247497",
|
||||
"uid": "f2932505-e649-4b99-b505-4789ed21301f"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "ClusterSecretStore",
|
||||
"name": "openbao",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/openbao-secretstore",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"railiance-apps-root": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "railiance-apps-root",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76247264",
|
||||
"uid": "3078d1f5-07c2-44cc-bff7-c2ee2a2c9e7c"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "activity-core",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "bao-notice",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision-requester",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "openbao-secretstore",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "secret-annotation-guard",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "state-hub-memo-dispatch",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "target-revenue",
|
||||
"namespace": "argocd"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/railiance01/applications",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "main"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
}
|
||||
},
|
||||
"held_fence": false,
|
||||
"objects": {
|
||||
"deployment/flex-auth-secrets-engine": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"conditions": [
|
||||
{
|
||||
"reason": "NewReplicaSetAvailable",
|
||||
"status": "True",
|
||||
"type": "Progressing"
|
||||
},
|
||||
{
|
||||
"reason": "MinimumReplicasAvailable",
|
||||
"status": "True",
|
||||
"type": "Available"
|
||||
}
|
||||
],
|
||||
"field_managers": [
|
||||
{
|
||||
"manager": "helm",
|
||||
"operation": "Update"
|
||||
},
|
||||
{
|
||||
"manager": "k3s",
|
||||
"operation": "Update"
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"namespace": "flex-auth",
|
||||
"owners": [],
|
||||
"resource_version": "75291996",
|
||||
"uid": "f83a5f5c-7dd7-4aac-bc02-d447e423e6ae"
|
||||
}
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"externalsecret.external-secrets.io/flex-auth-secrets-engine-envelope-signing": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"persistentvolumeclaim/flex-auth-secrets-engine-outbox": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"secretstore.external-secrets.io/openbao-flex-auth-envelope-signing": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"serviceaccount/flex-auth-envelope-signing-eso": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"serviceaccount/flex-auth-secrets-engine": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"conditions": [],
|
||||
"field_managers": [
|
||||
{
|
||||
"manager": "helm",
|
||||
"operation": "Update"
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"namespace": "flex-auth",
|
||||
"owners": [],
|
||||
"resource_version": "57721771",
|
||||
"uid": "4fd62828-c7b6-47ce-ac44-11b9fab851c4"
|
||||
}
|
||||
},
|
||||
"stderr_present": false
|
||||
}
|
||||
},
|
||||
"observed_at": "2026-10-16T19:12:36.858755+00:00",
|
||||
"persistent_mutations": false,
|
||||
"schema": "platform-native-plan-public-supplement.v1",
|
||||
"transport": {
|
||||
"exit_code": 0,
|
||||
"stderr_present": false
|
||||
},
|
||||
"collector_sha256": "sha256:151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d",
|
||||
"coordinator_completed_at": "2026-10-16T19:12:36.585389+00:00"
|
||||
}
|
||||
|
|
@ -0,0 +1,302 @@
|
|||
{
|
||||
"schema": "railiance-platform.bounded-native-plan-review.v1",
|
||||
"reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
|
||||
"work_item": "RPF-WP-0035-T12",
|
||||
"decision": "approved",
|
||||
"scope": "Exact P4/R2 Platform custody/read-lane and existing Argo Application manual-sync/freeze execution proposal, contingent on mandatory observed execution gates. Owner plan review only; not founder approval, native execution, CCR approval recording or completed native-admission disposition.",
|
||||
"intent_basis": "INTENT Secure Custody, Stable Interfaces and Operable and Observable; Staff PEP-shaped attended founder-gated effects. SCOPE retains OpenBao custody/policy/delivery acceptance, not workload/Helm, cluster runtime/storage, identity or authorization ownership.",
|
||||
"exact_revisions": {
|
||||
"platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53",
|
||||
"packet_p4_manifest_sha256": "9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3",
|
||||
"rollout_r2_manifest_sha256": "5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
|
||||
"chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
|
||||
"image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
||||
"image_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
||||
"deployment_projection_sha256": "8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c",
|
||||
"ccr_proposed_sha256": "44bbbf4aff84c3b085afdb14708106fd9a12ac03a0c47774913931a87fb94ada"
|
||||
},
|
||||
"evidence": {
|
||||
"live_preflight_sha256": "7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b",
|
||||
"observed_at": "2026-10-16T18:53:06.325922+00:00",
|
||||
"all_seven_server_dry_runs_accepted": true,
|
||||
"projection_source_matches_server_admitted_stopped_render": true,
|
||||
"held_fence": false,
|
||||
"actual_signer_stopped": false,
|
||||
"application_supplement_sha256": "f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c",
|
||||
"application_supplement_observed_at": "2026-10-16T19:12:36.858755+00:00",
|
||||
"application_collector_sha256": "sha256:151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d"
|
||||
},
|
||||
"platform_read_lane": {
|
||||
"ccr": "CCR-2026-0050",
|
||||
"policy": "workload-kv-read-flex-auth-envelope-signing",
|
||||
"role": "external-secrets-flex-auth-envelope-signing",
|
||||
"sa": "flex-auth/flex-auth-envelope-signing-eso",
|
||||
"audience": "openbao",
|
||||
"ttl_seconds": 900,
|
||||
"max_ttl_seconds": 900,
|
||||
"explicit_max_ttl_seconds": 900,
|
||||
"no_default_policy": true,
|
||||
"permissions": "Exact platform/data/workloads/flex-auth/envelope-signing read plus lookup-self read/revoke-self update; no metadata/list/sibling/write/delete grant. KV document has all three fields; ESO projects only ED25519_PRIVATE_KEY to seed. No field-level authorization claim.",
|
||||
"delivery": "Namespaced SecretStore flex-auth/openbao-flex-auth-envelope-signing and ExternalSecret flex-auth/flex-auth-secrets-engine-envelope-signing; Owner target creation, Retain deletion, 5m refresh; dedicated SA automount false. This proposed namespaced lane does not mutate existing ClusterSecretStore/openbao or legacy ESO token renewer."
|
||||
},
|
||||
"observed_application_scope": [
|
||||
{
|
||||
"name": "railiance-apps-root",
|
||||
"uid": "3078d1f5-07c2-44cc-bff7-c2ee2a2c9e7c",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Parent of existing nine Applications; hold manual sync during ceremony to prevent child source/policy changes.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/railiance01/applications",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "main"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "activity-core",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "bao-notice",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision-requester",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "openbao-secretstore",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "secret-annotation-guard",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "state-hub-memo-dispatch",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "target-revenue",
|
||||
"namespace": "argocd"
|
||||
}
|
||||
],
|
||||
"resource_version": "76247264"
|
||||
},
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Resource inventory includes NetworkPolicies informed-decision-lifecycle-ingress and informed-decision-review-ingress in flex-auth. Hold manual sync affecting those policies; no signer Deployment/ESO resource ownership observed.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "312ab97e876e17341bf16f9e95397e14c2ac2720"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-c81577741a09",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-workload-registry",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision-workload",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-lifecycle-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRole",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRoleBinding",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"resource_version": "76247431"
|
||||
},
|
||||
{
|
||||
"name": "openbao-secretstore",
|
||||
"uid": "f2932505-e649-4b99-b505-4789ed21301f",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Owns ClusterSecretStore/openbao only; existing shared delivery controller-adjacent app. No proposed signer namespaced lane ownership observed; preserve existing state and no related manual sync during ceremony.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/openbao-secretstore",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "ClusterSecretStore",
|
||||
"name": "openbao",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"resource_version": "76247497"
|
||||
},
|
||||
{
|
||||
"name": "eso-token-renewer",
|
||||
"uid": "b10d1e31-08da-4364-b537-4e166eeeb25e",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Owns legacy renewer ConfigMap/SA/CronJob in external-secrets, not new dedicated Kubernetes-auth role. Preserve unchanged; no stop/disable of unrelated shared renewer proposed.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/eso-token-renewer",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "eso-token-renewer-worker-5c86dt7fm7",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "CronJob",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
}
|
||||
],
|
||||
"resource_version": "76246569"
|
||||
}
|
||||
],
|
||||
"observed_signer_controller": "No Application in the current complete inventory owns flex-auth-secrets-engine Deployment, signer SecretStore/ExternalSecret or outbox PVC. Helm release revision4 and native Deployment/ReplicaSet controller are actual signer write path; Access owns exact manual/CI/Helm writer freeze. No new signer Argo adoption or controller configuration change is proposed.",
|
||||
"mandatory_execution_gates": [
|
||||
"Initial founder rollout/CCR decision may authorize only its explicitly enumerated read-lane apply and Access stopped-candidate preparation effects under reviewed owner scopes; it does not require those effects to exist before authorization. After that authorization and execution, assemble separately reviewed final one-use custody scope from approved CCR bytes/confirmed native bindings, authenticated founder entity, future absolute UTC expiry, held exclusive-window receipt, stopped native projection/fence and independent consumer baseline. All five dispositions bind this exact completed scope before custody. Actual founder/expiry/CCR/window remain null in frozen P4 preparation; this review fills none.",
|
||||
"Before window refresh exact Application UID/source revision/resource tuples/current operation and manual sync settings for the identified apps and root. Freeze explicit manual sync/CI/Helm actors by founder executor/abort-owner agreement; require no pending/running Argo operation affecting relevant resources. Last Succeeded alone is not proof of no newly queued operation. Preserve before-state metadata; no speculative absence-of-all-possible-writers requirement. The19:12:36 supplement establishes all four selected Applications manual/no queued operation at that time, not a reserved future window.",
|
||||
"Platform approves only source read-lane policy/role/delivery design here. Separate founder CCR decision and reviewed role/policy apply/readback are required; verify exact SA namespace/audience, native policy and all 900s/max/no-default attributes. Native positive/negative ESO login/path tests and safely reduced Ready/SecretSynced/version correspondence are separate evidence; no raw Secret/JWT outputs.",
|
||||
"Access installs exact stopped candidate through reviewed Helm path and authenticates competing workload writers; actual observedGeneration, Deployment/owned ReplicaSets0, no owned/terminating/signer-SA/seed-mount pods and no HPA must hold. Exact native projection must equal8ce375f, independently of successful server dry-run. Secrets owns stopped/failclosed consumer; cluster owns refreshed headroom/storage/PV retention.",
|
||||
"Founder runs only exact approved silent child/source/admission-file hash through attended Warden OIDC. Use private0700 receipt/admission custody,0600 files, trusted dependencies/runtime and explicit same-UID containment assessment. 5<remaining<=120 seconds at child start with fixed2s I/O caps; expired/early/changed scope refuses; no TTL widening/post-login refresh.",
|
||||
"One fixed CAS0 plus metadata setup/readback is distinct from CCR read grant. Fresh exact cluster/backend/entity/source/reader-policy and actual fence checks precede private effects; only durable authenticated public receipt may cross to Secrets. No private seed/credential output, external seed import, standing writer role or agent session.",
|
||||
"Keep signer and consumer fenced after CAS until independent Secrets public key/kid/fingerprint/trust admission, exact ESO/readback and Access mounted-runtime proofs. 120s ready abort and600s founder recovery hold apply to proposed rollout; no success inferred from source/public preparation.",
|
||||
"On any unknown custody/write/readback/fsync, hold fence and original unknown receipt; only independently reviewed R2 read-only recovery binds immutable original receipt and current/original source lineages. No CAS retry/remint, automatic cleanup, private seed restoration or retrospective success.",
|
||||
"Platform restores only captured safe manual Application/sync state under reviewed recovery disposition; never sync root merely to clear OutOfSync or enable automated/prune/selfheal. Access owns workload rollback and outbox preservation; unsigned05a remains failclosed for strict signed consumer. Secrets owns trust withdrawal/restoration; cluster owns PVC/PV retention. Compromise uses separately approved forward-only successor, never old-seed restoration."
|
||||
],
|
||||
"owner_roles": [
|
||||
"access-engine-owner: workload/Helm",
|
||||
"railiance-platform-owner: custody/read-lane/existing Applications",
|
||||
"cluster-runtime-storage-owner: runtime/storage",
|
||||
"secrets-engine-owner: consumer/trust",
|
||||
"founder: exact decision/executor/abort authority"
|
||||
],
|
||||
"cost_and_risk": "Platform preparation/new infrastructure EUR0. No monetary loss/risk ceiling granted. Seed compromise permits lifecycle forgery; controlled outage and node-local evidence loss need explicit founder disposition. Shared ESO/Argo controllers remain installed unchanged; Enablement review only if actual installation/controller configuration delta is later proposed.",
|
||||
"not_authorized": [
|
||||
"live Kubernetes/OpenBao/Argo mutation",
|
||||
"credential or Secret reads/TokenRequest",
|
||||
"native custody/trust/caller admission",
|
||||
"founder decision or completed native scope assent",
|
||||
"other-owner review"
|
||||
],
|
||||
"open_metadata_detail": "Requested sanitized supplement successfully observed all four exact Application sources/revisions/resource tuples and no queued operation; proposed delivery objects/PVC absent. Refresh at authorized ceremony; no broader writer inventory demanded.",
|
||||
"workplan_status": "RPF-WP-0035-T12 remains progress; all native custody/acceptance gates remain open.",
|
||||
"observed_delivery_state": {
|
||||
"proposed_eso_sa_store_external_secret_and_pvc_absent": true,
|
||||
"deployment_field_managers": [
|
||||
"helm",
|
||||
"k3s"
|
||||
],
|
||||
"signer_sa_field_managers": [
|
||||
"helm"
|
||||
],
|
||||
"observations_grant_no_execution": true
|
||||
},
|
||||
"approval_stages": {
|
||||
"initial_rollout_ccr_decision": "Explicit founder scope for read role/policy/delivery apply and stopped Helm/PVC preparation only; source plan owner reviews support this proposal. No custody/public-trust/caller grant inferred.",
|
||||
"later_one_use_custody_assent": "Five exact dispositions bind completed approved CCR/native binding receipt, founder identity, absolute expiry, held window, actual fence/projection, source/image/baseline. Changed expiry changes scope.",
|
||||
"execution_produced_facts_not_initial_human_choices": [
|
||||
"actual stopped Helm revision",
|
||||
"PVC UID/PV UID and Retain readback after WFFC binding",
|
||||
"actual stopped fence/projection receipt",
|
||||
"held-window observation"
|
||||
],
|
||||
"unresolved_human_choices": [
|
||||
"authenticated public founder OpenBao entity UUID (not inferred from hub-writer identity)",
|
||||
"concrete ceremony absolute UTC expiry/window for final exact scope",
|
||||
"accept or constrain proposed high seed-forgery/outage/local-evidence-loss scope; no monetary loss ceiling is established"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
{
|
||||
"schema": "platform-owner-review-publication-receipt.v1",
|
||||
"repo": "railiance-platform",
|
||||
"commit": "08c1f036f2750097750f435efd76e8f6ee6df393",
|
||||
"command": "uv run --project /home/worsch/repo-manager rmgr sync --path /home/worsch/railiance-platform --push",
|
||||
"exit_code": 0,
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"primary_receipt": {
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "08c1f036f2750097750f435efd76e8f6ee6df393",
|
||||
"derived_commit": "08c1f036f2750097750f435efd76e8f6ee6df393",
|
||||
"outcome": "applied",
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"unresolved_edges": 12
|
||||
},
|
||||
"validation": {
|
||||
"ccr_schema": "passed",
|
||||
"ccr_apply_still_blocked_on_unconfirmed_binding": true,
|
||||
"git_diff_check": "passed",
|
||||
"commit_secret_scan": "clean"
|
||||
},
|
||||
"preexisting_changes_preserved": [
|
||||
"WORK-RECORDS.md"
|
||||
],
|
||||
"native_effects_executed": false,
|
||||
"frozen_p4_modified": false
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"schema": "platform-native-plan-review-verification.v1",
|
||||
"platform_checkout_head": "84c529f239c81e6d3ca337015700b03e3a862f53",
|
||||
"owner_checkout_mutated": false,
|
||||
"scope": "review artifact and own-role CCR comment/T12 workrecord patch only",
|
||||
"owner_review_sha256": "3a2b4e8a410ffa241540afcd25c1dc2036eab93f433feeaa7708bda9f2175f20",
|
||||
"patch_sha256": "57ad03343cf0b01a76475029a7a407244eb4835e79c7be21c3dfd2aeebec2bd9",
|
||||
"approval_fields_modified": false,
|
||||
"native_execution": false,
|
||||
"patch_applies_to_unchanged_owner_checkout": true,
|
||||
"collector_static_compile_passed": true,
|
||||
"collector_executed": false,
|
||||
"collector_sha256": "151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d",
|
||||
"supplement_sha256": "f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c",
|
||||
"collector_executed_by_root": true
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue