From 108bb9a2de093f4067f9be0d6265d4322332fe44 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 19 Aug 2026 14:24:33 +0200 Subject: [PATCH] Close USER-WP-0023 after live A2 enforce evidence flex-auth-user-engine is enforce on sha256:138aa347. Probe from user-engine-8569d7cb87-fp7px: 200 with the projected token, 401 without, 403 when representing tenant-engine. Record fsGroup 10001 so uid 10001 can read the projected caller token. --- docs/flex-auth-caller-identity.md | 49 +++++++++++-------- .../USER-WP-0023-flex-auth-caller-identity.md | 20 ++++++-- 2 files changed, 44 insertions(+), 25 deletions(-) diff --git a/docs/flex-auth-caller-identity.md b/docs/flex-auth-caller-identity.md index e08d015..cab46de 100644 --- a/docs/flex-auth-caller-identity.md +++ b/docs/flex-auth-caller-identity.md @@ -1,6 +1,6 @@ # flex-auth caller identity contract -Status: caller side implemented and deployed; live proof pending flex-auth A2 promotion (FLEX-WP-0015-T02). +Status: live A2 proven 2026-08-19 on `flex-auth-user-engine` (`enforce`). Governing published policy (2026-08-19): @@ -31,12 +31,14 @@ The tenant authority seam is distinct: user-engine identifies itself as actor own flex-auth decision before store access. Tenant ids remain opaque and are URL-encoded. No client may infer existence from an unauthorized read. -As of 2026-08-18 the deployed user-engine image carries this file-based caller -token, so the caller side is no longer the laggard. The remaining asymmetry runs -the other way: flex-auth's A2 enforcement is implemented but unpromoted, so the -header is sent and ignored. That ordering is safe — a caller that authenticates -against a service that does not yet check is harmless, whereas the reverse -would have returned 401 to every decision. +As of 2026-08-19 `flex-auth-user-engine` is live `enforce` on digest +`sha256:138aa347…` (Helm release rev 4). user-engine `sha256:c501aeb2…` +sends the projected token. The pod security context must set +`runAsUser` / `runAsGroup` / `fsGroup` `10001` (image uid; see +Containerfile). Without `fsGroup`, the projected token is `0440 root:root` +and the adapter never sends `Authorization`. That is persisted in +rapp-user-engine `manifests/runtime.yaml` `e599b4f`. The portal image has +no `curl`; live probes use Python. ## Live promotion probe (USER-WP-0023-T03) @@ -45,16 +47,12 @@ runs in namespace `user-engine` as ServiceAccount `user-engine`, with the projected token mounted at `/var/run/secrets/flex-auth-caller/token` under audience `flex-auth` and `USER_ENGINE_FLEX_AUTH_TOKEN_FILE` pointing at it. -**This probe cannot pass yet, and the reason is upstream.** FLEX-WP-0015-T02 -is `wait`: ADR 0004's TokenReview choke point is implemented in flex-auth -source, but the running digest is unchanged, so production still accepts -unauthenticated callers. Our Authorization header is currently sent and -ignored. Run the probe only after flex-auth promotes A2 through -FLEX-WP-0011; before then step 2 returns a normal decision instead of 401 and -would record a false pass. +Closed 2026-08-19 after `flex-auth-user-engine` flipped to `enforce`. +Do not re-run these against `warn`: step 2 would return a decision. -Run from an operator shell with cluster credentials (this repo's sessions do -not hold them). `POD` is any ready user-engine pod. +`POD` is any ready user-engine pod. The portal image has no `curl`; the +recorded run used Python. The bash shape below is the contract, not the +exact live invocation. ```bash POD=$(kubectl -n user-engine get pod -l app.kubernetes.io/name=user-engine \ @@ -89,9 +87,19 @@ BODY='{"actor":{"issuer":"https://kc.coulomb.social","subject":"probe", A2 choke point named by Tenancy Posture v0.1; publication does not change the remaining operator sequence. -Record all three results, the flex-auth digest they ran against, and the -user-engine digest, in USER-WP-0023-T03 before marking it done. A pass on -steps 1 and 3 without a 401 on step 2 means enforcement is still off. +Recorded 2026-08-19 from pod `user-engine-8569d7cb87-fp7px` (flex-auth +message `45852487`): + +| Step | Result | +| --- | --- | +| 1. Bearer projected token | `200` `decision:350b46fb42989606` allow `tenant_admin` | +| 2. No Authorization | `401` `unauthenticated` | +| 3. `resource.system=tenant-engine` | `403` `forbidden` | + +Digests: flex-auth `sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b`, +user-engine `sha256:c501aeb204154d85017565a87fd34cff12e5c48f600d124d3f8c82f11bb9d59c`. +tenant-engine and `policy.enabled` were not moved. A pass on steps 1 and 3 +without a 401 on step 2 would have meant enforcement was still off. ## Live cross-service check (USER-WP-0021) @@ -108,5 +116,4 @@ and no `404`, which is what the rollback window produced. Capture the tenant-engine digest alongside the results; both silent rollbacks this month were digest-level and neither raised an alert. -This shares the operator rollout with the T03 probe above and is most -efficiently run in the same session. +This remains owed. It was not run in the 2026-08-19 A2 session. diff --git a/workplans/USER-WP-0023-flex-auth-caller-identity.md b/workplans/USER-WP-0023-flex-auth-caller-identity.md index df183da..a4ba691 100644 --- a/workplans/USER-WP-0023-flex-auth-caller-identity.md +++ b/workplans/USER-WP-0023-flex-auth-caller-identity.md @@ -4,7 +4,7 @@ type: workplan title: "Bind user-engine to flex-auth with rotating workload identity" domain: communication repo: user-engine -status: active +status: finished owner: codex topic_slug: netkingdom created: "2026-08-18" @@ -49,7 +49,7 @@ adapter request coverage. ```task id: USER-WP-0023-T03 -status: wait +status: done priority: high state_hub_task_id: "0499c65b-491d-4ed1-8549-f58dba48f612" ``` @@ -99,7 +99,19 @@ same split this workplan already implemented. (`https://policy.coulomb.social/architecture/net-kingdom/v0.1/`) lists both documents in chapter 9. -The workplan stays `active` because T03's live proof is still owed. That -proof is not unblocked by publication. +2026-08-19 close: flex-auth-user-engine is live `enforce` (Helm release +rev 4, digest `sha256:138aa347…`). Probe from pod +`user-engine-8569d7cb87-fp7px` (message `45852487`, FLEX-WP-0015-T02): + +1. Bearer projected token → `200` `decision:350b46fb42989606` allow + `tenant_admin` +2. No Authorization → `401` `unauthenticated` (not a decision) +3. `resource.system=tenant-engine` → `403` `forbidden` (binding, not allow) + +user-engine digest `sha256:c501aeb2…`. tenant-engine and `policy.enabled` +were not moved. Live user-engine needed `fsGroup: 10001` so uid 10001 can +read the `0440 root:root` projected token; that is persisted in +rapp-user-engine `manifests/runtime.yaml` `e599b4f`. This workplan is +finished. Contract: `docs/flex-auth-caller-identity.md`.