2 Commits

Author	SHA1	Message	Date
chrisfu	00f0ebec07	Merge claude/crazy-bose-fec256 into main ... Bringing the long-running session-feature branch back into main in one deliberate sweep. The branch carried the cluster work that's been live for weeks (cross-cluster CNPG metrics, Grafana w/ Google OAuth, supabase oauth2-proxy, cluster recovery, pg.0.knoe.dev + per-engineer onboarding, GCS-backed CNPG backups via Workload Identity, the env-contamination guard, the Junie brief queue, the cnpg-grafana CSRF + memory-request fixes from today), while main accumulated Junie's parallel knoe-auth Phase 2 OIDC work (full provider surface: discovery, authorize, token, userinfo, JWKS, RS256 signing, code exchange, session services). Key decision: the two branches did COMPETING rebrands off the same starting point (5ba9b63, 2026-04-27): - claude branch (commit b355855, earlier): org.prole.authority.* → dev.knoe.auth.* (artifact renamed to knoe-auth.jar) - main (commit 9daa94b, recent): org.prole.authority.* → dev.knoe.authority.* (kept "authority" artifact name) dev.knoe.auth wins: cluster runs from this name, the Maven artifact is already knoe-auth.jar, and the broader rename is the documented namespace direction (per ~/.claude/projects/-Users-chrisfu-dev-knoe-db/ memory/MEMORY.md). All of main's recent Phase 2 OIDC content was ported from authority/src/.../dev/knoe/authority/ into authority/src/.../dev/knoe/auth/ with package declarations rewritten. == File-level resolution summary == Textual conflicts (4): authority/pom.xml - Took our artifactId="auth" - Took our branch's removal of spring-security-kerberos-client (verified: Junie's Phase 2 OIDC code does not import it; the dep was already-dead config) docs/pipeline-phases.md - Took our branch's "Phase 1 not started" status. Main had a misplaced "✅ Complete" with a knoe-auth-Phase-1 commit ref in the autobuild Phase 1 section — different domain. docs/plans/knoe-auth-round-1.md - Took our branch's dev.knoe.auth file table (vs main's dev.knoe.authority listing). Pure rename mismatch. supabase/helm/knoe-supabase/templates/kong/config.yaml - Took our branch's onboard route + plain dashboard wiring. Main had an oauth2proxy.enabled toggle that put oauth2-proxy as a Kong upstream — but the deployed architecture (commit 25f1b2e) has oauth2-proxy in FRONT of Kong, not behind. Main's wrapper reflected an architecture that was never deployed. - Took our branch's removal of basic-auth from dashboard route (queue #15 brief still tracks the matching values.yaml / kong/deployment.yaml cleanup). Java tree reconciliation (44 file-pairs): 20 dual-path source files + 2 dual-path tests Body-identical between main's authority/ and our branch's auth/ after stripping package decls — main's commit 9daa94b was a pure rebrand. Took our branch's auth/ version for all 22. 8 main-only source files (Phase 2 OIDC), ported into auth/: web/JwksController.java web/OidcAuthorizeController.java web/OidcDiscoveryController.java web/OidcTokenController.java web/OidcUserInfoController.java session/OidcCodeService.java session/OidcTokenService.java session/SessionService.java 12 main-only test files, ported into auth/: HealthControllerTest.java enroll/EnrollValueTypesTest.java enroll/EnrollmentControllerTest.java enroll/TotpServiceTest.java kerberos/KadminClientTest.java kerberos/KerberosSpnegoResultTest.java web/LoginControllerTest.java admin/AdminControllerTest.java user/PrincipalNormalizerTest.java regression/IdentityRegressionTest.java session/OidcCodeServiceTest.java session/SessionServiceTest.java Port mechanics: read main:authority/...<file> via git show, then sed rewrite `package dev.knoe.authority` → `package dev.knoe.auth` and `import dev.knoe.authority` → `import dev.knoe.auth`. Body content unchanged. authority/src/main/java/dev/knoe/authority/ — DELETED (duplicate) authority/src/test/java/dev/knoe/authority/ — DELETED (duplicate) == Verification == - grep -rln '<<<<<<<' across .java/.md/.yaml/.yml/.sh/.xml/.tpl: clean - find authority/src -path '*/dev/knoe/authority*': empty (subtree gone) - grep 'package dev.knoe.authority' across repo: clean - bash -n install.sh deploy.sh etc/preflight_kubecontext.sh: clean - git ls-files -u | wc -l: 0 unmerged paths - helm lint supabase/helm/knoe-supabase: pre-existing failure on studioIngress.enabled undefined in values.yaml (introduced by Junie on main; unrelated to this merge — flagging as follow-up). == Followups (carried into TODO ranked queue or noted here) == - helm lint failure: studioIngress block in values.yaml is missing enable flag; templates/studio/{ingress,oauth2proxy-deployment, oauth2proxy-service}.yaml all reference studioIngress.enabled with no default. Pre-existing on main; not introduced by this merge. - The five Junie briefs filed on this branch are now reachable from main at docs/plans/junie/{02,06,07,13,15}-*.md. Junie can pick them up in any order. - knoe-auth Phase 2 OIDC source (now at dev.knoe.auth.*) is not yet deployed to the cluster. Deployment is its own task. - The branch claude/crazy-bose-fec256 stays in place (worktree at .claude/worktrees/crazy-bose-fec256 may have ongoing context for Claude Code sessions). Safe to delete once next session starts cleanly from main. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-01 16:39:10 -07:00
chrisfu	a069989315	Rename prole-db to knoe-db, add knoe-auth as cluster-internal KDC ... Itemized changes: 1. knoe-auth: New cluster-internal KDC and SSO gateway service - Created etc/init_knoe_auth.sh based on init_kdc.sh with knoe-auth naming - Namespace defaults to SERVICE_NAMESPACE (knoe-system) - ConfigMap: knoe-auth-kdc-config, Secret: knoe-auth-secrets - Legacy cleanup removes old auth/dog/authority deployments 2. Orchestration: knoe-auth initializes before CloudNativePG - Updated prole.sh to insert init_knoe_auth.sh as step 2 (before CNPG) - Renumbered all subsequent initialization steps 3. Kong routing: Updated init_kong.sh to route to knoe-auth in SERVICE_NAMESPACE 4. Comment/reference updates for knoe-auth - Updated init_common_services.sh, init_service_layer.sh, init_kerberos.sh 5. prole-db renamed to knoe-db across the entire codebase - Renamed prole-db/ directory to knoe-db/ - Renamed all prole-db Kubernetes manifests (deploy/opentofu, k8s/) - Renamed scripts: docker-root-knoe-db.sh, docker-run-knoe-db.sh, test-cnpg-knoe-db.sh - Renamed etc/init_prole-db-reset.sh to etc/init_knoe-db-reset.sh - Renamed etc/prole-db-passwwd.sh to etc/knoe-db-passwwd.sh - Renamed mock_val counterparts accordingly - Renamed tests/etc/test_init_prole-db-reset.sh to test_init_knoe-db-reset.sh - Renamed docs/prole-db-documentation-mcp-architecture.md to knoe-db variant - Renamed modes/k3d/prole-db/ to modes/k3d/knoe-db/ - Renamed prole-db.iml to knoe-db.iml 6. Configuration updates - Updated conf/dev, conf/prod, conf/test, conf/service prole.cfg files - Updated conf/port-mapping.cfg - Updated etc/prole_cfg.sh and mock_val/prole_cfg.sh - Updated service/prole.cfg 7. Kubernetes manifests and deploy configuration - Updated deploy/opentofu/k3s ArgoCD application YAMLs - Updated kong-configmap.yaml and kustomization.yaml - Updated k3s/kong-config.yml and prole-resources.yaml - Updated prole-mssql-db deployment YAMLs - Updated supabase helm render and deploy scripts 8. Infrastructure and GCP Terraform - Updated deploy/gcp/terraform: folders, groups, IAM, service-projects 9. Python/installer code updates - Updated knoe/core: actions, build_context, controller, env, milestones - Updated knoe/milestone.py - Updated knoe/ui/screens: cfg, database, database_options, deploy, docker, navigation, security, services, validate - Updated knoe.spec, status.py 10. Shell script updates - Updated etc/: build_db, init_cloudnative_pg, init_cnpg_backup, init_db_manager, init_forgejo, init_gitlab, init_monitoring, init_openbao, init_port_forwards, init_postgrest, init_supabase_ports, status - Updated mock_val/ counterparts for all above scripts - Updated prole-net/init-prole-dns.sh - Updated bin/prole-kpf.sh, gitea/deploy.sh, supabase/deploy.sh 11. Test updates - Updated tests/etc/: test_init_cloudnative_pg*, test_init_cnpg_backup*, test_init_kdc*, test_init_kerberos*, test_init_kong*, test_prole_cfg* - Updated tests/installer/: test_actions_helpers, test_cfg_save_kubecontext, test_controller, test_core_classes, test_milestones, test_milestones_extended, test_namespace_propagation - Updated tests/: test_database_options, test_navigation, test_render_supabase_hostname, test_docker_build_fix, test_all_prole_home_fixes, silent_install_test, final_test 12. Documentation updates - Updated docs/: DOCKER-BUILD-FIX, PROLE-CFG-SECRETS, PROLE-HOME-DIRECTORY, build-system, patent - Updated scan/network_description.txt - Updated pom.xml 13. Miscellaneous script updates - Updated root-level: _adopt_replica_pvcs, _fix_replica_merlin, _import_pi, _patch_cluster, _prebind_pvcs, _rebind_d002, _rebind_d002b, test_resolve - Updated scripts/generate_spec.py Co-authored-by: Junie <junie@jetbrains.com>	2026-03-22 22:16:21 -07:00