# Brief 03 — Image rename: knoe-authority → knoe-auth

**Status:** Active  
**Filed:** 2026-05-02  
**Author:** Junie

---

## 1. Problem

The Maven artifact has been `knoe-auth.jar` since commit b355855, but the Docker image is still
tagged `knoe-authority:latest` in Artifact Registry and in both deployment manifests.  
There is no Spring Boot `Dockerfile` in the repo — `authority/Dockerfile` is the Samba/KDC image,
not the application image.

Drift tracked in `docs/TODO.md` as queue item #3 and Reality table row R6.

---

## 2. Deliverables

### 2.1 New Spring Boot Dockerfile

`authority/Dockerfile.app` — multi-stage build:

1. **Build stage** (`maven:3.9-eclipse-temurin-21`) — runs `mvn -f authority/pom.xml -DskipTests package`
2. **Runtime stage** (`eclipse-temurin:21-jre-jammy`) — copies `authority/target/knoe-auth.jar`, exposes 8080

### 2.2 New Make targets

```
docker-build-auth   # builds authority/Dockerfile.app → knoe-auth:latest (local tag)
docker-push-auth    # tags + pushes to Artifact Registry as knoe-auth:latest and knoe-auth:<version>
```

`REGISTRY` defaults to `us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system`.

### 2.3 Manifest updates

| File | Lines to change | Old value | New value |
|---|---|---|---|
| `deploy/gcp/gke/knoe-auth-deployment.yaml` | 31, 133, 245 | `knoe-authority:latest` | `knoe-auth:latest` |
| `deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml` | 19, 205 | `myrddin.prole.org:5000/knoe-authority:latest` | `myrddin.prole.org:5000/knoe-auth:latest` |

(k3s line 132 already uses `knoe-auth:latest` — no change needed.)

### 2.4 Doc updates

- `docs/knoe-system.md` §3 "Key manifests" table — remove the "Note: image tag still knoe-authority:latest" caveat
- `docs/knoe-system.md` §7 open work items — remove queue #3 entry
- `docs/TODO.md` — move queue #3 to Done, drop Reality row R6

---

## 3. Out of scope

- Actual `docker push` to Artifact Registry (requires GCP credentials; engineer runs `make docker-push-auth`)
- Renaming the KDC image (`authority/Dockerfile` → stays as-is; it's a separate image)

---

## 4. Definition of done

- [ ] `authority/Dockerfile.app` builds cleanly: `docker build -f authority/Dockerfile.app -t knoe-auth:latest .`
- [ ] `make docker-build-auth` succeeds
- [ ] `git grep knoe-authority -- deploy/` returns nothing
- [ ] `docs/knoe-system.md` no longer references `knoe-authority:latest`
- [ ] `docs/TODO.md` queue #3 moved to Done, R6 dropped from Reality table

---

## 5. Commit shape

```
feat(auth): rename Docker image knoe-authority → knoe-auth

- Add authority/Dockerfile.app (Spring Boot multi-stage build)
- Add make docker-build-auth / docker-push-auth targets
- Update deploy/gcp/gke/knoe-auth-deployment.yaml (3 image refs)
- Update deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml (2 image refs)
- Update docs/knoe-system.md, docs/TODO.md

Closes queue #3. Drops Reality drift R6.
```