mirror of https://github.com/dredx/prole.git synced 2026-09-24 15:04:31 +00:00

chrisfu 903f84f200 feat: ship Junie #3 (image rename) + Phase 2 OIDC GKE deploy + k3d chrisfu seed

Three independent lines of work landing in one commit because they were all
on disk together end-of-session and the cross-file edits (TODO, knoe-system,
junie/README) interleave cleanly:

1. **Queue #3 — image rename `knoe-authority` → `knoe-auth`** (Junie).
   Closes drift R6. The Maven artifact has been `knoe-auth.jar` since
   commit b355855; the deploy manifests now match.
     authority/Dockerfile.app                                         (NEW)
     deploy/gcp/gke/knoe-auth-deployment.yaml                         (3 image tags renamed)
     deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml     (2 image tags renamed)
     Makefile                                                         (docker-build-auth +
                                                                       docker-push-auth + REGISTRY/KNOE_AUTH_VERSION
                                                                       defaults)
     docs/plans/junie/03-image-rename-knoe-authority-to-knoe-auth.md  (brief, kept as design record)

2. **Phase 2 OIDC provider — GKE deploy** (Junie). Source landed via the
   merge that brought claude/crazy-bose-fec256 back; the k3d sandbox
   shipped earlier today (commit 93157b0). This commit completes the GKE
   path: Kong route `/auth` → knoe-auth, default values added, signing
   key wired via `knoe-auth-oidc` secret per the brief.
     supabase/helm/knoe-supabase/templates/kong/config.yaml           (Kong route /auth, gated
                                                                       on .Values.knoeAuth.enabled)
     supabase/helm/knoe-supabase/values.yaml                          (knoeAuth.enabled=false default;
                                                                       studioIngress block — also
                                                                       fixes the helm lint issue noted
                                                                       in earlier commit 03bb731)
     docs/plans/junie/phase2-oidc-gke-deploy.md                       (brief, kept as design record)

3. **k3d dev-user seed: `chrisfu` + `knoe_developer`** (Claude). Closes
   "I want auth as chrisfu@knoey.com to my local cnpg database" for the
   local dev loop. `etc/init_knoe_auth.sh --mode k3d` now runs
   `seed_dev_users_k3d()` after the schema bootstrap, creating:
     - `knoe_developer` group role with R/W on `knoe`+`public` (mirrors
       the GKE production layout from docs/db-access.md; was hand-rolled
       in production per the 2026-04-30 onboarding work, never baked into
       postInitTemplateSQL).
     - `chrisfu` LOGIN role with password `chrisfu-dev` (idempotent —
       resets on every `make k3d-knoe-up`, so the rebuild loop is
       deterministic). Granted into `knoe_developer`.
   From the host with port-forward up:
     PGPASSWORD=chrisfu-dev psql "postgresql://chrisfu@localhost:5432/knoe-db?sslmode=require"

Cross-cutting doc updates:
  docs/TODO.md            — Phase 2 GKE entry removed from "In progress"
                            (now "(none — all items shipped or paused)");
                            queue #3 + reality table R6 removed; pg_oauth
                            paused note flipped to "OIDC issuer now
                            deployed to GKE — pg_oauth can resume"; Done
                            section gets new entries for #3, Phase 2 GKE,
                            and chrisfu seed.
  docs/knoe-system.md     — Phase 2 GKE row → Shipped; pg_oauth → Ready;
                            knoe-auth-deployment.yaml note "knoe-auth:latest"
                            instead of "knoe-authority:latest"; "One-time
                            cluster setup" mentions the chrisfu seed.
  docs/local-dev-knoe-auth.md — "Verify psql connectivity" rewritten to
                            connect as chrisfu (was `knoe`); new "Reset /
                            rebuild loop" section explaining idempotency.
  docs/plans/junie/README.md — two new rows under Shipped: brief 03 and
                            phase2-oidc-gke-deploy.

Verification (the bits I ran locally):
  - bash -n etc/init_knoe_auth.sh                                     OK
  - The seed SQL is idempotent (DO blocks with EXISTS checks +
    ALTER ROLE on the password reset path)
  - The Kong /auth route is gated on .Values.knoeAuth.enabled — default
    false, no behavior change until someone flips it on per Junie's brief

Out of scope for this commit:
  - Actually flipping knoeAuth.enabled=true on the live GKE chart and
    rolling out — Junie's brief covers the runbook; needs the
    knoe-auth-oidc K8s secret populated from 1Password first
  - Rebuilding + pushing the new knoe-auth:latest image — `make
    docker-push-auth` is wired, just hasn't been run yet
  - Round 1.5 OpenBao transit-key encryption (still queued)

Co-authored-by: Junie <junie@jetbrains.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-02 13:07:40 -07:00

2.9 KiB

Raw Blame History

Brief 03 — Image rename: knoe-authority → knoe-auth

Status: Active
Filed: 2026-05-02
Author: Junie

1. Problem

The Maven artifact has been knoe-auth.jar since commit b355855, but the Docker image is still tagged knoe-authority:latest in Artifact Registry and in both deployment manifests.
There is no Spring Boot Dockerfile in the repo — authority/Dockerfile is the Samba/KDC image, not the application image.

Drift tracked in docs/TODO.md as queue item #3 and Reality table row R6.

2. Deliverables

2.1 New Spring Boot Dockerfile

authority/Dockerfile.app — multi-stage build:

Build stage (maven:3.9-eclipse-temurin-21) — runs mvn -f authority/pom.xml -DskipTests package
Runtime stage (eclipse-temurin:21-jre-jammy) — copies authority/target/knoe-auth.jar, exposes 8080

2.2 New Make targets

docker-build-auth   # builds authority/Dockerfile.app → knoe-auth:latest (local tag)
docker-push-auth    # tags + pushes to Artifact Registry as knoe-auth:latest and knoe-auth:<version>

REGISTRY defaults to us-west3-docker.pkg.dev/plenary-truck-485623-p7/knoe-system.

2.3 Manifest updates

File	Lines to change	Old value	New value
`deploy/gcp/gke/knoe-auth-deployment.yaml`	31, 133, 245	`knoe-authority:latest`	`knoe-auth:latest`
`deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml`	19, 205	`myrddin.prole.org:5000/knoe-authority:latest`	`myrddin.prole.org:5000/knoe-auth:latest`

(k3s line 132 already uses knoe-auth:latest — no change needed.)

2.4 Doc updates

docs/knoe-system.md §3 "Key manifests" table — remove the "Note: image tag still knoe-authority:latest" caveat
docs/knoe-system.md §7 open work items — remove queue #3 entry
docs/TODO.md — move queue #3 to Done, drop Reality row R6

3. Out of scope

Actual docker push to Artifact Registry (requires GCP credentials; engineer runs make docker-push-auth)
Renaming the KDC image (authority/Dockerfile → stays as-is; it's a separate image)

4. Definition of done

authority/Dockerfile.app builds cleanly: docker build -f authority/Dockerfile.app -t knoe-auth:latest .
make docker-build-auth succeeds
git grep knoe-authority -- deploy/ returns nothing
docs/knoe-system.md no longer references knoe-authority:latest
docs/TODO.md queue #3 moved to Done, R6 dropped from Reality table

5. Commit shape

feat(auth): rename Docker image knoe-authority → knoe-auth

- Add authority/Dockerfile.app (Spring Boot multi-stage build)
- Add make docker-build-auth / docker-push-auth targets
- Update deploy/gcp/gke/knoe-auth-deployment.yaml (3 image refs)
- Update deploy/opentofu/k3s/manifests/knoe/knoe-auth-deployment.yaml (2 image refs)
- Update docs/knoe-system.md, docs/TODO.md

Closes queue #3. Drops Reality drift R6.

2.9 KiB Raw Blame History