mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 17:34:31 +00:00
00f0ebec07
Bringing the long-running session-feature branch back into main in one deliberate sweep. The branch carried the cluster work that's been live for weeks (cross-cluster CNPG metrics, Grafana w/ Google OAuth, supabase oauth2-proxy, cluster recovery, pg.0.knoe.dev + per-engineer onboarding, GCS-backed CNPG backups via Workload Identity, the env-contamination guard, the Junie brief queue, the cnpg-grafana CSRF + memory-request fixes from today), while main accumulated Junie's parallel knoe-auth Phase 2 OIDC work (full provider surface: discovery, authorize, token, userinfo, JWKS, RS256 signing, code exchange, session services). Key decision: the two branches did COMPETING rebrands off the same starting point (5ba9b63, 2026-04-27): - claude branch (commit b355855, earlier): org.prole.authority.* → dev.knoe.auth.* (artifact renamed to knoe-auth.jar) - main (commit9daa94b, recent): org.prole.authority.* → dev.knoe.authority.* (kept "authority" artifact name) dev.knoe.auth wins: cluster runs from this name, the Maven artifact is already knoe-auth.jar, and the broader rename is the documented namespace direction (per ~/.claude/projects/-Users-chrisfu-dev-knoe-db/ memory/MEMORY.md). All of main's recent Phase 2 OIDC content was ported from authority/src/.../dev/knoe/authority/ into authority/src/.../dev/knoe/auth/ with package declarations rewritten. == File-level resolution summary == Textual conflicts (4): authority/pom.xml - Took our artifactId="auth" - Took our branch's removal of spring-security-kerberos-client (verified: Junie's Phase 2 OIDC code does not import it; the dep was already-dead config) docs/pipeline-phases.md - Took our branch's "Phase 1 not started" status. Main had a misplaced "✅ Complete" with a knoe-auth-Phase-1 commit ref in the autobuild Phase 1 section — different domain. docs/plans/knoe-auth-round-1.md - Took our branch's dev.knoe.auth file table (vs main's dev.knoe.authority listing). Pure rename mismatch. supabase/helm/knoe-supabase/templates/kong/config.yaml - Took our branch's onboard route + plain dashboard wiring. Main had an oauth2proxy.enabled toggle that put oauth2-proxy as a Kong upstream — but the deployed architecture (commit 25f1b2e) has oauth2-proxy in FRONT of Kong, not behind. Main's wrapper reflected an architecture that was never deployed. - Took our branch's removal of basic-auth from dashboard route (queue #15 brief still tracks the matching values.yaml / kong/deployment.yaml cleanup). Java tree reconciliation (44 file-pairs): 20 dual-path source files + 2 dual-path tests Body-identical between main's authority/ and our branch's auth/ after stripping package decls — main's commit9daa94bwas a pure rebrand. Took our branch's auth/ version for all 22. 8 main-only source files (Phase 2 OIDC), ported into auth/: web/JwksController.java web/OidcAuthorizeController.java web/OidcDiscoveryController.java web/OidcTokenController.java web/OidcUserInfoController.java session/OidcCodeService.java session/OidcTokenService.java session/SessionService.java 12 main-only test files, ported into auth/: HealthControllerTest.java enroll/EnrollValueTypesTest.java enroll/EnrollmentControllerTest.java enroll/TotpServiceTest.java kerberos/KadminClientTest.java kerberos/KerberosSpnegoResultTest.java web/LoginControllerTest.java admin/AdminControllerTest.java user/PrincipalNormalizerTest.java regression/IdentityRegressionTest.java session/OidcCodeServiceTest.java session/SessionServiceTest.java Port mechanics: read main:authority/...<file> via git show, then sed rewrite `package dev.knoe.authority` → `package dev.knoe.auth` and `import dev.knoe.authority` → `import dev.knoe.auth`. Body content unchanged. authority/src/main/java/dev/knoe/authority/ — DELETED (duplicate) authority/src/test/java/dev/knoe/authority/ — DELETED (duplicate) == Verification == - grep -rln '<<<<<<<' across .java/.md/.yaml/.yml/.sh/.xml/.tpl: clean - find authority/src -path '*/dev/knoe/authority*': empty (subtree gone) - grep 'package dev.knoe.authority' across repo: clean - bash -n install.sh deploy.sh etc/preflight_kubecontext.sh: clean - git ls-files -u | wc -l: 0 unmerged paths - helm lint supabase/helm/knoe-supabase: pre-existing failure on studioIngress.enabled undefined in values.yaml (introduced by Junie on main; unrelated to this merge — flagging as follow-up). == Followups (carried into TODO ranked queue or noted here) == - helm lint failure: studioIngress block in values.yaml is missing enable flag; templates/studio/{ingress,oauth2proxy-deployment, oauth2proxy-service}.yaml all reference studioIngress.enabled with no default. Pre-existing on main; not introduced by this merge. - The five Junie briefs filed on this branch are now reachable from main at docs/plans/junie/{02,06,07,13,15}-*.md. Junie can pick them up in any order. - knoe-auth Phase 2 OIDC source (now at dev.knoe.auth.*) is not yet deployed to the cluster. Deployment is its own task. - The branch claude/crazy-bose-fec256 stays in place (worktree at .claude/worktrees/crazy-bose-fec256 may have ongoing context for Claude Code sessions). Safe to delete once next session starts cleanly from main. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
59 lines
2.4 KiB
YAML
59 lines
2.4 KiB
YAML
# External TCP LoadBalancer for direct psql access to the CNPG primary.
|
|
#
|
|
# Hostname: pg.0.knoe.dev (DNS A record pointed manually at Namecheap to the
|
|
# IP allocated by this Service).
|
|
#
|
|
# Auth model:
|
|
# - Phase 1 (current): per-engineer postgres roles with strong passwords +
|
|
# VALID UNTIL 30d. SCRAM-SHA-256 over TLS (hostssl in pg_hba).
|
|
# - Phase 2 (queued): PostgreSQL 18 OAUTHBEARER with a custom validator
|
|
# library (knoe_oauth.so) that maps Google email -> postgres role.
|
|
# Connection target stays the same; only the credential issuance changes.
|
|
#
|
|
# TLS: CNPG issues the server cert and auto-rotates it. The cluster spec's
|
|
# `certificates.serverAltDnsNames` is extended with `pg.0.knoe.dev` so the
|
|
# auto-issued cert validates externally. Engineers download the CNPG-issued
|
|
# CA cert (kubectl get secret knoe-db-ca -n knoe-db-0 -o jsonpath='{.data.ca\.crt}' | base64 -d)
|
|
# and use `sslmode=verify-full sslrootcert=<ca.crt>`.
|
|
#
|
|
# Source-IP allowlist: open today (loadBalancerSourceRanges: 0.0.0.0/0). Tighten
|
|
# to known engineer/CI IP ranges in a follow-up; SCRAM-SHA-256 is brute-force-
|
|
# resistant so the open window is acceptable for the Phase 1 horizon (~30d).
|
|
#
|
|
# Phase 1 verification (after DNS A record is up):
|
|
# psql "host=pg.0.knoe.dev port=5432 user=chrisfu dbname=postgres sslmode=verify-full sslrootcert=$HOME/.knoe/knoe-db-ca.crt"
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: knoe-db-rw-elb
|
|
namespace: knoe-db-0
|
|
labels:
|
|
app.kubernetes.io/name: knoe-db
|
|
app.kubernetes.io/component: postgres-external
|
|
app.kubernetes.io/managed-by: knoe-installer
|
|
annotations:
|
|
# GKE L4 Regional Backend Service (newer LB type; required for SCTP and
|
|
# for some traffic-policy combinations; allocates faster than the legacy
|
|
# network LB on this cluster).
|
|
cloud.google.com/l4-rbs: "enabled"
|
|
spec:
|
|
type: LoadBalancer
|
|
# `Local` preserves the client's real source IP at the postgres backend
|
|
# (vs `Cluster` which SNATs to the receiving node IP, making external
|
|
# clients look like they live in the cluster's 10.0.0.0/8 range and bypass
|
|
# the `hostnossl reject` rule in pg_hba).
|
|
externalTrafficPolicy: Local
|
|
loadBalancerSourceRanges:
|
|
# Phase 1: open. Tighten in a follow-up once we have an engineer IP allowlist
|
|
# or a corp VPN egress range.
|
|
- 0.0.0.0/0
|
|
selector:
|
|
cnpg.io/cluster: knoe-db
|
|
cnpg.io/instanceRole: primary
|
|
ports:
|
|
- name: psql
|
|
port: 5432
|
|
targetPort: 5432
|
|
protocol: TCP
|