Repository navigation
staging ztna-audience A: teknoir-ztna scope + hub audience in transition - #120
Merged
Merged
Conversation
Realm: client scope teknoir-ztna (audience mapper, access token only) as an OPTIONAL scope of teknoir-cli; client teknoir is unchanged, so no default token gets the audience. ztna chart: hub env KEYCLOAK_AUDIENCE and KEYCLOAK_AUDIENCE_MODE (values: transition; the helper fails the render for anything but enforce|transition, unset means enforce). Tests for the scope, the optional scope, the env and the bad mode. The hub image pin is not changed here: it must be re-pinned with scripts/pin-image to the wg-tunnel merge commit before this is released. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The hub pin still predates the audience check (sha-9c9bdae ignores KEYCLOAK_AUDIENCE and KEYCLOAK_AUDIENCE_MODE), so enforce would only look enforced. The wg-tunnel commit cannot be pinned before it is merged and built, so the gate is in the release lint: check-pins.py fails a rendered wg-hub with KEYCLOAK_AUDIENCE_MODE=enforce on a tag in release-policy.yaml pre_audience_hub_tags (every earlier pin) and warns for transition. Re-pin with scripts/pin-image before this is released. README: hard gate (negative test) before --verified, and the rollback path (audienceMode transition, keep the teknoir-ztna optional scope on teknoir-cli). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pre_audience_hub_tags listed the known old wg-hub pins by prefix and was incomplete: sha-92680d4 (current wg-tunnel main), sha-c975288, sha-0967baf and the earlier staging pins passed enforce, and so would any branch build or a future re-pin. The lint now fails closed: release-policy.yaml audience_hub_tags lists the exact tags known to have the audience check (empty until the ztna-audience PR is merged and its image pinned), and a wg-hub that renders KEYCLOAK_AUDIENCE_MODE=enforce on any other tag is an error (warning for transition). Tests cover every pre-audience main build, prefixes, a missing tag and a missing list; README and values say to list the tag when re-pinning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
check_hub_audience warned for KEYCLOAK_AUDIENCE_MODE=transition, so PR A could ship with a hub that ignores KEYCLOAK_AUDIENCE* (sha-9c9bdae, audience_hub_tags empty). Any rendered mode on a tag outside audience_hub_tags is now an error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lm scope only with ztna on - wg-hub sha-a2478da (wg-tunnel #9 on top of #8): audience check plus leader election; listed in audience_hub_tags so the release lint accepts transition. - The teknoir-ztna client scope and its optional-scope entry render only when the auth chart gets ztna.enabled (app-of-apps passes it), so an install with ZTNA off keeps an identical realm (charts/ztna/tests/run.sh). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Anders 2026-10-22: "Keycloak ztna audience" ("A dedicated teknoir-ztna audience for hub tokens instead of reusing the CLI client").
Next: tnctl v0.1.2-beta asks for the scope on hub calls only; after 72 h without legacy tokens, PR B (enforce). Plan: plans/ztna-later.md ztna-audience.
helm unittest charts/auth 31/31, charts/ztna/tests/run.sh, scripts/tests/run.sh green.
🤖 Generated with Claude Code