 Jon Chery
|
978334a4bc
|
feat(P06): auth init-idp real + auth register + doctor oidc (REQ-155)
Implements the v0.12 R-021 load-bearing change's working IdP path:
- orca auth init-idp: renders Dex config + systemd unit + Traefik route
(atomic deploy, RP ID from --rp-id, C-38)
- orca auth register: opens browser to WebAuthn registration page
- loadOIDCConfig: config-file loading (oidc block + cluster_domain),
falls back to flags + env vars
- orca doctor oidc: health check (systemctl is-active + .well-known)
- config.go: OIDCConfig block + ClusterDomain field
- markdown.go: oidc block parsing in config frontmatter
---ci---
project: orca
phase: 6
milestone: v0.13
status: complete
requirements:
covered: [155]
---/ci---
|
2026-08-10 11:55:01 +00:00 |
|
|
Jon Chery
|
5232fcb808
|
fix(P04): wire ACL enforcement + WebAuthn reg auth + audit actor (REQ-153)
R-023: Zero-trust enforcement operationally wired.
ACL enforcement (C-45 staged rollout):
- acl.Check wired into all 5 daemon handlers (dispatch/jobs/nodes/tasks)
- health endpoints exempt (liveness probes not gated)
- ACL log-only mode default (config acl.enforce=false); enforce after
bootstrap ACL verified
- sshpush auth: ORCA_OIDC_TOKEN validated against JWKS before apply
- txn apply: Authorize hook validates OIDC token before running pull
- acl.json mode 0600 (was 0644)
- flock on acl.json for concurrent grant/revoke
- bootstrap ACL: init grants cluster-admin to orca-admins group + SVID
Audit actor identity:
- currentActor reads OIDC sub from credentials.json (was hardcoded "cli")
- threaded through all audit.Record calls via context
WebAuthn registration auth:
- BeginRegistration/FinishRegistration require authenticated session
- fail-closed 401 when no authFunc configured
New files: internal/daemon/acl.go, internal/cli/authactor.go,
internal/engine/actor.go, internal/identity/authtoken.go,
internal/sshpush/auth.go, internal/txn/auth_test.go
---ci---
project: orca
phase: 4
milestone: v0.13
status: complete
requirements:
covered: [153]
---/ci---
|
2026-08-07 20:33:39 +00:00 |
|
|
Jon Chery
|
437aab39b4
|
feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)
P0a1 — Re-architecture Foundation (path resolver + config demotion).
Path resolver (REQ-070, R-002):
- internal/paths/paths.go: 23 functions for the multi-namespace layout
(Root/ClusterDir/NamespaceDir/NS*/DefaultNamespace/CA/MasterKey/CacheDB/
Txn/Peers/KnownHosts/SSH/Server/Config). Honors $ORCA_HOME. 100% coverage.
- internal/certpaths/certpaths.go: refactored as thin shim delegating to
paths, preserving the v0.8 flat-layout API for backward compat during
the dual-write window (REQ-090). Package doc explains the v0.10-P14
migration plan. certpaths deleted after v0.10-P14. 100% coverage.
Config demotion (REQ-069, R-014):
- internal/config/markdown.go: minimal hand-rolled YAML frontmatter parser
(no new dep — yaml.v3 not in go.mod). Returns same *Config struct as HCL.
- internal/config/config.go: renamed Load body to LoadHCL (// Deprecated
per R-013), added dispatcher Load() routing on extension (.hcl->HCL,
.md->Markdown, .yaml->Markdown). Signature preserved so root.go unchanged.
- dispatch_test.go + markdown_test.go: 89.8% coverage on config package.
Known_hosts flock (REQ-063, deferred P1 from REVIEW_v0.8 A2):
- internal/security/flock.go: stdlib syscall.Flock advisory lock helper.
- internal/proxmox/bootstrap.go: TOFUHostKeyCallback capture + ResetHostKey
both acquire the flock before read-modify-write on known_hosts. Prevents
concurrent writers under v0.9 parallel SSH fan-out. 3 flock tests.
CA migration spec (grill C-07):
- .ciagent/CA_MIGRATION_SPEC_v0.9.md: Option A (preserve trust root,
RECOMMENDED) vs Option B (forced re-bootstrap). Pre-flight checks,
migration steps, rollback, post-migration invariants, spike plan.
Verification: build pass, 17/17 Go packages pass, 20/20 bats pass, gofmt
clean, go vet clean, verify-reqs 90 consistent. Coverage: paths 100%,
certpaths 100%, config 89.8%, emit covered.
---ci---
project: orca
phase: P0a1
milestone: v0.9
status: execute
---/ci---
|
2026-08-05 16:38:26 +00:00 |
|
|
Jon Chery
|
cd07e435d9
|
feat(P02): HCL config file parsing — internal/config package (REQ-054)
New internal/config package: Config struct (HCL tags), Load(paths...),
MergeOverrides(flags, env) with flag>env>file>default precedence (D-039).
No package-level state (AD-023). --config persistent flag on root command;
daemon uses cfg.ListenAddr when flag at default. 11 config tests + 2 cli tests.
---ci---
project: orca
phase: 2
milestone: v0.7
status: verify
requirements:
covered: [REQ-054]
partial: []
---/ci---
|
2026-08-04 00:09:33 +00:00 |
|