gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-15 09:01:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: record tenant CA path move

Browse Source
This commit is contained in:
joshsiv-mulga
2026-10-06 15:22:16 +10:00
parent 001aa2d42a
commit a8d218accb
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PACKAGE_BOUNDARY_MIGRATION.md
+1
View File
@@ -252,6 +252,7 @@ while the branch is in flight; they do not describe the umbrella repository's
| `06b1eefd9` | `spinifex/runtime/roles/northstar` (`BootstrapBaseZone`) | `spinifex/domains/dns` | Seeding the base zone and its NS topology is DNS control-plane work, so it joins the DNS domain and the northstar role is left with process startup and reload only. Its tests moved with it and reuse the DNS package's identical `fakeS3` helper. The daemon flakes seen during verification (`TestRestoreInstances_ClusterRecordWinsForSharedInstance` under load; `TestKVIPSecBarrier_*` and `TestDrainVolumeRecordsItsPointAfterTheWork` under `-count=3`) reproduce identically on `origin/dev`. Full preflight (excluding the pre-existing containerd advisory), focused DNS, northstar and CLI suites and tagged integration/E2E compilation passed. |
| `8ca318070` | `spinifex/admin` (`SystemAccountID`) | `spinifex/foundation/aws/identifiers` (`GlobalAccountID`) | `SystemAccountID()` duplicated the existing `GlobalAccountID` constant (`000000000000`), so its callers now use the constant and the function and its test are deleted rather than moved. `DefaultAccountID` and `DefaultAccountName` are Mulga bootstrap identity policy, not AWS identifier syntax, and stay in admin for a later IAM/account bootstrap slice. Full preflight (excluding the pre-existing containerd advisory), focused admin, account-teardown, EKS, CLI and identifier suites and tagged integration/E2E compilation passed. |
| `930040875` | `spinifex/admin` (`LoadCAKeyPair`) | `spinifex/foundation/pki` | Loading a PEM certificate and PKCS8 RSA key is a generic primitive; the new package imports no Spinifex package and holds no certificate identity or file layout. `GenerateCACert` and `GenerateSignedCert` stay in admin because they embed Spinifex certificate identity and validity policy. Full preflight (excluding the pre-existing containerd advisory), focused admin and RDS suites and tagged integration/E2E compilation passed. |
| `001aa2d42` | `spinifex/admin` (`TenantCACertPath`, `TenantCAKeyPath`) | `spinifex/domains/acm` | The tenant private CA's on-disk layout belongs to ACM, beside `LoadTenantCA` and `LoadOrCreateTenantCA`, which consume it; the daemon and the `spx admin acm` command now call the ACM domain. Full preflight (excluding the pre-existing containerd advisory), focused ACM, admin, daemon and CLI suites and tagged integration/E2E compilation passed. |
The EC2 contract row is intentionally different from the directory moves: it creates
a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS