tracebloc · saqlainsyed007 · Jul 29, 2026 · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026
diff --git a/README.md b/README.md
@@ -50,7 +50,7 @@ For the threat model, defense layers, per-platform caveats, operator responsibil
 
 ## Deploy
 
-This repo ships the **tracebloc** unified Helm chart (currently `v1.3.5`) — one chart for AKS, EKS, bare-metal, and OpenShift.
+This repo ships the **tracebloc** unified Helm chart — one chart for AKS, EKS, bare-metal, and OpenShift. See [`client/Chart.yaml`](client/Chart.yaml) or the [releases page](https://github.com/tracebloc/client/releases) for the current chart version.
 
 ### Quick install
 

@@ -235,6 +235,12 @@
               "type": "string",
               "description": "Host the `helm test` enforcement check curls directly (when allowExternalHttps=false) to verify the CNI blocks egress; non-enforcement fails the test (a test hook never affects install/upgrade) — client-runtime#104. Empty string disables it (e.g. air-gapped clusters)."
             },
+            "enforcementProbeTimeoutSeconds": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 60,
+              "description": "Max seconds the egress-enforcement `helm test` waits for egress to become blocked before failing. Covers standard-mode CNI reconciliation (e.g. AWS VPC CNI NETWORK_POLICY_ENFORCING_MODE=standard). 60s suits AWS VPC CNI / Calico / Cilium; raise on slow nodes."
+            },
             "dnsNamespace": {
               "type": "string",
               "default": "kube-system",
@@ -270,6 +276,62 @@
         }
       }
     },
+    "egressReachabilityCheck": {
+      "type": "object",
+      "description": "Backend-reachability seal check (helm test hook). Set enabled=false only on truly air-gapped clusters with no route to the backend.",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": true,
+          "description": "Render the backend-reachability helm test hook Job. A test hook never affects install/upgrade."
+        }
+      }
+    },
+    "ingestionAuthz": {
+      "type": "object",
+      "description": "Authorization policy for POST /internal/submit-ingestion-run on jobs-manager (client-runtime#21). Rendered into the ingestion-authz ConfigMap.",
+      "properties": {
+        "serviceAccountName": {
+          "type": "string",
+          "minLength": 1,
+          "default": "ingestor",
+          "description": "Name of the shared ServiceAccount this chart creates for ingestor subchart releases (client#129). Single source of truth for the SA template and the default `allowed` entry."
+        },
+        "allowed": {
+          "type": "array",
+          "description": "Maps (namespace, service_account) to permitted table-name prefixes. Empty renders `allowed: []` (deny-all, fail-safe).",
+          "items": {
+            "type": "object",
+            "properties": {
+              "service_account": {
+                "type": "string",
+                "description": "SA name. Omit to fall back to ingestionAuthz.serviceAccountName."
+              },
+              "namespace": {
+                "type": "string",
+                "description": "SA namespace. Omit to fall back to the release namespace."
+              },
+              "table_prefixes": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Table-name prefixes this SA may ingest into. [\"*\"] = any table."
+              }
+            }
+          }
+        }
+      }
+    },
+    "podTokenSigningSecret": {
+      "type": "string",
+      "default": "",
+      "description": "HMAC secret for signing pod-proxy tokens. Empty (default) auto-generates a stable secret on first install and reuses it via lookup on upgrade. Set explicitly only to pin or rotate (rotating invalidates all live tokens)."
+    },
+    "podTokenTtlSeconds": {
+      "type": "integer",
+      "minimum": 1,
+      "default": 604800,
+      "description": "Backstop lifetime (seconds) for a signed pod-proxy token. Set to comfortably exceed the longest expected training-job duration or long-running jobs 401 mid-run. Default 7 days."
+    },
     "sealCheck": {
       "type": "object",
       "description": "Seal check — the chart's conformance suite (RFC-0003 §8.2 / backend#1184). Every check is a `helm test` hook Job labelled tracebloc.io/seal-check=true + tracebloc.io/seal-check-name=<check> (the enumeration contract the tracebloc CLI consumes, cli#393). See docs/SEAL-CHECK.md.",

diff --git a/docs/eks.md b/docs/eks.md
diff --git a/ingestor/README.md b/ingestor/README.md
@@ -147,7 +147,7 @@ The dominant install path leaves `image.digest` empty and lets jobs-manager spaw
 |---|---|
 | Reproducing an older ingestion run for audit / debugging | `--set image.digest=sha256:<old-digest>` |
 | Testing a new ingestor release before cluster-wide rollout | `--set image.digest=sha256:<new-digest>` |
-| Air-gapped mirror with frozen versions | Use both `--set image.repository=...` and `--set image.digest=sha256:...` |
+| Air-gapped mirror with frozen versions | Point the parent `tracebloc/client` chart's `images.ingestor.repository` at your mirror (that is what jobs-manager spawns from) and pin `--set image.digest=sha256:...` |
 
 When set, the digest must be the full canonical form (`sha256:` + 64 lowercase hex chars). Tags like `v0.3.0` are rejected by jobs-manager. See the [data-ingestors releases page](https://github.com/tracebloc/data-ingestors/releases) for current digests.
 
@@ -157,7 +157,6 @@ When set, the digest must be the full canonical form (`sha256:` + 64 lowercase h
 |---|---|---|
 | `jobsManager.endpoint` | `http://jobs-manager.<release-namespace>.svc.cluster.local:8080` (auto-resolved) | The ingestor release and the parent `tracebloc/client` release live in different namespaces, or you're testing against a port-forward. |
 | `serviceAccount.name` | `ingestor` | The cluster's `ingestionAuthz` policy expects a different SA name. (Default matches the parent chart's default.) |
-| `image.repository` | `ghcr.io/tracebloc/ingestor` | Air-gapped mirror. |
 | `idempotencyKey` | `<release>-<unix-epoch>` (regenerated every install) | You want strict at-most-once semantics across reinstalls of the same release name — pass a stable UUID so jobs-manager replays the original run instead of starting a new one. |
 | `hookTimeoutSeconds` | `30` | Slow networks or large schemas. |
 

diff --git a/ingestor/values.yaml b/ingestor/values.yaml
@@ -31,10 +31,12 @@ ingestConfig: ""
 # rollout. jobs-manager then runs that exact digest (IfNotPresent). Must
 # be the full canonical sha256 digest; tags are rejected.
 image:
-  # Repository defaults to the GHCR-published image. Customers running an
-  # air-gapped mirror override this (and the parent client chart's
-  # images.ingestor.repository — that is what jobs-manager spawns from).
-  repository: ghcr.io/tracebloc/ingestor
+  # Air-gapped mirror override lives in the PARENT client chart's
+  # images.ingestor.repository — that is what jobs-manager actually spawns
+  # from. This subchart previously carried its own `repository` key, but no
+  # template ever rendered it; it was removed (tracebloc/backend#963) so it
+  # can't be mistaken for a second, non-authoritative override.
+  #
   # Optional per-request pin. Empty (default) = jobs-manager spawns the
   # current published image by floating tag. When set must be
   # sha256:<64 lowercase hex>.

@@ -238,54 +238,6 @@ _client_workload_deployments() {
   printf '%s\n' "mysql-client" "${ns}-jobs-manager" "${ns}-requests-proxy"
 }
 
-# ── macOS: Docker Desktop architecture vs machine (for wrong-arch UX) ────────
-#  Call early on macOS to fail fast with clear instructions if Docker.app
-#  is for the wrong architecture (e.g. Intel Docker on Apple Silicon).
-#  Returns 0 if OK or not applicable; returns 1 and prints message if mismatch.
-check_docker_arch_mac() {
-  [[ "$(uname -s)" != "Darwin" ]] && return 0
-  [[ ! -d "/Applications/Docker.app" ]] && return 0
-
-  local real_arch
-  if sysctl -n hw.optional.arm64 2>/dev/null | grep -q '1'; then
-    real_arch="arm64"
-  else
-    real_arch="amd64"
-  fi
-
-  # Main executable is com.docker.backend (CFBundleExecutable), not "Docker"
-  local docker_bin_path="/Applications/Docker.app/Contents/MacOS/com.docker.backend"
-  [[ ! -x "$docker_bin_path" ]] && docker_bin_path="/Applications/Docker.app/Contents/MacOS/Docker"
-  local docker_bin_arch
-  docker_bin_arch="$(file "$docker_bin_path" 2>/dev/null || true)"
-  local docker_is_arm=false
-  local docker_is_intel=false
-  echo "$docker_bin_arch" | grep -q 'arm64' && docker_is_arm=true
-  echo "$docker_bin_arch" | grep -q 'x86_64' && docker_is_intel=true
-
-  if [[ "$real_arch" == "arm64" ]] && [[ "$docker_is_intel" == true ]] && [[ "$docker_is_arm" != true ]]; then
-    echo ""
-    warn "Docker is installed for the wrong chip (Intel instead of Apple Silicon)."
-    hint "This can cause slow performance or prevent Docker from starting."
-    echo ""
-    echo -e "  ${BOLD}Fix:${RESET} Re-run the installer — it will replace Docker with the correct version."
-    echo ""
-    return 1
-  fi
-
-  if [[ "$real_arch" == "amd64" ]] && [[ "$docker_is_arm" == true ]]; then
-    echo ""
-    warn "Docker is installed for the wrong chip (Apple Silicon instead of Intel)."
-    hint "Docker may not work correctly."
-    echo ""
-    echo -e "  ${BOLD}Fix:${RESET} Re-run the installer — it will replace Docker with the correct version."
-    echo ""
-    return 1
-  fi
-
-  return 0
-}
-
 # ── Spinner — hides noisy command output behind an animated status line ──────
 #  Usage:  spin <pid> "Installing foo…" [deadline_seconds]
 #  The background process's stdout/stderr should already be redirected to a file

@@ -1,5 +1,5 @@
 c29c4fafe6691bfbfb6f90d761aa0650d79d0a5962a599926284d9e3e6a10006  scripts/install-k8s.sh
-c64c2bcf00cbaffc00ae54a9149436a375ee5052e3e882fd689bc19a7b4a1620  scripts/lib/common.sh
+003b913cf0eaa134dba8fc4317ded80bfb0fe5491895c45d525e46514e7913d6  scripts/lib/common.sh
 5ecbc741b61bfdbbdae14123d12328d786aa1a7d4e16bc3c31ce256eb4a01933  scripts/lib/preflight.sh
 19be2771df0e1a41b4fa9678e1cf6a77492304f66f73cf705a2ae42b1dac2ba3  scripts/lib/detect-gpu.sh
 7977ef12a16fc6aee1c2824cae13bd1450f7fe1c1345323292e4a14decbfe83f  scripts/lib/gpu-nvidia.sh

diff --git a/scripts/tests/common.bats b/scripts/tests/common.bats
@@ -253,12 +253,6 @@ setup() {
 @test "has: present command" { run has bash; [ "$status" -eq 0 ]; }
 @test "has: absent command" { run has nope-not-a-real-cmd-xyz; [ "$status" -ne 0 ]; }
 
-# ── check_docker_arch_mac (no-op off macOS) ────────────────────────────────
-@test "check_docker_arch_mac: no-op on non-macOS" {
-  run check_docker_arch_mac
-  [ "$status" -eq 0 ]
-}
-
 # ── count_bar (first-run: honest N-of-M for multi-image pulls) ───────────────
 @test "count_bar: renders 'N of M <noun>'" {
   run count_bar 3 6 services