statecraft.
Catalog/rahi

044-n3-split-composition

N=3 split composition: two StatefulSets, rahi and rauthy, one hiqlite node per pod, rahi reaching rauthy only through an encrypted internal Service and losing readiness, never liveness, without it

Lifecycle draftImplementation pendingVerification unknownQualification unknown

The owner decided on 2026-09-23 (hiqlite proposal D-14, recorded at bartekus/hiqlite@da4c910) that an N=3 cell is one namespace holding two StatefulSets, rahi and rauthy, three replicas each, one hiqlite node per pod, and that the single-container supervised composition of spec 031 stays the N=1 profile. This spec is rahi's share of that decision. It amends 031 and 032 for N=3 only: rahi starts without rauthy, reaches it only through the internal ClusterIP Service rauthy-internal.<namespace>.svc.cluster.local over Rauthy's TLS or a mesh's mTLS, fails readiness and never liveness while rauthy is unavailable, and keeps peer discovery independent of readiness. It carries the proposal's routing, NetworkPolicy, per-StatefulSet disruption and storage requirements, and backup obligations. It changes no dependency and claims no N=3 support: that follows only from recorded qualification on a named release.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "deploy/n3-split/"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-cli/tests/split.rs"
}
  • extends
    {
  "nature": "amending",
  "spec": "020-edge-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-edge/src/probes.rs"
  }
}
  • extends
    {
  "nature": "amending",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/config.rs"
  }
}
  • extends
    {
  "nature": "amending",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/discovery.rs"
  }
}
  • extends
    {
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/serve.rs"
  }
}
  • extends
    {
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/backup.rs"
  }
}
  • extends
    {
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/rauthy_api.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/rauthy_env.rs"
  }
}
  • extends
    {
  "nature": "amending",
  "spec": "032-cluster-topology",
  "unit": {
    "kind": "file",
    "path": "scripts/k8s-validate.sh"
  }
}
  • extends
    {
  "nature": "amending",
  "spec": "032-cluster-topology",
  "unit": {
    "kind": "file",
    "path": "deploy/README.md"
  }
}

Source headings

  1. 044: N=3 split composition
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. Proposed amendments to complete specs (N=3 only)
  6. Routing and trust (replaces loopback)
  7. Readiness and liveness (replaces die-together)
  8. Disruption and storage
  9. Backup (replaces the single-volume cut)
  10. 4. Functional requirements
  11. 5. Acceptance criteria
  12. 6. Out of scope
  13. 7. Resolved decisions
  14. Proposals (2026-09-23)
  15. Bootstrap blocker disposition (2026-10-02)
  16. Verification

Frozen anchors

No frozen anchors declared.