coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add ExternalSecret for ISSUE_CORE_API_KEY on Railiance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details
Build and Publish Container Image / build-and-push (push) Successful in 13s
Details

Browse source 
Sync the shared issue-core ingestion key from OpenBao into
actcore-runtime-secret via External Secrets, with an interim coulombcore
ClusterSecretStore bootstrap script and deploy docs. Removes manual key
injection from bootstrap-secrets.sh.
This commit is contained in:
tegwick 2026-07-08 00:04:38 +02:00
parent 7dab19b0d7
commit 9a7ae8b59a
7 changed files with 128 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

22
k8s/railiance/README.md
View file

@ -10,6 +10,8 @@ name and access policy.
- `00-namespace.yaml`: namespace and shared labels
- `10-infrastructure.yaml`: PostgreSQL for app data, PostgreSQL for Temporal,
NATS JetStream, Temporal, and Temporal UI
- `15-externalsecret-issue-core.yaml`: OpenBao → `ISSUE_CORE_API_KEY` merge into
`actcore-runtime-secret` via External Secrets
- `20-runtime.yaml`: migrate/sync jobs plus API, worker, and event-router
- `bootstrap-secrets.sh`: idempotently creates generated Kubernetes secrets
@ -24,12 +26,15 @@ the ConfigMap projection from that file before enabling the probe schedule.
`OPS_HUB_KEY` is created only as an empty Secret placeholder until the operator
provisions the Inter-Hub ops-hub key.
`ISSUE_SINK_TYPE` is `rest` in `actcore-runtime-config`. Populate
`ISSUE_CORE_API_KEY` in `actcore-runtime-secret` with the same value as the
issue-core runtime secret (`issue-core/issue-core-runtime` via OpenBao lane
`issue-core-ingestion-api-key`) before trusting live task emission. Roll back
to audit mode by setting `ISSUE_SINK_TYPE=null` and restarting worker and
event-router deployments. See `docs/issue-core-emission-boundary.md`.
`ISSUE_SINK_TYPE` is `rest` in `actcore-runtime-config`. `ISSUE_CORE_API_KEY`
is synced from OpenBao into `actcore-runtime-secret` by ExternalSecret
`actcore-issue-core-runtime` (same path as issue-core:
`platform/workloads/issue-core/issue-core/issue-core-runtime`). Prereqs:
`ClusterSecretStore/openbao-activity-core` and ESO token bootstrap
(`OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh`).
Roll back to audit mode by setting
`ISSUE_SINK_TYPE=null` and restarting worker and event-router deployments.
See `docs/issue-core-emission-boundary.md`.
The same runtime projection now includes the active
`daily-statehub-wsjf-triage.md` ActivityDefinition plus its JSON output schema
@ -61,6 +66,11 @@ ssh railiance01
cd ~/activity-core
bash k8s/railiance/bootstrap-secrets.sh
kubectl apply -f k8s/railiance/10-infrastructure.yaml
# Bootstrap OpenBao ESO token + apply ExternalSecret (once per cluster):
OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh
kubectl apply -f ~/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml
kubectl apply -f k8s/railiance/15-externalsecret-issue-core.yaml
kubectl -n activity-core wait --for=condition=Ready externalsecret/actcore-issue-core-runtime --timeout=120s
kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-app-db --timeout=180s
kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-temporal-db --timeout=180s
kubectl -n activity-core wait --for=condition=ready pod -l app.kubernetes.io/name=actcore-nats --timeout=180s