coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind multiple queue worker identities, one token each (WP-0039-T01)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
Build and Publish Container Image / build-and-push (push) Successful in 39s
Details

Browse source 
ACTIVITY_CORE_WORKERS maps worker_id=ENV_NAME, where each token env must be
ACTIVITY_CORE_WORKER_TOKEN[_SUFFIX]. Without the map, the legacy single pair
behaves exactly as before. Duplicate identities, missing or shared tokens, a
token equal to the operator token, and an unlisted legacy identity all fail
worker mutations closed with 503. Operator/SSO reads keep working.

Declare per-identity OpenBao paths and an ExternalSecret, not yet applied.
The policy, seeding and rollout are waiting tasks T02-T04, answering
secrets-engine SECRETS-WP-0009-T03 and SECRETS-WP-0011-T04.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-23 17:38:41 +02:00
parent 6002d5c5f6
commit b4a7a84211
6 changed files with 400 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/deploy-ops-run-queue-railiance.md
View file

@ -91,16 +91,21 @@ explicit is better for ops):
| `OPS_RUN_MAX_ATTEMPTS` | `3` | Optional |
| `OPS_RUN_SLA_HOURS` | `1` | Status stuck threshold |
| `ACTIVITY_CORE_WORKER_ID` | `rein-aharness@railiance01` | Exact non-secret identity bound to the worker token |
| `ACTIVITY_CORE_WORKERS` | `rein-aharness@railiance01=ACTIVITY_CORE_WORKER_TOKEN,rein-aharness-metered@railiance01=ACTIVITY_CORE_WORKER_TOKEN_METERED` | Optional token-to-identity map (ACTIVITY-WP-0039); when set it is authoritative |
Worker auth (required before external claim):
```bash
# Generate once; store in secret — do not commit
WORKER_TOKEN="$(openssl rand -hex 24)"
kubectl -n activity-core patch secret actcore-runtime-secret --type merge \
-p "{\"stringData\":{\"ACTIVITY_CORE_WORKER_TOKEN\":\"${WORKER_TOKEN}\"}}"
# Record token in operator secret store (OpenBao / password manager), not chat.
```
Worker tokens are held in OpenBao, one path per identity, field `token`:
`platform/workloads/activity-core/ops-run-workers/<identity-slug>`. The
ExternalSecret `k8s/railiance/15-externalsecret-worker-tokens.yaml` merges them
into `actcore-runtime-secret`. Do not generate a token by hand or patch it into
the Secret. Minting is founder-attended OpenBao work (ACTIVITY-WP-0039-T03).
Until that rollout, production still carries the earlier hand-set
`ACTIVITY_CORE_WORKER_TOKEN`.
Each token binds exactly one identity. Shared tokens, a token equal to the
operator token, and identities missing from `ACTIVITY_CORE_WORKERS` fail closed
with 503.
Apply the ConfigMap identity and Secret token in the same rollout. If the token
is present without `ACTIVITY_CORE_WORKER_ID`, worker mutations fail with 503;