coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind multiple queue worker identities, one token each (WP-0039-T01)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details
Build and Publish Container Image / build-and-push (push) Successful in 39s
Details

Browse source 
ACTIVITY_CORE_WORKERS maps worker_id=ENV_NAME, where each token env must be
ACTIVITY_CORE_WORKER_TOKEN[_SUFFIX]. Without the map, the legacy single pair
behaves exactly as before. Duplicate identities, missing or shared tokens, a
token equal to the operator token, and an unlisted legacy identity all fail
worker mutations closed with 503. Operator/SSO reads keep working.

Declare per-identity OpenBao paths and an ExternalSecret, not yet applied.
The policy, seeding and rollout are waiting tasks T02-T04, answering
secrets-engine SECRETS-WP-0009-T03 and SECRETS-WP-0011-T04.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-23 17:38:41 +02:00
parent 6002d5c5f6
commit b4a7a84211
6 changed files with 400 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

4
k8s/railiance/README.md
View file

@ -45,6 +45,10 @@ workers insert claimable `ops_runs` on emit. Full railiance checklist:
harness claim client. The non-secret `ACTIVITY_CORE_WORKER_ID` in the runtime
ConfigMap binds that credential to `rein-aharness@railiance01`; deploy both
settings together.
Additional worker identities use the non-secret `ACTIVITY_CORE_WORKERS` map,
with one OpenBao-held token per identity synced by
`15-externalsecret-worker-tokens.yaml`. That file is not applied yet; see
ACTIVITY-WP-0039.
| ExternalSecret | OpenBao path | Secret key |
| --- | --- | --- |