coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire static OpenBao ESO token bootstrap (RPF-WP-0045-T06)

Browse source 
The openbao-activity-core store has used OpenBao Kubernetes auth since
2026-09-21 and synced cleanly for more than 24 hours. Remove the
openbao-eso-token-apply script and Makefile target, point the manifest
comments and runbooks at the Kubernetes-auth store, and guard against
reintroducing the script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-23 17:47:11 +02:00
parent 94b5c45f22
commit b690ce03fa
8 changed files with 26 additions and 114 deletions
Download patch file Download diff file Expand all files Collapse all files

7
k8s/railiance/15-externalsecret-backup-offsite.yaml
View file

@ -1,9 +1,10 @@
# Sync Option A offsite backup credentials into actcore-runtime-secret.
#
# Prereqs on railiance01:
# - ClusterSecretStore openbao-activity-core
# - ESO token includes policy workload-kv-read-railiance-backup-offsite-lane
# (scripts/openbao-eso-token-apply.sh defaults updated in RAILIANCE-WP-0016)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
# Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
# RPF-WP-0045, 2026-09-21 — no static ESO token)
# - Store role policy includes workload-kv-read-railiance-backup-offsite-lane
#
# OpenBao path: platform/workloads/railiance/backup/offsite-lane
# Fields synced (never AGE_PRIVATE_KEY):

9
k8s/railiance/15-externalsecret-forgejo-admin.yaml
View file

@ -2,11 +2,10 @@
#
# Prereqs on railiance01:
# - External Secrets Operator (namespace external-secrets)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon)
# - Secret external-secrets/openbao-activity-core-eso-token with policies:
# workload-kv-read-issue-core-runtime
# workload-kv-read-forgejo-admin
# (scripts/openbao-eso-token-apply.sh)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
# Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
# RPF-WP-0045, 2026-09-21 — no static ESO token)
# - Store role policy includes workload-kv-read-forgejo-admin
#
# OpenBao path: platform/workloads/forgejo/forgejo-admin
# property: API_TOKEN → secret key FORGEJO_TOKEN

5
k8s/railiance/15-externalsecret-issue-core.yaml
View file

@ -2,8 +2,9 @@
#
# Prereqs on railiance01:
# - External Secrets Operator (namespace external-secrets)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon)
# - Secret external-secrets/openbao-activity-core-eso-token (scripts/openbao-eso-token-apply.sh)
# - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
# Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
# RPF-WP-0045, 2026-09-21 — no static ESO token)
#
# OpenBao path: platform/workloads/issue-core/issue-core/issue-core-runtime
# property: ISSUE_CORE_API_KEY (shared with issue-core ingestion)

12
k8s/railiance/README.md
View file

@ -57,9 +57,12 @@ ACTIVITY-WP-0039.
| `actcore-backup-offsite` | `platform/workloads/railiance/backup/offsite-lane` | `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL` |
| `llm-connect-provider-secrets` | `platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets` | `OPENROUTER_API_KEY` |
Prereqs: `ClusterSecretStore/openbao-activity-core` and ESO token bootstrap with
the four exact-path read policies (`OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token
./scripts/openbao-eso-token-apply.sh`). The llm-connect `ExternalSecret` remains
Prereqs: `ClusterSecretStore/openbao-activity-core`, owned by railiance-platform.
Since RPF-WP-0045 (2026-09-21) it uses OpenBao Kubernetes auth through the
`activity-core/activity-core-eso` ServiceAccount, with a 15-minute token and a
role policy limited to exact paths. The static-token bootstrap
(`scripts/openbao-eso-token-apply.sh`) is retired; do not recreate a static
`openbao-activity-core-eso-token`. The llm-connect `ExternalSecret` remains
owned by the llm-connect deployment package rather than activity-core.
Roll back to audit mode by setting `ISSUE_SINK_TYPE=null` and restarting worker
and event-router deployments. See `docs/issue-core-emission-boundary.md`.
@ -97,8 +100,7 @@ ssh railiance01
cd ~/activity-core
bash k8s/railiance/bootstrap-secrets.sh
kubectl apply -f k8s/railiance/10-infrastructure.yaml
# Bootstrap OpenBao ESO token + apply ExternalSecrets (once per cluster):
OPENBAO_TOKEN_FILE=~/.local/openbao/platform-admin.token ./scripts/openbao-eso-token-apply.sh
# Apply the store (railiance-platform addon, Kubernetes auth) + ExternalSecrets:
kubectl apply -f ~/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-activity-core.clustersecretstore.yaml
kubectl apply -f k8s/railiance/15-externalsecret-issue-core.yaml
kubectl apply -f k8s/railiance/15-externalsecret-forgejo-admin.yaml