coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden ops run identity and leases
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
This commit is contained in:
tegwick 2026-08-23 13:01:46 +02:00
parent 36161d346f
commit f0a897e088
13 changed files with 522 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

4
k8s/railiance/20-runtime.yaml
View file

@ -24,7 +24,9 @@ data:
OPS_RUN_LEASE_SECONDS: "900"
OPS_RUN_MAX_ATTEMPTS: "3"
OPS_RUN_SLA_HOURS: "1"
# ACTIVITY_CORE_WORKER_TOKEN lives in actcore-runtime-secret (optional until REIN-A-0002)
# Non-secret identity bound to ACTIVITY_CORE_WORKER_TOKEN at the API boundary.
ACTIVITY_CORE_WORKER_ID: rein-aharness@railiance01
# ACTIVITY_CORE_WORKER_TOKEN lives in actcore-runtime-secret.
ACTIVITY_DEFINITION_DIRS: /etc/activity-core/external-definitions
CUSTODIAN_REPO_ROOT: /var/custodian
ACTIVITY_CORE_ROOT: /etc/activity-core

6
k8s/railiance/README.md
View file

@ -41,8 +41,10 @@ host-network bridge and workstation tunnel are not part of this deployment.
`OPS_RUN_QUEUE_ENABLED=true`. After image + migrate job (alembic **0007**),
workers insert claimable `ops_runs` on emit. Full railiance checklist:
`docs/deploy-ops-run-queue-railiance.md`. Keep host timers until REIN-A-0002.
Optional `ACTIVITY_CORE_WORKER_TOKEN` in `actcore-runtime-secret` for harness
claim auth.
`ACTIVITY_CORE_WORKER_TOKEN` in `actcore-runtime-secret` authenticates the
harness claim client. The non-secret `ACTIVITY_CORE_WORKER_ID` in the runtime
ConfigMap binds that credential to `rein-aharness@railiance01`; deploy both
settings together.
| ExternalSecret | OpenBao path | Secret key |
| --- | --- | --- |

4
k8s/railiance/bootstrap-secrets.sh
View file

@ -43,6 +43,6 @@ fi
# actcore-issue-core-runtime (k8s/railiance/15-externalsecret-issue-core.yaml).
# Apply that manifest after ClusterSecretStore openbao-activity-core is Ready.
#
# Optional (ACTIVITY-WP-0026 / REIN-A-0002): patch ACTIVITY_CORE_WORKER_TOKEN and
# ACTIVITY_CORE_OPERATOR_TOKEN into actcore-runtime-secret — see
# Patch ACTIVITY_CORE_WORKER_TOKEN and ACTIVITY_CORE_OPERATOR_TOKEN into
# actcore-runtime-secret before enabling their API paths — see
# docs/deploy-ops-run-queue-railiance.md. Not auto-generated here.