tegwick
b4a7a84211
ACTIVITY_CORE_WORKERS maps worker_id=ENV_NAME, where each token env must be ACTIVITY_CORE_WORKER_TOKEN[_SUFFIX]. Without the map, the legacy single pair behaves exactly as before. Duplicate identities, missing or shared tokens, a token equal to the operator token, and an unlisted legacy identity all fail worker mutations closed with 503. Operator/SSO reads keep working. Declare per-identity OpenBao paths and an ExternalSecret, not yet applied. The policy, seeding and rollout are waiting tasks T02-T04, answering secrets-engine SECRETS-WP-0009-T03 and SECRETS-WP-0011-T04. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 151606@bnt-lap001 Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
# Sync ops_run queue worker tokens from OpenBao into actcore-runtime-secret.
|
|
#
|
|
# NOT YET APPLIED (ACTIVITY-WP-0039). Apply only after T02 (railiance-platform
|
|
# adds both exact paths to the activity-core-eso role policy) and T03 (the
|
|
# founder seeds both paths). Applying earlier makes the store fail to read,
|
|
# or overwrites the hand-set ACTIVITY_CORE_WORKER_TOKEN with a missing value.
|
|
#
|
|
# Prereqs on railiance01:
|
|
# - ClusterSecretStore openbao-activity-core (railiance-platform addon; OpenBao
|
|
# Kubernetes auth via ServiceAccount activity-core/activity-core-eso since
|
|
# RPF-WP-0045)
|
|
#
|
|
# One path per worker identity (field: token), so a consumer lane can be
|
|
# granted exactly one worker's token:
|
|
# rein-aharness@railiance01 -> ACTIVITY_CORE_WORKER_TOKEN
|
|
# rein-aharness-metered@railiance01 -> ACTIVITY_CORE_WORKER_TOKEN_METERED
|
|
# The identity map is the non-secret ACTIVITY_CORE_WORKERS in
|
|
# actcore-runtime-config.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: actcore-ops-run-worker-tokens
|
|
namespace: activity-core
|
|
labels:
|
|
app.kubernetes.io/name: activity-core
|
|
app.kubernetes.io/part-of: activity-core
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-activity-core
|
|
target:
|
|
name: actcore-runtime-secret
|
|
creationPolicy: Merge
|
|
deletionPolicy: Retain
|
|
data:
|
|
- secretKey: ACTIVITY_CORE_WORKER_TOKEN
|
|
remoteRef:
|
|
key: platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01
|
|
property: token
|
|
- secretKey: ACTIVITY_CORE_WORKER_TOKEN_METERED
|
|
remoteRef:
|
|
key: platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01
|
|
property: token
|