coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.
This commit is contained in:
tegwick 2026-08-13 00:58:49 +02:00
parent bbf86b8373
commit 3a7d63e18f
18 changed files with 826 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

30
Makefile
View file

@ -21,7 +21,35 @@ help: ## Show this help
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} \
/^[a-zA-Z_-]+:.*?##/ { printf " \033[36m%-24s\033[0m %s\n", $$1, $$2 }' $(MAKEFILE_LIST)
.PHONY: test test-pg pg-test-up pg-test-down failure-matrix mock-audit-smoke mock-audit-cleanup help
.PHONY: test test-pg pg-test-up pg-test-down failure-matrix mock-audit-smoke mock-audit-cleanup \
image-build image-publish deploy-dry-run help
IMAGE_REGISTRY ?= forgejo.coulomb.social/coulomb/audit-core
GIT_COMMIT := $(shell git rev-parse HEAD)
GIT_COMMIT_SHORT := $(shell git rev-parse --short HEAD)
# railiance01 k3s API is forwarded by ops-bridge tunnel k3s-api-railiance01.
KUBECONFIG_RAILIANCE ?= $(HOME)/.kube/config-hosteurope
image-build: ## Build the immutable image, labelled with the current commit
docker build -f Containerfile \
--build-arg GIT_COMMIT=$(GIT_COMMIT) \
-t $(IMAGE_REGISTRY):$(GIT_COMMIT_SHORT) \
-t $(IMAGE_REGISTRY):$(GIT_COMMIT) \
.
image-publish: image-build ## Push the commit-tagged image to Forgejo
docker push $(IMAGE_REGISTRY):$(GIT_COMMIT_SHORT)
docker push $(IMAGE_REGISTRY):$(GIT_COMMIT)
@echo "Pin the printed digest in deploy/audit-core.yaml and deploy/migrate-job.yaml"
deploy-dry-run: ## Server-side validate the railiance01 manifests
KUBECONFIG=$(KUBECONFIG_RAILIANCE) kubectl apply --dry-run=server --validate=strict \
-f deploy/audit-core.yaml \
-f deploy/networkpolicies.yaml \
-f deploy/clustersecretstore.yaml \
-f deploy/vaultdynamicsecrets.yaml \
-f deploy/externalsecrets.yaml \
-f deploy/migrate-job.yaml
PG_TEST_CONTAINER ?= ac-pg-test
PG_TEST_PORT ?= 55445