coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stand up railiance01 receiver without founder bao kv put
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Database leases come from ClusterSecretStore openbao-audit-core-database
(one extract, one lease). Senders are minted in-cluster. Secret mounts
use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation
stub events table. /readyz reports custody_class=archive.
This commit is contained in:
tegwick 2026-08-13 10:27:13 +02:00
parent 3119ee33d6
commit 74575c4f32
10 changed files with 121 additions and 98 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/openbao-eso-token-apply.sh
View file

@ -12,7 +12,10 @@ DEFAULT_POLICIES="external-secrets-audit-core"
POLICIES="${OPENBAO_AUDIT_CORE_POLICIES:-$DEFAULT_POLICIES}"
POLICY_DIR="${OPENBAO_POLICY_DIR:-$HOME/railiance-platform/openbao/policies}"
BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
# ~/.kube/config-hosteurope currently targets 16443 (coulombcore). railiance01
# is the k3s-api-railiance01 tunnel on 16444. Always pass this explicitly
# unless you have a dedicated railiance01 kubeconfig.
RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-}"
SECRET_NAME="${OPENBAO_AUDIT_CORE_ESO_SECRET:-openbao-audit-core-eso-token}"
SECRET_NS="${OPENBAO_AUDIT_CORE_ESO_NAMESPACE:-external-secrets}"
TTL="${OPENBAO_AUDIT_CORE_ESO_TTL:-768h}"
@ -26,9 +29,16 @@ if ! command -v kubectl >/dev/null 2>&1; then
exit 1
fi
if [[ -z "$RAILIANCE01_KUBECONFIG" ]]; then
echo "ERROR: set RAILIANCE01_KUBECONFIG to a kubeconfig whose server is https://127.0.0.1:16444 (railiance01)." >&2
echo "Do not use ~/.kube/config or ~/.kube/config-hosteurope — those currently hit 16443 (coulombcore)." >&2
exit 1
fi
echo "OpenBao addr: $BAO_ADDR"
echo "Policies: $POLICIES"
echo "K8s secret: $SECRET_NS/$SECRET_NAME (railiance01)"
echo "Kubeconfig: $RAILIANCE01_KUBECONFIG"
if [[ -n "${BAO_TOKEN:-}" ]]; then
:
@ -72,6 +82,17 @@ fi
echo "minted child token length=${#child_token} (value not printed)"
export KUBECONFIG="$RAILIANCE01_KUBECONFIG"
# Fail closed if this kubeconfig is not railiance01. coulombcore has
# core-hub-staging and no audit-core namespace.
if ! kubectl get ns audit-core >/dev/null 2>&1; then
echo "ERROR: kubeconfig does not see namespace audit-core; refusing to write the ESO token." >&2
echo "Expected railiance01 via https://127.0.0.1:16444 (ops-bridge tunnel k3s-api-railiance01)." >&2
exit 1
fi
if kubectl get ns core-hub-staging >/dev/null 2>&1; then
echo "ERROR: kubeconfig looks like coulombcore (namespace core-hub-staging present)." >&2
exit 1
fi
kubectl -n "$SECRET_NS" create secret generic "$SECRET_NAME" \
--from-literal=token="$child_token" \
--dry-run=client -o yaml | kubectl apply -f -