coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stand up railiance01 receiver without founder bao kv put
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Database leases come from ClusterSecretStore openbao-audit-core-database
(one extract, one lease). Senders are minted in-cluster. Secret mounts
use fsGroup 10001. Schema 0001-0004 applied after dropping the isolation
stub events table. /readyz reports custody_class=archive.
This commit is contained in:
tegwick 2026-08-13 10:27:13 +02:00
parent 3119ee33d6
commit 74575c4f32
10 changed files with 121 additions and 98 deletions
Download patch file Download diff file Expand all files Collapse all files

30
workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
View file

@ -204,12 +204,17 @@ Package side in this repo: `deploy/clustersecretstore.yaml`,
the ClusterSecretStore add-on). The OpenBao database roles themselves were
already delivered by RAPP-POSTGRES-WP-0002-T04.
Remaining before done: attended `platform-admin` OpenBao login to write the
ESO policy, mint `external-secrets/openbao-audit-core-eso-token`, and
`bao kv put` the sender registry. Then apply CSS + generators + ExternalSecrets
and verify a live lease plus a live rotation against the mounted directory.
That step is flagged `needs_human` — this session has no token that can write
policies.
Progress 2026-08-13 (lane, not token-paste): founder `bao kv put` is retired
as the T02 delivery path. Senders were minted in-cluster into Secret
`audit-core-senders`. Database leases come from ClusterSecretStore
`openbao-audit-core-database` (one extract = one lease). Both ExternalSecrets
are `SecretSynced`. ops-mason plan
`audit-core-openbao-runtime-custody` is `reviewed` and waiting on the one
founder approve to replace the interim ESO token with an AppRole. Catalog
draft: `warden route find "audit-core senders" --all`.
Remaining before T02 done: approve the Mason plan (AppRole cutover + empty
KV path), then a live rotation drill. Unseal OpenBao only if it is sealed.
## T03 - Deploy the receiver
@ -303,10 +308,15 @@ Image for commit `3a7d63e` is published and pinned:
`forgejo.coulomb.social/coulomb/audit-core@sha256:41493cd5bbd86a3309af07b1a97d41343b91d758a300ad39d71e4a18c17de7cc`
The Deployment is still not applied: it would start and then fail on a
missing sender registry and database lease. Apply migrate Job then
Deployment once T02 secrets exist, and verify restart, reschedule, and
`kubectl rollout undo`.
Applied 2026-08-13. Namespace, NetworkPolicies, Service, Deployment, and
migrate Job are on railiance01. `/readyz` reports
`custody_class=archive`. Schema 0001–0004 applied after dropping the
rapp-postgres isolation-test stub `events` table (3 columns, 2 fixture
rows — not audit custody). Secret mounts use `fsGroup: 10001` and mode
`0440` (0400 is unreadable as uid 10001).
Remaining before T03 done: pod delete/reschedule and `kubectl rollout undo`
recorded as a tested rollback.
## T04 - Migrate existing SQLite records