coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add attended runtime-lease remint helper for the expired ESO token
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
The 768h orphan token in external-secrets/openbao-audit-core-eso-token
expired at 2026-09-14T10:23Z and ClusterSecretStore lookup-self is 403,
so ESO cannot mint database/creds/audit-core-runtime. Recreate the
Kubernetes Secret without last-applied-configuration so the token is
not stored in annotation metadata.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
This commit is contained in:
tegwick 2026-09-14 23:54:35 +02:00
parent cf8c740b1b
commit ca6a608b16
2 changed files with 28 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/openbao-eso-token-apply.sh
View file

@ -93,10 +93,12 @@ if kubectl get ns core-hub-staging >/dev/null 2>&1; then
echo "ERROR: kubeconfig looks like coulombcore (namespace core-hub-staging present)." >&2 echo "ERROR: kubeconfig looks like coulombcore (namespace core-hub-staging present)." >&2
exit 1 exit 1
fi fi
# Recreate rather than kubectl-apply: apply writes the token into
# last-applied-configuration, which is readable as Secret metadata.
kubectl -n "$SECRET_NS" delete secret "$SECRET_NAME" --ignore-not-found
kubectl -n "$SECRET_NS" create secret generic "$SECRET_NAME" \ kubectl -n "$SECRET_NS" create secret generic "$SECRET_NAME" \
--from-literal=token="$child_token" \ --from-literal=token="$child_token"
--dry-run=client -o yaml | kubectl apply -f -
unset child_token BAO_TOKEN unset child_token BAO_TOKEN
echo "Secret $SECRET_NS/$SECRET_NAME applied on railiance01." echo "Secret $SECRET_NS/$SECRET_NAME applied on railiance01."
echo "Next: apply ClusterSecretStore openbao-audit-core, then deploy/." echo "Next: force-sync ExternalSecret audit-core-database; do not bounce the pod."

23
scripts/renew-runtime-lease.sh Executable file
View file

@ -0,0 +1,23 @@
#!/usr/bin/env bash
# Attended remint of the ESO orphan token, then force-sync the runtime lease.
# Never prints secret values. Run inside:
# warden access openbao-platform-admin-login --exec -- \
# env RAILIANCE01_KUBECONFIG="$HOME/.kube/config-railiance01" \
# "$PWD/scripts/renew-runtime-lease.sh"
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
export KUBECONFIG="$RAILIANCE01_KUBECONFIG"
export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
"$ROOT/scripts/openbao-eso-token-apply.sh"
# One read of database/creds/audit-core-runtime = one new lease. Annotate
# only the runtime ExternalSecret; migrate/senders follow on their own
# refresh once the store is Ready.
kubectl -n audit-core annotate externalsecret audit-core-database \
force-sync="$(date -u +%s)" --overwrite
echo "ESO token reminted and audit-core-database force-sync requested."
echo "Wait for ExternalSecret Ready=True; do not restart the receiver."