tegwick
21e8ce9b72
renew-runtime-lease.sh is recovery-only now: it mints with -period instead of -ttl=768h, so a recovery no longer undoes the platform's periodic token, and defaults BAO_ADDR to the tunnel rather than the retired bao.coulomb.social. The old openbao-eso-token-apply.sh is retired for the same two reasons. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 151986@bnt-lap001 Assistant-Session: ccd02b6b-80ae-48e5-8cad-9c8f74d21a67
37 lines
1.2 KiB
Markdown
37 lines
1.2 KiB
Markdown
---
|
|
id: ADHOC-2026-09-24
|
|
type: workplan
|
|
title: "Ad hoc tasks 2026-09-24"
|
|
domain: infotech
|
|
repo: audit-core
|
|
status: finished
|
|
flavor: implementation
|
|
owner: claude
|
|
topic_slug: railiance
|
|
created: "2026-09-24"
|
|
updated: "2026-09-24"
|
|
---
|
|
|
|
# Ad hoc tasks 2026-09-24
|
|
|
|
## Align the ESO token scripts with the periodic token (RPF-WP-0046)
|
|
|
|
```task
|
|
id: ADHOC-2026-09-24-T01
|
|
status: done
|
|
priority: medium
|
|
```
|
|
|
|
Inbox from railiance-platform (`1847edae`): on 2026-09-23
|
|
`external-secrets/openbao-audit-core-eso-token` was re-minted as a periodic
|
|
168h token, renewed daily by the CronJob `external-secrets/eso-token-renewer`.
|
|
`scripts/renew-runtime-lease.sh` re-minted with `-ttl=768h`, which would undo
|
|
that, and defaulted `BAO_ADDR` to the retired `https://bao.coulomb.social`.
|
|
|
|
Done: `renew-runtime-lease.sh` is now marked recovery-only, mints with
|
|
`-period` (default 168h, `OPENBAO_AUDIT_CORE_ESO_PERIOD`), and defaults
|
|
`BAO_ADDR` to the tunnel `http://127.0.0.1:18200`. The first-mint script
|
|
`scripts/openbao-eso-token-apply.sh` is retired (deleted): it carried the same
|
|
768h TTL and retired address, and the agent environment orientation §6 says not
|
|
to re-run the old `*-eso-token-apply` scripts. Nothing was run against the
|
|
cluster or OpenBao.
|