tegwick
3a7d63e18f
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the migration lease. Image base is digest-pinned. Namespace and NetworkPolicies are on the cluster; Deployment waits for the attended OpenBao ESO token.
19 lines
631 B
Markdown
19 lines
631 B
Markdown
# railiance01 package
|
|
|
|
Target: railiance01 only. The workstation kubeconfig that talks to that API
|
|
is the `k3s-api-railiance01` tunnel (local port **16444**).
|
|
`~/.kube/config-hosteurope` currently points at 16443 (coulombcore); rewrite
|
|
the server port or export a copy before applying.
|
|
|
|
Apply order is documented in `docs/operator-runbook.md`. Do not apply the
|
|
Deployment until:
|
|
|
|
1. The image digest is pinned (not `REPLACE_AT_RELEASE`).
|
|
2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
|
|
`audit-core-senders` exist.
|
|
3. Job `audit-core-migrate` has completed.
|
|
|
|
```bash
|
|
make image-build
|
|
make deploy-dry-run
|
|
```
|