tegwick
6b46d1aaca
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 151986@bnt-lap001 Assistant-Session: ccd02b6b-80ae-48e5-8cad-9c8f74d21a67
39 lines
1.3 KiB
Markdown
39 lines
1.3 KiB
Markdown
---
|
|
id: ADHOC-2026-09-24
|
|
type: workplan
|
|
title: "Ad hoc tasks 2026-09-24"
|
|
domain: infotech
|
|
repo: audit-core
|
|
status: finished
|
|
flavor: implementation
|
|
owner: claude
|
|
topic_slug: railiance
|
|
created: "2026-09-24"
|
|
updated: "2026-09-24"
|
|
state_hub_workstream_id: "48fa851e-ef2a-5713-9ea7-9a9c213c783e"
|
|
---
|
|
|
|
# Ad hoc tasks 2026-09-24
|
|
|
|
## Align the ESO token scripts with the periodic token (RPF-WP-0046)
|
|
|
|
```task
|
|
id: ADHOC-2026-09-24-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "894b3a2e-071e-5638-8cae-a785ca172d87"
|
|
```
|
|
|
|
Inbox from railiance-platform (`1847edae`): on 2026-09-23
|
|
`external-secrets/openbao-audit-core-eso-token` was re-minted as a periodic
|
|
168h token, renewed daily by the CronJob `external-secrets/eso-token-renewer`.
|
|
`scripts/renew-runtime-lease.sh` re-minted with `-ttl=768h`, which would undo
|
|
that, and defaulted `BAO_ADDR` to the retired `https://bao.coulomb.social`.
|
|
|
|
Done: `renew-runtime-lease.sh` is now marked recovery-only, mints with
|
|
`-period` (default 168h, `OPENBAO_AUDIT_CORE_ESO_PERIOD`), and defaults
|
|
`BAO_ADDR` to the tunnel `http://127.0.0.1:18200`. The first-mint script
|
|
`scripts/openbao-eso-token-apply.sh` is retired (deleted): it carried the same
|
|
768h TTL and retired address, and the agent environment orientation §6 says not
|
|
to re-run the old `*-eso-token-apply` scripts. Nothing was run against the
|
|
cluster or OpenBao.
|