coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adopt the agent environment orientation for KeyCape's live objects.

Browse source 
Write Secrets with kubectl replace in the rotation script, since apply copies
the data into the last-applied annotation. Record in operations.md the
live-change rules that apply here and the open finding: four live Secrets
carry that annotation, and removing it waits for the founder's go-ahead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
This commit is contained in:
tegwick 2026-09-23 22:07:23 +02:00
parent 012e695947
commit 51e541c9a1
3 changed files with 50 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tools/rotate-live-exposed-secret.sh
View file

@ -283,8 +283,12 @@ sys.stdout.write(updated)
kubectl create configmap authelia-config -n sso --from-file=configuration.yml="$work_dir/authelia-configuration.updated.yml" --dry-run=client -o yaml |
kubectl apply -f - >/dev/null
# replace, not apply: apply copies the full Secret data into the
# last-applied-configuration annotation, where any metadata read prints it.
# replace writes only the manifest, which also drops an annotation left by an
# earlier apply.
kubectl create secret generic keycape-config -n sso --from-file=config.yaml="$work_dir/config.yaml" --from-file=key.pem="$work_dir/key.pem" --dry-run=client -o yaml |
kubectl apply -f - >/dev/null
kubectl replace -f - >/dev/null
kubectl rollout restart deployment/authelia deployment/keycape -n sso >/dev/null
kubectl rollout status deployment/authelia -n sso --timeout=180s