tegwick
e5b72a6b30
All 31 live probes pass on the stored policy (sha256 969d7aae). The repo file
is trimmed to the stored bytes. platform/suppliers/scaleway/{bootstrap,backup,
mas-tem-relay} created at v1 with placeholders, values never read.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
65 lines
2.7 KiB
Bash
Executable file
65 lines
2.7 KiB
Bash
Executable file
#!/bin/sh
|
|
# Create the Scaleway supplier-account KV entries with placeholder values
|
|
# (supplier convention platform/suppliers/<supplier>/<account>, founder
|
|
# decision 2026-10-08). The founder then replaces each `xxx` in the OpenBao UI.
|
|
#
|
|
# Runs under the ops-mason-construct grant (BAO_TOKEN from ~/.claude-bao-token),
|
|
# or silently by the founder:
|
|
# warden access openbao-platform-admin-login --exec -- \
|
|
# sh /home/worsch/ops-mason/scripts/put-scaleway-supplier-placeholders.sh
|
|
# Run 2026-10-18 under claude-MASON-WP-0015-T03: all three created at v1.
|
|
#
|
|
# -cas=0 refuses to write a path that already exists, so a real value is never
|
|
# overwritten; a rerun fails harmlessly. No secret values pass through this script.
|
|
# The receipt holds path, version and result only.
|
|
set -u
|
|
umask 077
|
|
receipt_dir=/home/worsch/.local/state/railiance/receipts
|
|
mkdir -p "$receipt_dir"
|
|
receipt="$receipt_dir/scaleway-supplier-placeholders.txt"
|
|
: >"$receipt"
|
|
|
|
put() {
|
|
path=$1; shift
|
|
if bao kv put -cas=0 "$path" "$@" >/dev/null 2>&1; then
|
|
echo "$path created" >>"$receipt"
|
|
else
|
|
echo "$path not written (exists or denied)" >>"$receipt"
|
|
fi
|
|
}
|
|
|
|
meta() {
|
|
path=$1; shift
|
|
bao kv metadata put "$@" "$path" >/dev/null 2>&1 \
|
|
|| echo "$path metadata not written" >>"$receipt"
|
|
}
|
|
|
|
# Same field names as platform/workloads/railiance/{scaleway/bootstrap,backup/object-storage}.
|
|
put platform/suppliers/scaleway/bootstrap \
|
|
ACCESS_KEY=xxx SECRET_KEY=xxx DEFAULT_ORGANIZATION_ID=xxx DEFAULT_PROJECT_ID=xxx
|
|
meta platform/suppliers/scaleway/bootstrap \
|
|
-custom-metadata=owner=railiance-platform \
|
|
-custom-metadata=purpose=scaleway-bootstrap-iam-key \
|
|
-custom-metadata=readers=none-yet
|
|
|
|
put platform/suppliers/scaleway/backup \
|
|
ACCESS_KEY=xxx SECRET_KEY=xxx DEFAULT_ORGANIZATION_ID=xxx DEFAULT_PROJECT_ID=xxx
|
|
meta platform/suppliers/scaleway/backup \
|
|
-custom-metadata=owner=railiance-platform \
|
|
-custom-metadata=purpose=resource-control-scoped-backup-key \
|
|
-custom-metadata=readers=none-yet
|
|
|
|
# MASON-WP-0014, temporary: tear down at MAS-WP-0003 close.
|
|
put platform/suppliers/scaleway/mas-tem-relay username=xxx password=xxx
|
|
meta platform/suppliers/scaleway/mas-tem-relay \
|
|
-custom-metadata=owner=railiance-platform \
|
|
-custom-metadata=purpose=mas-live-test-tem-smtp \
|
|
-custom-metadata=readers=external-secrets-mas-tem-relay \
|
|
-custom-metadata=plan=ops-mason/plans/mas-tem-relay-smtp.md
|
|
|
|
# Version numbers only; values are never read.
|
|
for p in bootstrap backup mas-tem-relay; do
|
|
v=$(bao kv metadata get -format=json "platform/suppliers/scaleway/$p" 2>/dev/null \
|
|
| sed -n 's/.*"current_version": *\([0-9]*\).*/\1/p' | head -1)
|
|
echo "platform/suppliers/scaleway/$p current_version=${v:-unknown}" >>"$receipt"
|
|
done
|