From bc83a2fb16d2aebe78754fed603f42200557ab9a Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 16:54:05 +0200 Subject: [PATCH] ORGREF-WP-0002-T02 done: ArgoCD and k3s pull anonymously Founder checks: no ArgoCD repository credentials; k3s registries.yaml holds auth only for the frozen Gitea host, none for forgejo.coulomb.social. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012 --- inventory/access-consumers.md | 20 +++++++++++++++---- ...WP-0002-forge-closure-netkingdom-access.md | 9 ++++++++- 2 files changed, 24 insertions(+), 5 deletions(-) diff --git a/inventory/access-consumers.md b/inventory/access-consumers.md index e27136f..58e146f 100644 --- a/inventory/access-consumers.md +++ b/inventory/access-consumers.md @@ -17,8 +17,8 @@ Secrets and node registry configuration were not inspected. | Class | Count | Reads | Will need | | --- | --- | --- | --- | -| cluster-image-pull | 43 workloads | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`, unverified). Anonymous pulls confirmed working on 2026-10-08: anonymous registry token issued, tag list 200 | -| cluster-gitops | 10 ArgoCD applications over 5 repos | Git: railiance-platform (6 apps), activity-core, informed-decision, state-hub, target-revenue | ArgoCD repository credentials. `argocd-cm` defines none; Secret-based credentials unverified | +| cluster-image-pull | 43 workloads | container images from the Forgejo registry, **none with `imagePullSecrets`** | node-level registry auth (k3s `registries.yaml` has **none for the forge**, founder check below) or pull credentials per namespace. Anonymous pulls confirmed working on 2026-10-08: anonymous registry token issued, tag list 200 | +| cluster-gitops | 10 ArgoCD applications over 5 repos | Git: railiance-platform (6 apps), activity-core, informed-decision, state-hub, target-revenue | ArgoCD repository credentials: **none exist today** (founder check below) | | ci-runner | about 20 repos | own-source tarballs and cross-repo tarballs, anonymously (below) | job token for the own repository, a scoped read token across repositories | | package index | kaizen-agentic, vergabe-teilnahme | PyPI `simple/` index without credentials | package-read token | | federation | reuse-surface | about 60 capability indexes by raw URL | read identity, or a published index location | @@ -95,9 +95,21 @@ Agents do not read Secrets, so run these in your own terminal and paste the outp `absent`, or no `auth:` under the forge host, means all 43 pulls depend on anonymous registry access today. -## Still open for T02 +### Results, 2026-10-08 (run by the founder) + +1. **ArgoCD: no repository credentials.** Empty output: no `repository` or + `repo-creds` Secrets. All 10 Applications read the forge anonymously. +2. **k3s: no registry auth for the forge.** `registries.yaml` exists with + `mirrors` and `configs.auth` (username, password) only for `92.205.130.254:`, + the frozen legacy Gitea host. The port was cut off by the value-stripping + command. There is no entry for `forgejo.coulomb.social`, so all 43 image pulls + are anonymous. One node-level `configs."forgejo.coulomb.social".auth` entry + with a read-only package identity would cover all of them at once (T06). The + stale Gitea credential on the node is a cleanup item for railiance-forge or + railiance-infra. + +## Left to owners (tracked in T06, not T02) -- The two founder checks above. - Owners confirm the code readers listed under "no token handling found". - Consumers outside these working trees (external sites and links, other people's clones) cannot be found by scanning; T08's anonymous probe after each diff --git a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md index 8b9fa01..cb1a9cc 100644 --- a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md +++ b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md @@ -122,7 +122,7 @@ Record a founder decision covering: ```task id: ORGREF-WP-0002-T02 -status: progress +status: done priority: high state_hub_task_id: "ace26a22-50e2-58c6-b4ad-85d95c284fce" ``` @@ -158,6 +158,13 @@ clones are SSH and unaffected. Open: founder presence checks for ArgoCD repository credentials and k3s node registry auth (commands in the summary), and owner confirmation of the code readers. +2026-10-08: T02 done. Founder checks: ArgoCD has no repository credentials +(all 10 Applications read anonymously); k3s `registries.yaml` holds auth only for +the frozen Gitea host `92.205.130.254`, none for `forgejo.coulomb.social` (all 43 +pulls anonymous). One node-level registry auth entry would cover every pull +(T06). The stale Gitea credential on the node is a cleanup item. Code-reader +confirmation moves to the owners under T06. + ```task id: ORGREF-WP-0002-T03 status: todo