coulomb/prj-forgejo-org-refactor
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ORGREF-WP-0002-T02 done: ArgoCD and k3s pull anonymously

Browse source 
Founder checks: no ArgoCD repository credentials; k3s registries.yaml holds
auth only for the frozen Gitea host, none for forgejo.coulomb.social.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
This commit is contained in:
tegwick 2026-10-08 16:54:05 +02:00
parent ba5ed2f707
commit bc83a2fb16
2 changed files with 24 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

20
inventory/access-consumers.md
View file

@ -17,8 +17,8 @@ Secrets and node registry configuration were not inspected.
| Class | Count | Reads | Will need |
| --- | --- | --- | --- |
| cluster-image-pull | 43 workloads | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`, unverified). Anonymous pulls confirmed working on 2026-10-08: anonymous registry token issued, tag list 200 |
| cluster-gitops | 10 ArgoCD applications over 5 repos | Git: railiance-platform (6 apps), activity-core, informed-decision, state-hub, target-revenue | ArgoCD repository credentials. `argocd-cm` defines none; Secret-based credentials unverified |
| cluster-image-pull | 43 workloads | container images from the Forgejo registry, **none with `imagePullSecrets`** | node-level registry auth (k3s `registries.yaml` has **none for the forge**, founder check below) or pull credentials per namespace. Anonymous pulls confirmed working on 2026-10-08: anonymous registry token issued, tag list 200 |
| cluster-gitops | 10 ArgoCD applications over 5 repos | Git: railiance-platform (6 apps), activity-core, informed-decision, state-hub, target-revenue | ArgoCD repository credentials: **none exist today** (founder check below) |
| ci-runner | about 20 repos | own-source tarballs and cross-repo tarballs, anonymously (below) | job token for the own repository, a scoped read token across repositories |
| package index | kaizen-agentic, vergabe-teilnahme | PyPI `simple/` index without credentials | package-read token |
| federation | reuse-surface | about 60 capability indexes by raw URL | read identity, or a published index location |
@ -95,9 +95,21 @@ Agents do not read Secrets, so run these in your own terminal and paste the outp
`absent`, or no `auth:` under the forge host, means all 43 pulls depend on
anonymous registry access today.
## Still open for T02
### Results, 2026-10-08 (run by the founder)
1. **ArgoCD: no repository credentials.** Empty output: no `repository` or
`repo-creds` Secrets. All 10 Applications read the forge anonymously.
2. **k3s: no registry auth for the forge.** `registries.yaml` exists with
`mirrors` and `configs.auth` (username, password) only for `92.205.130.254:<port>`,
the frozen legacy Gitea host. The port was cut off by the value-stripping
command. There is no entry for `forgejo.coulomb.social`, so all 43 image pulls
are anonymous. One node-level `configs."forgejo.coulomb.social".auth` entry
with a read-only package identity would cover all of them at once (T06). The
stale Gitea credential on the node is a cleanup item for railiance-forge or
railiance-infra.
## Left to owners (tracked in T06, not T02)
- The two founder checks above.
- Owners confirm the code readers listed under "no token handling found".
- Consumers outside these working trees (external sites and links, other
people's clones) cannot be found by scanning; T08's anonymous probe after each