tegwick
f91cbca461
40 cluster workloads pull forge images without imagePullSecrets, 6 ArgoCD applications read forge Git; local clones are SSH. Live credential checks and per-entry review remain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
46 lines
2.7 KiB
Markdown
46 lines
2.7 KiB
Markdown
# Anonymous forge consumers — ORGREF-WP-0002-T02
|
|
|
|
Machine-readable result: `access-consumers-2026-10-08.json`. Reproduce:
|
|
|
|
```bash
|
|
python3 tools/access_consumers.py --root /home/worsch \
|
|
--runtime inventory/runtime-2026-09-28.json \
|
|
--output inventory/access-consumers-2026-10-08.json
|
|
```
|
|
|
|
Read-only: 161 local working trees scanned, plus the 2026-09-28 runtime capture
|
|
(not a live read). Secrets, ArgoCD repository credentials and node registry
|
|
configuration were not inspected.
|
|
|
|
## What breaks when repositories and packages go private
|
|
|
|
| Class | Count | Reads | Will need |
|
|
| --- | --- | --- | --- |
|
|
| cluster-image-pull | 40 workloads in 21 namespaces | container images from the Forgejo registry, **none with `imagePullSecrets`** | pull credentials per namespace, or node-level registry auth (k3s `registries.yaml`), which is unverified |
|
|
| cluster-gitops | 6 ArgoCD applications | Git sources on the forge | ArgoCD repository credentials (current state unverified) |
|
|
| ci-runner | 27 hits in workflow files | checkouts, reusable actions, registry | runner or job tokens for cross-repo reads |
|
|
| api-client | 25 hits | `/api/v1` calls (state-hub, railiance-*, ops-warden, issue-core, …) | per-service tokens; check which calls are anonymous today |
|
|
| raw-file-fetch | 68 hits, 63 in `reuse-surface` | raw files by URL | authenticated fetch, or move the published content to a public location |
|
|
| raw-file-fetch (campaign) | pr-hall-of-helix, fluid-telegram | Telegram fetching post images | a deliberate public asset location (ORGREF-WP-0002-T01 point 4) |
|
|
| package-consumer | 2 (kaizen-agentic, whynot-design) | modules or packages from the forge | package-registry credentials |
|
|
|
|
Lower risk, review only: `repo-gitops` (15) and `repo-image-reference` (91) are
|
|
the same cluster consumers seen from their source repos. `code-reference` (24),
|
|
`config-reference` (98) and `build-tooling` (23) are mostly URLs and pushes that
|
|
need a per-entry look. `doc-link` (119) means links break for the public, not
|
|
consumers. `record-or-test` (103) is evidence and fixtures.
|
|
|
|
## Not anonymous
|
|
|
|
All 160 local clones use SSH with the founder's key (`forgejo-remote`). They keep
|
|
working as long as that account can read the repositories.
|
|
|
|
## Still open for T02
|
|
|
|
- Live verification: k3s node registry auth, ArgoCD repository credentials, and
|
|
a fresh runtime capture (the 2026-09-28 capture is the basis here).
|
|
- Per-entry review of `api-client`, `code-reference` and `ci-runner` hits, to
|
|
tell anonymous reads from authenticated writes.
|
|
- Consumers outside these working trees (external sites and links, other
|
|
people's clones) cannot be found by scanning; T08's anonymous probe after each
|
|
wave is the backstop.
|