coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy reuse-surface runtime secrets via OpenBao External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 3s
Details
CI Smoke / container-smoke (push) Successful in 48s
Details

Browse source 
Add openbao-reuse ClusterSecretStore handoff, reuse-surface-runtime
ExternalSecret, ESO token bootstrap script, and Makefile targets for
CCR-2026-0005 / RAILIANCE-WP-0011.
This commit is contained in:
tegwick 2026-07-07 22:34:34 +02:00
parent 3a9236148a
commit 40f0cb741d
5 changed files with 130 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

28
docs/reuse-surface-on-railiance01.md
View file

@ -48,9 +48,12 @@ export REUSE_SURFACE_URL=http://127.0.0.1:18001
## Runtime secrets
Custody is the Kubernetes Secret `reuse-surface-env` in namespace `reuse` on
Railiance01. This is **not** an OpenBao KV path today — see
**RAILIANCE-WP-0011** for a planned OpenBao + External Secrets migration.
Custody is OpenBao KV at
`platform/workloads/reuse/reuse-surface/runtime-secrets` on coulombcore
(`https://bao.coulomb.social`), delivered to the workload through External
Secrets (`ExternalSecret reuse/reuse-surface-runtime` → Secret `reuse-surface-env`,
`ClusterSecretStore openbao-reuse`). Lane: **CCR-2026-0005** /
**RAILIANCE-WP-0011**.
| Key | Required | Purpose |
| --- | --- | --- |
@ -66,16 +69,21 @@ kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-
kubectl --kubeconfig ~/.kube/config-hosteurope rollout status deployment/reuse-surface -n reuse
```
**Create or rotate** (generate values locally — never commit or paste into chat):
**Bootstrap / rotate** (update OpenBao fields — never commit or paste into chat):
```bash
kubectl create namespace reuse --dry-run=client -o yaml | kubectl apply -f -
kubectl create secret generic reuse-surface-env \
--namespace reuse \
--from-literal=REUSE_SURFACE_TOKEN="$(openssl rand -hex 32)" \
--from-literal=REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET="$(openssl rand -hex 32)" \
--dry-run=client -o yaml | kubectl apply -f -
# Operator: update both fields in OpenBao, then refresh ESO and roll the Deployment
make reuse-runtime-es-status
kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse
make reuse-forgejo-webhook # required when rotating REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
```
One-time lane bootstrap (CCR-2026-0005):
```bash
make reuse-openbao-eso-token-apply
make reuse-runtime-es-deploy
make reuse-runtime-es-status
```
**Export for a shell session** (streams to your terminal only):