coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy reuse-surface runtime secrets via OpenBao External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 3s
Details
CI Smoke / container-smoke (push) Successful in 48s
Details

Browse source 
Add openbao-reuse ClusterSecretStore handoff, reuse-surface-runtime
ExternalSecret, ESO token bootstrap script, and Makefile targets for
CCR-2026-0005 / RAILIANCE-WP-0011.
This commit is contained in:
tegwick 2026-07-07 22:34:34 +02:00
parent 3a9236148a
commit 40f0cb741d
5 changed files with 130 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

16
Makefile
View file

@ -49,6 +49,7 @@ FORGEJO_DB_NAMESPACE ?= databases
FORGEJO_RUNNER_MANIFEST ?= manifests/forgejo-runner.yaml FORGEJO_RUNNER_MANIFEST ?= manifests/forgejo-runner.yaml
FORGEJO_RUNNER_REGISTRATION_SECRET ?= helm/forgejo-runner-registration.sops.yaml FORGEJO_RUNNER_REGISTRATION_SECRET ?= helm/forgejo-runner-registration.sops.yaml
FORGEJO_MAILER_EXTERNAL_SECRET ?= manifests/forgejo-mailer-externalsecret.yaml FORGEJO_MAILER_EXTERNAL_SECRET ?= manifests/forgejo-mailer-externalsecret.yaml
REUSE_RUNTIME_EXTERNAL_SECRET ?= manifests/reuse-surface-runtime-externalsecret.yaml
PLATFORM_REPO ?= $(HOME)/railiance-platform PLATFORM_REPO ?= $(HOME)/railiance-platform
ESO_CHART_VERSION ?= 0.16.1 ESO_CHART_VERSION ?= 0.16.1
INTER_HUB_IMAGE_REF = $(INTER_HUB_IMAGE_REPOSITORY):$(INTER_HUB_IMAGE_TAG) INTER_HUB_IMAGE_REF = $(INTER_HUB_IMAGE_REPOSITORY):$(INTER_HUB_IMAGE_TAG)
@ -316,6 +317,19 @@ reuse-logs: check-railiance01-kubeconfig ## Tail reuse-surface service logs from
reuse-forgejo-webhook: check-railiance01-kubeconfig ## Idempotent org webhook on Forgejo -> reuse hub (REUSE-WP-0019-T03) reuse-forgejo-webhook: check-railiance01-kubeconfig ## Idempotent org webhook on Forgejo -> reuse hub (REUSE-WP-0019-T03)
bash tools/reuse-forgejo-webhook.sh bash tools/reuse-forgejo-webhook.sh
reuse-openbao-eso-token-apply: ## Mint coulombcore OpenBao ESO token + Secret on railiance01 (CCR-2026-0005)
OPENBAO_TOKEN_FILE="$(HOME)/.local/openbao/platform-admin.token" bash tools/reuse-openbao-eso-token-apply.sh
reuse-openbao-store-deploy: check-railiance01-kubeconfig eso-deploy ## Apply openbao-reuse ClusterSecretStore
test -d "$(PLATFORM_REPO)/argocd/platform-addons/openbao-secretstore"
KUBECONFIG="$(REUSE_KUBECONFIG)" kubectl apply -f "$(PLATFORM_REPO)/argocd/platform-addons/openbao-secretstore/openbao-reuse.clustersecretstore.yaml"
reuse-runtime-es-deploy: check-railiance01-kubeconfig reuse-openbao-store-deploy ## Apply reuse-surface runtime ExternalSecret
KUBECONFIG="$(REUSE_KUBECONFIG)" kubectl apply -f $(REUSE_RUNTIME_EXTERNAL_SECRET)
reuse-runtime-es-status: check-railiance01-kubeconfig ## Show reuse-surface runtime ExternalSecret sync status
KUBECONFIG="$(REUSE_KUBECONFIG)" kubectl get externalsecret,secret -n $(REUSE_NAMESPACE) reuse-surface-runtime reuse-surface-env
##@ Help ##@ Help
help: ## Show this help help: ## Show this help
@ -323,4 +337,4 @@ help: ## Show this help
/^[a-zA-Z0-9_-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } \ /^[a-zA-Z0-9_-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
/^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST) /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
.PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status check-railiance01-kubeconfig check-inter-hub-image-tag check-inter-hub-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs inter-hub-render-baseline inter-hub-dry-run inter-hub-server-dry-run inter-hub-deploy inter-hub-status inter-hub-release-info inter-hub-smoke inter-hub-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs help .PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status check-railiance01-kubeconfig check-inter-hub-image-tag check-inter-hub-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs inter-hub-render-baseline inter-hub-dry-run inter-hub-server-dry-run inter-hub-deploy inter-hub-status inter-hub-release-info inter-hub-smoke inter-hub-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status help

28
docs/reuse-surface-on-railiance01.md
View file

@ -48,9 +48,12 @@ export REUSE_SURFACE_URL=http://127.0.0.1:18001
## Runtime secrets ## Runtime secrets
Custody is the Kubernetes Secret `reuse-surface-env` in namespace `reuse` on Custody is OpenBao KV at
Railiance01. This is **not** an OpenBao KV path today — see `platform/workloads/reuse/reuse-surface/runtime-secrets` on coulombcore
**RAILIANCE-WP-0011** for a planned OpenBao + External Secrets migration. (`https://bao.coulomb.social`), delivered to the workload through External
Secrets (`ExternalSecret reuse/reuse-surface-runtime` → Secret `reuse-surface-env`,
`ClusterSecretStore openbao-reuse`). Lane: **CCR-2026-0005** /
**RAILIANCE-WP-0011**.
| Key | Required | Purpose | | Key | Required | Purpose |
| --- | --- | --- | | --- | --- | --- |
@ -66,16 +69,21 @@ kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-
kubectl --kubeconfig ~/.kube/config-hosteurope rollout status deployment/reuse-surface -n reuse kubectl --kubeconfig ~/.kube/config-hosteurope rollout status deployment/reuse-surface -n reuse
``` ```
**Create or rotate** (generate values locally — never commit or paste into chat): **Bootstrap / rotate** (update OpenBao fields — never commit or paste into chat):
```bash ```bash
kubectl create namespace reuse --dry-run=client -o yaml | kubectl apply -f - # Operator: update both fields in OpenBao, then refresh ESO and roll the Deployment
kubectl create secret generic reuse-surface-env \ make reuse-runtime-es-status
--namespace reuse \
--from-literal=REUSE_SURFACE_TOKEN="$(openssl rand -hex 32)" \
--from-literal=REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET="$(openssl rand -hex 32)" \
--dry-run=client -o yaml | kubectl apply -f -
kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse kubectl --kubeconfig ~/.kube/config-hosteurope rollout restart deployment/reuse-surface -n reuse
make reuse-forgejo-webhook # required when rotating REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
```
One-time lane bootstrap (CCR-2026-0005):
```bash
make reuse-openbao-eso-token-apply
make reuse-runtime-es-deploy
make reuse-runtime-es-status
``` ```
**Export for a shell session** (streams to your terminal only): **Export for a shell session** (streams to your terminal only):

7
helm/reuse-surface-values.yaml
View file

@ -1,8 +1,7 @@
# Production overrides for reuse-surface federation hub. # Production overrides for reuse-surface federation hub.
# Runtime secrets (Secret reuse-surface-env, namespace reuse): # Runtime secrets: ExternalSecret reuse-surface-runtime -> Secret reuse-surface-env
# REUSE_SURFACE_TOKEN — hub write API bearer token # (OpenBao path platform/workloads/reuse/reuse-surface/runtime-secrets, CCR-2026-0005).
# REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET — HMAC for POST /v1/webhooks/forgejo # See docs/reuse-surface-on-railiance01.md#runtime-secrets
# See docs/reuse-surface-on-railiance01.md#runtime-secrets and make reuse-forgejo-webhook.
image: image:
tag: "e3ae22e" tag: "e3ae22e"

35
manifests/reuse-surface-runtime-externalsecret.yaml Normal file
View file

@ -0,0 +1,35 @@
# reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005).
#
# OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets
# Fields: REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
#
# Prereqs on railiance01:
# - External Secrets Operator (make eso-deploy)
# - ClusterSecretStore openbao-reuse (railiance-platform openbao-secretstore)
# - OpenBao policy workload-kv-read-reuse-surface-runtime + ESO token
# (make reuse-openbao-eso-token-apply)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: reuse-surface-runtime
namespace: reuse
labels:
app.kubernetes.io/name: reuse-surface
app.kubernetes.io/part-of: railiance-apps
spec:
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: openbao-reuse
target:
name: reuse-surface-env
creationPolicy: Owner
data:
- secretKey: REUSE_SURFACE_TOKEN
remoteRef:
key: workloads/reuse/reuse-surface/runtime-secrets
property: REUSE_SURFACE_TOKEN
- secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
remoteRef:
key: workloads/reuse/reuse-surface/runtime-secrets
property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET

59
tools/reuse-openbao-eso-token-apply.sh Executable file
View file

@ -0,0 +1,59 @@
#!/usr/bin/env bash
# Create/read-limited OpenBao token on coulombcore (bao.coulomb.social) and store it
# on railiance01 for External Secrets (ClusterSecretStore openbao-reuse).
set -euo pipefail
POLICY_NAME="${OPENBAO_REUSE_POLICY:-workload-kv-read-reuse-surface-runtime}"
POLICY_FILE="${OPENBAO_REUSE_POLICY_FILE:-$HOME/railiance-platform/openbao/policies/workload-kv-read-reuse-surface-runtime.hcl}"
BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-hosteurope}"
SECRET_NAME="${OPENBAO_REUSE_ESO_SECRET:-openbao-reuse-eso-token}"
SECRET_NS="${OPENBAO_REUSE_ESO_NAMESPACE:-external-secrets}"
if ! command -v bao >/dev/null 2>&1; then
echo "ERROR: bao CLI not found" >&2
exit 1
fi
if [[ ! -f "$POLICY_FILE" ]]; then
echo "ERROR: policy file missing: $POLICY_FILE" >&2
exit 1
fi
echo "OpenBao addr: $BAO_ADDR"
echo "Policy: $POLICY_NAME"
if [[ -n "${BAO_TOKEN:-}" ]]; then
:
elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
else
read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
echo >&2
fi
if [[ -z "${BAO_TOKEN:-}" ]]; then
echo "ERROR: empty OpenBao token" >&2
exit 1
fi
export BAO_ADDR BAO_TOKEN
health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"
if echo "$health" | grep -q '"sealed":true'; then
echo "ERROR: OpenBao at $BAO_ADDR reports sealed" >&2
exit 1
fi
bao policy write "$POLICY_NAME" "$POLICY_FILE"
token_json="$(bao token create -policy="$POLICY_NAME" -display-name="eso-reuse-surface-runtime" -period=720h -format=json)"
token="$(python3 -c "import json,sys; print(json.load(sys.stdin)['auth']['client_token'])" <<<"$token_json")"
KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create namespace "$SECRET_NS" --dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl create secret generic "$SECRET_NAME" \
--namespace "$SECRET_NS" \
--from-literal=token="$token" \
--dry-run=client -o yaml | KUBECONFIG="$RAILIANCE01_KUBECONFIG" kubectl apply -f -
unset BAO_TOKEN token token_json
echo "ok: applied $SECRET_NS/$SECRET_NAME on railiance01 (token not printed)"