From 85e9163bb0d150f06ac1128173d0d7bcfca0b550 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 7 Jul 2026 22:38:45 +0200 Subject: [PATCH] Point reuse-surface token export handoff at OpenBao path Primary operator fetch is bao kv get per RAILIANCE-WP-0011-T03; kubectl remains break-glass when OpenBao is unreachable. --- docs/reuse-surface-on-railiance01.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/reuse-surface-on-railiance01.md b/docs/reuse-surface-on-railiance01.md index 649138f..2162179 100644 --- a/docs/reuse-surface-on-railiance01.md +++ b/docs/reuse-surface-on-railiance01.md @@ -90,13 +90,16 @@ make reuse-runtime-es-status ```bash export REUSE_SURFACE_TOKEN=$( - kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse \ - -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d + bao kv get -field=REUSE_SURFACE_TOKEN \ + platform/workloads/reuse/reuse-surface/runtime-secrets ) ``` Or proxy via ops-warden: `warden access reuse-surface-hub-write-token --fetch`. +**Break-glass** (OpenBao unreachable): read materialized Secret `reuse-surface-env` +via kubectl — see `ops-warden/wiki/playbooks/reuse-surface-hub-write-token.md`. + ## Forgejo org webhook Org-level push webhook on Forgejo (`coulomb`) triggers hub recompose when any