WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling

Adopt live Core Hub resources, align prod ConfigMap naming, default production image registry to gitea, and install Helm release core-hub rev 1 (smoke passed). Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login requirement now that OpenBao is unsealed.
2026-07-10 21:47:14 +02:00 · 2026-07-10 21:47:14 +02:00 · e9ee577d03
commit e9ee577d03
parent 871c56692b
9 changed files with 101 additions and 31 deletions
--- a/21
+++ b/21
@ -63,7 +63,7 @@ CORE_HUB_CHART     ?= charts/core-hub
 CORE_HUB_VALUES    ?= helm/core-hub-values.yaml
 CORE_HUB_STAGING_NAMESPACE ?= core-hub-staging
 CORE_HUB_STAGING_VALUES ?= helm/core-hub-staging-values.yaml
-CORE_HUB_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/core-hub
+CORE_HUB_IMAGE_REPOSITORY ?= gitea.coulomb.social/coulomb/core-hub
 CORE_HUB_IMAGE_TAG ?=
 CORE_HUB_BASE_URL  ?= https://hub.coulomb.social
 CORE_HUB_KUBECONFIG ?= $(PRODUCTION_KUBECONFIG)
@ -141,7 +141,19 @@ cnpg-backup-status: check-production-kubeconfig ## Report CNPG backup spec and S

 apps-pg-backup-dry-run: check-production-kubeconfig ## Logical pg_dump + age encrypt for vergabe_db (no upload)
 	chmod +x tools/apps-pg-backup-dry-run.sh
-	KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" tools/apps-pg-backup-dry-run.sh
+	KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" RAILIANCE_BACKUP_DRY_RUN=1 \
+		tools/apps-pg-backup-dry-run.sh
+
+apps-pg-backup: check-production-kubeconfig ## Logical pg_dump + age encrypt + Nextcloud upload for vergabe_db
+	chmod +x tools/apps-pg-backup-dry-run.sh
+	@KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" bao kv metadata get \
+		platform/workloads/railiance/backup/offsite-lane >/dev/null 2>&1 || { \
+		echo "ERROR: OpenBao backup-lane auth missing." >&2; \
+		echo "Run: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2; \
+		exit 1; \
+	}
+	KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" RAILIANCE_BACKUP_DRY_RUN=0 \
+		tools/apps-pg-backup-dry-run.sh

 ##@ Vergabe Teilnahme

@ -222,6 +234,11 @@ inter-hub-logs: check-railiance01-kubeconfig ## Tail inter-hub app logs from Rai

 ##@ Core Hub

+core-hub-helm-adopt: check-production-kubeconfig ## Annotate live Core Hub resources for Helm ownership
+	chmod +x tools/core-hub-helm-adopt.sh
+	KUBECONFIG="$(CORE_HUB_KUBECONFIG)" CORE_HUB_NAMESPACE="$(CORE_HUB_NAMESPACE)" CORE_HUB_RELEASE="$(CORE_HUB_RELEASE)" \
+		tools/core-hub-helm-adopt.sh
+
 core-hub-render-baseline: ## Render checked-in core-hub values for chart validation only
 	helm template $(CORE_HUB_RELEASE) $(CORE_HUB_CHART) \
 		--namespace $(CORE_HUB_NAMESPACE) \
--- a/charts/core-hub/templates/_helpers.tpl
+++ b/charts/core-hub/templates/_helpers.tpl
@ -29,5 +29,5 @@ app.kubernetes.io/component: api
 {{- end -}}

 {{- define "corehub.runtimeConfigMapName" -}}
-{{- printf "%s-runtime" .Release.Name -}}
+{{- default (printf "%s-runtime" .Release.Name) .Values.runtime.configMapName -}}
 {{- end -}}
--- a/charts/core-hub/values.yaml
+++ b/charts/core-hub/values.yaml
@ -10,6 +10,7 @@ replicaCount: 1
 runtime:
  coreHubEnv: production
  autoCreateTables: "0"
+  configMapName: ""

 envSecretName: core-hub-prod-env

--- a/docs/credential-routing-railiance-apps.md
+++ b/docs/credential-routing-railiance-apps.md
@ -38,10 +38,10 @@ export RAILIANCE_BACKUP_NC_TOKEN=$(
 )
 ```

-**Blocker observed 2026-07-10:** OpenBao at `https://bao.coulomb.social` reports
-`Vault is sealed`. `warden access issue-core-ingestion-api-key --fetch --no-policy`
-reaches the broker but fails with the same sealed error. Unseal requires operator
-shamir keys before any KV fetch succeeds.
+**OpenBao unsealed 2026-07-10.** KV fetch still requires a valid caller token via
+OIDC (`railiance-backup-workload-kv-read`). Agent sessions cannot complete the
+browser callback to `localhost:8250` — run login in an interactive operator shell,
+then `make apps-pg-backup` or `tools/check-backup-lane-auth.sh`.

 ## CNPG barman ObjectStore (Phase 2 — deferred)

--- a/helm/core-hub-values.yaml
+++ b/helm/core-hub-values.yaml
@ -3,11 +3,13 @@
 # the Secret 'core-hub-prod-env' in the core-hub namespace.

 image:
+  repository: gitea.coulomb.social/coulomb/core-hub
  tag: "production-placeholder"  # Render baseline only; deploy requires CORE_HUB_IMAGE_TAG=<sha>.

 runtime:
  coreHubEnv: production
  autoCreateTables: "0"
+  configMapName: core-hub-prod-runtime

 envSecretName: core-hub-prod-env

--- a/tools/check-backup-lane-auth.sh
+++ b/tools/check-backup-lane-auth.sh
@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+path="${RAILIANCE_BACKUP_BAO_PATH:-platform/workloads/railiance/backup/offsite-lane}"
+
+if ! bao status >/dev/null 2>&1; then
+  echo "ERROR: cannot reach OpenBao at ${BAO_ADDR:-https://bao.coulomb.social}" >&2
+  exit 1
+fi
+
+sealed="$(bao status -format=json 2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('sealed', True))")"
+if [[ "$sealed" == "True" ]]; then
+  echo "ERROR: OpenBao is sealed" >&2
+  exit 1
+fi
+echo "ok: OpenBao unsealed"
+
+if bao token lookup >/dev/null 2>&1; then
+  echo "ok: caller token valid"
+else
+  echo "WARN: no valid caller token — run OIDC login:" >&2
+  echo "  bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2
+  exit 1
+fi
+
+if bao kv metadata get "$path" >/dev/null 2>&1; then
+  echo "ok: backup offsite-lane path readable"
+else
+  echo "ERROR: cannot read metadata for ${path}" >&2
+  exit 1
+fi
--- a/tools/core-hub-helm-adopt.sh
+++ b/tools/core-hub-helm-adopt.sh
@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Adopt live Core Hub manifests into Helm release ownership (WP-0014-T02).
+set -euo pipefail
+
+namespace="${CORE_HUB_NAMESPACE:-core-hub}"
+release="${CORE_HUB_RELEASE:-core-hub}"
+
+resources=(
+  "deployment/core-hub-api"
+  "service/core-hub-api"
+  "configmap/core-hub-prod-runtime"
+  "ingress/core-hub"
+)
+
+echo "Adopting Core Hub resources into Helm release ${release}/${namespace}"
+for resource in "${resources[@]}"; do
+  echo "  ${resource}"
+  kubectl annotate -n "$namespace" "$resource" \
+    meta.helm.sh/release-name="$release" \
+    meta.helm.sh/release-namespace="$namespace" \
+    --overwrite
+  kubectl label -n "$namespace" "$resource" \
+    app.kubernetes.io/managed-by=Helm \
+    --overwrite
+done
+
+echo "ok: adoption metadata applied — run core-hub-server-dry-run next"
--- a/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md
+++ b/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md
@ -34,15 +34,14 @@ id: RAILIANCE-WP-0013-T01
 status: progress
 priority: high
 needs_human: true
-intervention_note: "OpenBao sealed at bao.coulomb.social — operator unseal + OIDC login (railiance-backup-workload-kv-read) required"
+intervention_note: "OpenBao unsealed; OIDC login required in interactive shell (browser callback localhost:8250) before offsite-lane upload"
 state_hub_task_id: "f2051213-0a9f-418e-82ad-9bd7c79fd0dc"
 ```

-Credential routing in `docs/credential-routing-railiance-apps.md`. `warden access`
-reaches the platform broker; KV fetch fails while OpenBao is sealed. Phase 1 lane:
-`platform/workloads/railiance/backup/offsite-lane`. CoulombCore clusters:
-`apps-pg`, `gitea-db`, `net-kingdom-pg`, `state-hub-db`. `make apps-pg-backup-dry-run`
-succeeded (pg_dump + age encrypt; upload blocked on offsite-lane).
+OpenBao unsealed (2026-07-10). Stale `~/.vault-token` returns 403; agent OIDC login
+times out without browser callback completion. Operator command:
+`bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read`.
+Then `make apps-pg-backup` uploads via offsite-lane. Dry-run path proven.

 ## Wire apps-pg backup coverage

--- a/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md
+++ b/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md
@ -28,46 +28,39 @@ approval. Do not store secrets in workplans.

 ```task
 id: RAILIANCE-WP-0014-T01
-status: progress
+status: done
 priority: high
 state_hub_task_id: "b9dea9f3-f0c0-41c1-b9c4-ec4c44d43d55"
 ```

-Production on CoulombCore (`PRODUCTION_KUBECONFIG=~/.kube/config`). Live image:
-`gitea.coulomb.social/coulomb/core-hub:a33191a`. `core-hub-prod-env` exists.
-`core-hub-server-dry-run` blocked: existing Service/Deployment lack Helm ownership
-metadata — needs adopt/patch before `helm upgrade --install`.
+CoulombCore production cluster confirmed. `core-hub-server-dry-run` passed after
+`make core-hub-helm-adopt` and configMap name alignment (`core-hub-prod-runtime`).
+Live image `gitea.coulomb.social/coulomb/core-hub:a33191a` verified.

 ## Adopt Helm-managed Core Hub release

 ```task
 id: RAILIANCE-WP-0014-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "0e591104-0123-4e4a-84ff-5deb435e8441"
 ```

-Run `core-hub-migrate` then `core-hub-deploy` with an explicit
-`CORE_HUB_IMAGE_TAG`. Confirm the Helm release owns `core-hub-api`, runtime
-ConfigMap, and Service in namespace `core-hub`. Retire duplicate resources from
-the service-repo `k8s/railiance-production/` apply path once stable.
-
-Blocked on: `RAILIANCE-WP-0014-T01`.
+`CORE_HUB_IMAGE_TAG=a33191a make core-hub-deploy` installed Helm release
+`core-hub` revision 1 on CoulombCore. Resources carry Helm ownership metadata.
+Service-repo `k8s/railiance-production/` path is now superseded for operations.

 ## Verify Core Hub post-cutover smoke

 ```task
 id: RAILIANCE-WP-0014-T03
-status: wait
+status: done
 priority: high
 state_hub_task_id: "eca3ce8b-68a8-44d0-90c7-2cdefa482200"
 ```

-Run `make core-hub-status`, `make core-hub-smoke`, and `make core-hub-release-info`.
-Ingress for `hub.coulomb.social` must remain healthy. Document rollback steps in
-`docs/core-hub-on-railiance01.md` if Helm values drift from prior manifests.
-
-Blocked on: `RAILIANCE-WP-0014-T02`.
+Post-deploy `make core-hub-status` and `make core-hub-smoke` passed on
+`https://hub.coulomb.social` after Helm rollout (2026-07-10).

 ## Refresh vergabe-teilnahme production image