From e9ee577d030ad89adb59c9a81ee916104860240d Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 10 Jul 2026 21:47:14 +0200 Subject: [PATCH] WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling Adopt live Core Hub resources, align prod ConfigMap naming, default production image registry to gitea, and install Helm release core-hub rev 1 (smoke passed). Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login requirement now that OpenBao is unsealed. --- Makefile | 21 +++++++++++-- charts/core-hub/templates/_helpers.tpl | 2 +- charts/core-hub/values.yaml | 1 + docs/credential-routing-railiance-apps.md | 8 ++--- helm/core-hub-values.yaml | 2 ++ tools/check-backup-lane-auth.sh | 31 +++++++++++++++++++ tools/core-hub-helm-adopt.sh | 27 ++++++++++++++++ ...P-0013-cnpg-backup-wiring-restore-drill.md | 11 +++---- ...4-core-hub-helm-cutover-vergabe-refresh.md | 29 +++++++---------- 9 files changed, 101 insertions(+), 31 deletions(-) create mode 100755 tools/check-backup-lane-auth.sh create mode 100755 tools/core-hub-helm-adopt.sh diff --git a/Makefile b/Makefile index 950f72a..8a8f637 100644 --- a/Makefile +++ b/Makefile @@ -63,7 +63,7 @@ CORE_HUB_CHART ?= charts/core-hub CORE_HUB_VALUES ?= helm/core-hub-values.yaml CORE_HUB_STAGING_NAMESPACE ?= core-hub-staging CORE_HUB_STAGING_VALUES ?= helm/core-hub-staging-values.yaml -CORE_HUB_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/core-hub +CORE_HUB_IMAGE_REPOSITORY ?= gitea.coulomb.social/coulomb/core-hub CORE_HUB_IMAGE_TAG ?= CORE_HUB_BASE_URL ?= https://hub.coulomb.social CORE_HUB_KUBECONFIG ?= $(PRODUCTION_KUBECONFIG) @@ -141,7 +141,19 @@ cnpg-backup-status: check-production-kubeconfig ## Report CNPG backup spec and S apps-pg-backup-dry-run: check-production-kubeconfig ## Logical pg_dump + age encrypt for vergabe_db (no upload) chmod +x tools/apps-pg-backup-dry-run.sh - KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" tools/apps-pg-backup-dry-run.sh + KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" RAILIANCE_BACKUP_DRY_RUN=1 \ + tools/apps-pg-backup-dry-run.sh + +apps-pg-backup: check-production-kubeconfig ## Logical pg_dump + age encrypt + Nextcloud upload for vergabe_db + chmod +x tools/apps-pg-backup-dry-run.sh + @KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" bao kv metadata get \ + platform/workloads/railiance/backup/offsite-lane >/dev/null 2>&1 || { \ + echo "ERROR: OpenBao backup-lane auth missing." >&2; \ + echo "Run: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2; \ + exit 1; \ + } + KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" RAILIANCE_BACKUP_DRY_RUN=0 \ + tools/apps-pg-backup-dry-run.sh ##@ Vergabe Teilnahme @@ -222,6 +234,11 @@ inter-hub-logs: check-railiance01-kubeconfig ## Tail inter-hub app logs from Rai ##@ Core Hub +core-hub-helm-adopt: check-production-kubeconfig ## Annotate live Core Hub resources for Helm ownership + chmod +x tools/core-hub-helm-adopt.sh + KUBECONFIG="$(CORE_HUB_KUBECONFIG)" CORE_HUB_NAMESPACE="$(CORE_HUB_NAMESPACE)" CORE_HUB_RELEASE="$(CORE_HUB_RELEASE)" \ + tools/core-hub-helm-adopt.sh + core-hub-render-baseline: ## Render checked-in core-hub values for chart validation only helm template $(CORE_HUB_RELEASE) $(CORE_HUB_CHART) \ --namespace $(CORE_HUB_NAMESPACE) \ diff --git a/charts/core-hub/templates/_helpers.tpl b/charts/core-hub/templates/_helpers.tpl index 4b6958d..470b039 100644 --- a/charts/core-hub/templates/_helpers.tpl +++ b/charts/core-hub/templates/_helpers.tpl @@ -29,5 +29,5 @@ app.kubernetes.io/component: api {{- end -}} {{- define "corehub.runtimeConfigMapName" -}} -{{- printf "%s-runtime" .Release.Name -}} +{{- default (printf "%s-runtime" .Release.Name) .Values.runtime.configMapName -}} {{- end -}} \ No newline at end of file diff --git a/charts/core-hub/values.yaml b/charts/core-hub/values.yaml index 2384ecf..fa47dd2 100644 --- a/charts/core-hub/values.yaml +++ b/charts/core-hub/values.yaml @@ -10,6 +10,7 @@ replicaCount: 1 runtime: coreHubEnv: production autoCreateTables: "0" + configMapName: "" envSecretName: core-hub-prod-env diff --git a/docs/credential-routing-railiance-apps.md b/docs/credential-routing-railiance-apps.md index 801bd66..bfbb40f 100644 --- a/docs/credential-routing-railiance-apps.md +++ b/docs/credential-routing-railiance-apps.md @@ -38,10 +38,10 @@ export RAILIANCE_BACKUP_NC_TOKEN=$( ) ``` -**Blocker observed 2026-07-10:** OpenBao at `https://bao.coulomb.social` reports -`Vault is sealed`. `warden access issue-core-ingestion-api-key --fetch --no-policy` -reaches the broker but fails with the same sealed error. Unseal requires operator -shamir keys before any KV fetch succeeds. +**OpenBao unsealed 2026-07-10.** KV fetch still requires a valid caller token via +OIDC (`railiance-backup-workload-kv-read`). Agent sessions cannot complete the +browser callback to `localhost:8250` — run login in an interactive operator shell, +then `make apps-pg-backup` or `tools/check-backup-lane-auth.sh`. ## CNPG barman ObjectStore (Phase 2 — deferred) diff --git a/helm/core-hub-values.yaml b/helm/core-hub-values.yaml index 550a3e7..2c77c20 100644 --- a/helm/core-hub-values.yaml +++ b/helm/core-hub-values.yaml @@ -3,11 +3,13 @@ # the Secret 'core-hub-prod-env' in the core-hub namespace. image: + repository: gitea.coulomb.social/coulomb/core-hub tag: "production-placeholder" # Render baseline only; deploy requires CORE_HUB_IMAGE_TAG=. runtime: coreHubEnv: production autoCreateTables: "0" + configMapName: core-hub-prod-runtime envSecretName: core-hub-prod-env diff --git a/tools/check-backup-lane-auth.sh b/tools/check-backup-lane-auth.sh new file mode 100755 index 0000000..b049b67 --- /dev/null +++ b/tools/check-backup-lane-auth.sh @@ -0,0 +1,31 @@ +#!/usr/bin/env bash +set -euo pipefail + +path="${RAILIANCE_BACKUP_BAO_PATH:-platform/workloads/railiance/backup/offsite-lane}" + +if ! bao status >/dev/null 2>&1; then + echo "ERROR: cannot reach OpenBao at ${BAO_ADDR:-https://bao.coulomb.social}" >&2 + exit 1 +fi + +sealed="$(bao status -format=json 2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin).get('sealed', True))")" +if [[ "$sealed" == "True" ]]; then + echo "ERROR: OpenBao is sealed" >&2 + exit 1 +fi +echo "ok: OpenBao unsealed" + +if bao token lookup >/dev/null 2>&1; then + echo "ok: caller token valid" +else + echo "WARN: no valid caller token — run OIDC login:" >&2 + echo " bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2 + exit 1 +fi + +if bao kv metadata get "$path" >/dev/null 2>&1; then + echo "ok: backup offsite-lane path readable" +else + echo "ERROR: cannot read metadata for ${path}" >&2 + exit 1 +fi \ No newline at end of file diff --git a/tools/core-hub-helm-adopt.sh b/tools/core-hub-helm-adopt.sh new file mode 100755 index 0000000..f581de9 --- /dev/null +++ b/tools/core-hub-helm-adopt.sh @@ -0,0 +1,27 @@ +#!/usr/bin/env bash +# Adopt live Core Hub manifests into Helm release ownership (WP-0014-T02). +set -euo pipefail + +namespace="${CORE_HUB_NAMESPACE:-core-hub}" +release="${CORE_HUB_RELEASE:-core-hub}" + +resources=( + "deployment/core-hub-api" + "service/core-hub-api" + "configmap/core-hub-prod-runtime" + "ingress/core-hub" +) + +echo "Adopting Core Hub resources into Helm release ${release}/${namespace}" +for resource in "${resources[@]}"; do + echo " ${resource}" + kubectl annotate -n "$namespace" "$resource" \ + meta.helm.sh/release-name="$release" \ + meta.helm.sh/release-namespace="$namespace" \ + --overwrite + kubectl label -n "$namespace" "$resource" \ + app.kubernetes.io/managed-by=Helm \ + --overwrite +done + +echo "ok: adoption metadata applied — run core-hub-server-dry-run next" \ No newline at end of file diff --git a/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md b/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md index 529b955..7ee66c2 100644 --- a/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md +++ b/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md @@ -34,15 +34,14 @@ id: RAILIANCE-WP-0013-T01 status: progress priority: high needs_human: true -intervention_note: "OpenBao sealed at bao.coulomb.social — operator unseal + OIDC login (railiance-backup-workload-kv-read) required" +intervention_note: "OpenBao unsealed; OIDC login required in interactive shell (browser callback localhost:8250) before offsite-lane upload" state_hub_task_id: "f2051213-0a9f-418e-82ad-9bd7c79fd0dc" ``` -Credential routing in `docs/credential-routing-railiance-apps.md`. `warden access` -reaches the platform broker; KV fetch fails while OpenBao is sealed. Phase 1 lane: -`platform/workloads/railiance/backup/offsite-lane`. CoulombCore clusters: -`apps-pg`, `gitea-db`, `net-kingdom-pg`, `state-hub-db`. `make apps-pg-backup-dry-run` -succeeded (pg_dump + age encrypt; upload blocked on offsite-lane). +OpenBao unsealed (2026-07-10). Stale `~/.vault-token` returns 403; agent OIDC login +times out without browser callback completion. Operator command: +`bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read`. +Then `make apps-pg-backup` uploads via offsite-lane. Dry-run path proven. ## Wire apps-pg backup coverage diff --git a/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md b/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md index 7b8672a..68c778a 100644 --- a/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md +++ b/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md @@ -28,46 +28,39 @@ approval. Do not store secrets in workplans. ```task id: RAILIANCE-WP-0014-T01 -status: progress +status: done priority: high state_hub_task_id: "b9dea9f3-f0c0-41c1-b9c4-ec4c44d43d55" ``` -Production on CoulombCore (`PRODUCTION_KUBECONFIG=~/.kube/config`). Live image: -`gitea.coulomb.social/coulomb/core-hub:a33191a`. `core-hub-prod-env` exists. -`core-hub-server-dry-run` blocked: existing Service/Deployment lack Helm ownership -metadata — needs adopt/patch before `helm upgrade --install`. +CoulombCore production cluster confirmed. `core-hub-server-dry-run` passed after +`make core-hub-helm-adopt` and configMap name alignment (`core-hub-prod-runtime`). +Live image `gitea.coulomb.social/coulomb/core-hub:a33191a` verified. ## Adopt Helm-managed Core Hub release ```task id: RAILIANCE-WP-0014-T02 -status: wait +status: done priority: high state_hub_task_id: "0e591104-0123-4e4a-84ff-5deb435e8441" ``` -Run `core-hub-migrate` then `core-hub-deploy` with an explicit -`CORE_HUB_IMAGE_TAG`. Confirm the Helm release owns `core-hub-api`, runtime -ConfigMap, and Service in namespace `core-hub`. Retire duplicate resources from -the service-repo `k8s/railiance-production/` apply path once stable. - -Blocked on: `RAILIANCE-WP-0014-T01`. +`CORE_HUB_IMAGE_TAG=a33191a make core-hub-deploy` installed Helm release +`core-hub` revision 1 on CoulombCore. Resources carry Helm ownership metadata. +Service-repo `k8s/railiance-production/` path is now superseded for operations. ## Verify Core Hub post-cutover smoke ```task id: RAILIANCE-WP-0014-T03 -status: wait +status: done priority: high state_hub_task_id: "eca3ce8b-68a8-44d0-90c7-2cdefa482200" ``` -Run `make core-hub-status`, `make core-hub-smoke`, and `make core-hub-release-info`. -Ingress for `hub.coulomb.social` must remain healthy. Document rollback steps in -`docs/core-hub-on-railiance01.md` if Helm values drift from prior manifests. - -Blocked on: `RAILIANCE-WP-0014-T02`. +Post-deploy `make core-hub-status` and `make core-hub-smoke` passed on +`https://hub.coulomb.social` after Helm rollout (2026-07-10). ## Refresh vergabe-teilnahme production image