coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 20s
Details

Browse source 
Adopt live Core Hub resources, align prod ConfigMap naming, default production
image registry to gitea, and install Helm release core-hub rev 1 (smoke passed).
Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login
requirement now that OpenBao is unsealed.
This commit is contained in:
tegwick 2026-07-10 21:47:14 +02:00
parent 871c56692b
commit e9ee577d03
9 changed files with 101 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

21
Makefile
View file

@ -63,7 +63,7 @@ CORE_HUB_CHART ?= charts/core-hub
CORE_HUB_VALUES ?= helm/core-hub-values.yaml
CORE_HUB_STAGING_NAMESPACE ?= core-hub-staging
CORE_HUB_STAGING_VALUES ?= helm/core-hub-staging-values.yaml
CORE_HUB_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/core-hub
CORE_HUB_IMAGE_REPOSITORY ?= gitea.coulomb.social/coulomb/core-hub
CORE_HUB_IMAGE_TAG ?=
CORE_HUB_BASE_URL ?= https://hub.coulomb.social
CORE_HUB_KUBECONFIG ?= $(PRODUCTION_KUBECONFIG)
@ -141,7 +141,19 @@ cnpg-backup-status: check-production-kubeconfig ## Report CNPG backup spec and S
apps-pg-backup-dry-run: check-production-kubeconfig ## Logical pg_dump + age encrypt for vergabe_db (no upload)
chmod +x tools/apps-pg-backup-dry-run.sh
KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" tools/apps-pg-backup-dry-run.sh
KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" RAILIANCE_BACKUP_DRY_RUN=1 \
tools/apps-pg-backup-dry-run.sh
apps-pg-backup: check-production-kubeconfig ## Logical pg_dump + age encrypt + Nextcloud upload for vergabe_db
chmod +x tools/apps-pg-backup-dry-run.sh
@KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" bao kv metadata get \
platform/workloads/railiance/backup/offsite-lane >/dev/null 2>&1 || { \
echo "ERROR: OpenBao backup-lane auth missing." >&2; \
echo "Run: bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read" >&2; \
exit 1; \
}
KUBECONFIG="$(PRODUCTION_KUBECONFIG)" PLATFORM_REPO="$(PLATFORM_REPO)" RAILIANCE_BACKUP_DRY_RUN=0 \
tools/apps-pg-backup-dry-run.sh
##@ Vergabe Teilnahme
@ -222,6 +234,11 @@ inter-hub-logs: check-railiance01-kubeconfig ## Tail inter-hub app logs from Rai
##@ Core Hub
core-hub-helm-adopt: check-production-kubeconfig ## Annotate live Core Hub resources for Helm ownership
chmod +x tools/core-hub-helm-adopt.sh
KUBECONFIG="$(CORE_HUB_KUBECONFIG)" CORE_HUB_NAMESPACE="$(CORE_HUB_NAMESPACE)" CORE_HUB_RELEASE="$(CORE_HUB_RELEASE)" \
tools/core-hub-helm-adopt.sh
core-hub-render-baseline: ## Render checked-in core-hub values for chart validation only
helm template $(CORE_HUB_RELEASE) $(CORE_HUB_CHART) \
--namespace $(CORE_HUB_NAMESPACE) \