coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0014: Helm adopt and deploy Core Hub on CoulombCore; backup auth tooling
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 20s
Details

Browse source 
Adopt live Core Hub resources, align prod ConfigMap naming, default production
image registry to gitea, and install Helm release core-hub rev 1 (smoke passed).
Add apps-pg-backup and check-backup-lane-auth targets; document OIDC login
requirement now that OpenBao is unsealed.
This commit is contained in:
tegwick 2026-07-10 21:47:14 +02:00
parent 871c56692b
commit e9ee577d03
9 changed files with 101 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md
View file

@ -34,15 +34,14 @@ id: RAILIANCE-WP-0013-T01
status: progress
priority: high
needs_human: true
intervention_note: "OpenBao sealed at bao.coulomb.social — operator unseal + OIDC login (railiance-backup-workload-kv-read) required"
intervention_note: "OpenBao unsealed; OIDC login required in interactive shell (browser callback localhost:8250) before offsite-lane upload"
state_hub_task_id: "f2051213-0a9f-418e-82ad-9bd7c79fd0dc"
```
Credential routing in `docs/credential-routing-railiance-apps.md`. `warden access`
reaches the platform broker; KV fetch fails while OpenBao is sealed. Phase 1 lane:
`platform/workloads/railiance/backup/offsite-lane`. CoulombCore clusters:
`apps-pg`, `gitea-db`, `net-kingdom-pg`, `state-hub-db`. `make apps-pg-backup-dry-run`
succeeded (pg_dump + age encrypt; upload blocked on offsite-lane).
OpenBao unsealed (2026-07-10). Stale `~/.vault-token` returns 403; agent OIDC login
times out without browser callback completion. Operator command:
`bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read`.
Then `make apps-pg-backup` uploads via offsite-lane. Dry-run path proven.
## Wire apps-pg backup coverage

29
workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md
View file

@ -28,46 +28,39 @@ approval. Do not store secrets in workplans.
```task
id: RAILIANCE-WP-0014-T01
status: progress
status: done
priority: high
state_hub_task_id: "b9dea9f3-f0c0-41c1-b9c4-ec4c44d43d55"
```
Production on CoulombCore (`PRODUCTION_KUBECONFIG=~/.kube/config`). Live image:
`gitea.coulomb.social/coulomb/core-hub:a33191a`. `core-hub-prod-env` exists.
`core-hub-server-dry-run` blocked: existing Service/Deployment lack Helm ownership
metadata — needs adopt/patch before `helm upgrade --install`.
CoulombCore production cluster confirmed. `core-hub-server-dry-run` passed after
`make core-hub-helm-adopt` and configMap name alignment (`core-hub-prod-runtime`).
Live image `gitea.coulomb.social/coulomb/core-hub:a33191a` verified.
## Adopt Helm-managed Core Hub release
```task
id: RAILIANCE-WP-0014-T02
status: wait
status: done
priority: high
state_hub_task_id: "0e591104-0123-4e4a-84ff-5deb435e8441"
```
Run `core-hub-migrate` then `core-hub-deploy` with an explicit
`CORE_HUB_IMAGE_TAG`. Confirm the Helm release owns `core-hub-api`, runtime
ConfigMap, and Service in namespace `core-hub`. Retire duplicate resources from
the service-repo `k8s/railiance-production/` apply path once stable.
Blocked on: `RAILIANCE-WP-0014-T01`.
`CORE_HUB_IMAGE_TAG=a33191a make core-hub-deploy` installed Helm release
`core-hub` revision 1 on CoulombCore. Resources carry Helm ownership metadata.
Service-repo `k8s/railiance-production/` path is now superseded for operations.
## Verify Core Hub post-cutover smoke
```task
id: RAILIANCE-WP-0014-T03
status: wait
status: done
priority: high
state_hub_task_id: "eca3ce8b-68a8-44d0-90c7-2cdefa482200"
```
Run `make core-hub-status`, `make core-hub-smoke`, and `make core-hub-release-info`.
Ingress for `hub.coulomb.social` must remain healthy. Document rollback steps in
`docs/core-hub-on-railiance01.md` if Helm values drift from prior manifests.
Blocked on: `RAILIANCE-WP-0014-T02`.
Post-deploy `make core-hub-status` and `make core-hub-smoke` passed on
`https://hub.coulomb.social` after Helm rollout (2026-07-10).
## Refresh vergabe-teilnahme production image