tegwick
a689270f18
Document OpenBao/warden paths for the offsite backup lane and flag the sealed Vault blocker. Point production Makefile targets at CoulombCore, auto-discover CNPG clusters in backup status, add apps-pg pg_dump dry-run tooling, and record Core Hub Helm cutover findings (live gitea image, adopt required).
99 lines
No EOL
3.1 KiB
Markdown
99 lines
No EOL
3.1 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0014
|
|
type: workplan
|
|
title: "Core Hub Helm cutover and vergabe-teilnahme image refresh"
|
|
domain: financials
|
|
repo: railiance-apps
|
|
status: active
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-10"
|
|
updated: "2026-07-10"
|
|
state_hub_workstream_id: "780c8d1d-ea75-479e-9733-10b518dde242"
|
|
---
|
|
|
|
# Core Hub Helm cutover and vergabe-teilnahme image refresh
|
|
|
|
Follow-up to `RAILIANCE-WP-0012` and custodian inbox `3ced85c7`. The S5 Helm
|
|
chart, values, Makefile targets, and runbook exist; the live cluster may still
|
|
run Core Hub from `core-hub/k8s/railiance-production/` manifests.
|
|
|
|
Separately, the 2026-07-10 delivery-lane snapshot shows `vergabe-teilnahme`
|
|
deployed at `f95de14` while the source repo head is `1061f3e` (14-commit drift).
|
|
|
|
Production-touching deploy steps require explicit image tags and operator
|
|
approval. Do not store secrets in workplans.
|
|
|
|
## Core Hub server dry-run on CoulombCore
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0014-T01
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "b9dea9f3-f0c0-41c1-b9c4-ec4c44d43d55"
|
|
```
|
|
|
|
Production on CoulombCore (`PRODUCTION_KUBECONFIG=~/.kube/config`). Live image:
|
|
`gitea.coulomb.social/coulomb/core-hub:a33191a`. `core-hub-prod-env` exists.
|
|
`core-hub-server-dry-run` blocked: existing Service/Deployment lack Helm ownership
|
|
metadata — needs adopt/patch before `helm upgrade --install`.
|
|
|
|
## Adopt Helm-managed Core Hub release
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0014-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "0e591104-0123-4e4a-84ff-5deb435e8441"
|
|
```
|
|
|
|
Run `core-hub-migrate` then `core-hub-deploy` with an explicit
|
|
`CORE_HUB_IMAGE_TAG`. Confirm the Helm release owns `core-hub-api`, runtime
|
|
ConfigMap, and Service in namespace `core-hub`. Retire duplicate resources from
|
|
the service-repo `k8s/railiance-production/` apply path once stable.
|
|
|
|
Blocked on: `RAILIANCE-WP-0014-T01`.
|
|
|
|
## Verify Core Hub post-cutover smoke
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0014-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "eca3ce8b-68a8-44d0-90c7-2cdefa482200"
|
|
```
|
|
|
|
Run `make core-hub-status`, `make core-hub-smoke`, and `make core-hub-release-info`.
|
|
Ingress for `hub.coulomb.social` must remain healthy. Document rollback steps in
|
|
`docs/core-hub-on-railiance01.md` if Helm values drift from prior manifests.
|
|
|
|
Blocked on: `RAILIANCE-WP-0014-T02`.
|
|
|
|
## Refresh vergabe-teilnahme production image
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0014-T04
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "d547f68d-52ec-4ff1-952b-ec70c834e0d3"
|
|
```
|
|
|
|
Identify the current published image tag for `vergabe-teilnahme` in the Forgejo
|
|
registry, verify the manifest with `tools/check-oci-image.sh`, run
|
|
`vergabe-dry-run` and `vergabe-server-dry-run` if available, then deploy with an
|
|
explicit tag. Close the 14-commit drift noted in the delivery-lane evidence.
|
|
|
|
## Post-deploy vergabe smoke and runbook evidence
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0014-T05
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "4eaaa345-4252-46c1-bd8a-49d654ec48f4"
|
|
```
|
|
|
|
After deploy, run `make vergabe-status`, migrations if required, and HTTPS smoke
|
|
against `vergabe-teilnahme.whywhynot.de`. Update `docs/vergabe-teilnahme.md`
|
|
with the deployed tag, date, and smoke result (non-secret).
|
|
|
|
Blocked on: `RAILIANCE-WP-0014-T04`. |