coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0046-T04 done: renewer adopted, first run renewed all five lanes
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Earliest old-token expiry is canned-prompts (~2026-10-10), not 10-25.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-24 00:38:59 +02:00
parent 8d878cc4c2
commit 1918128f8e
2 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/RPF-WP-0046-eso-database-token-renewal.md
View file

@ -111,7 +111,7 @@ ExternalSecrets are `SecretSynced`.
```task
id: RPF-WP-0046-T04
status: wait
status: done
priority: high
state_hub_task_id: "28726b1b-3777-5945-859b-9e563b12fee6"
```
@ -133,6 +133,14 @@ T04 progress, 2026-09-23 (founder go-ahead):
`argocd/railiance01/applications/` and pinned to `b2ebe10`. The root has no
automated sync, so nothing changes until the manual root sync.
T04 done, 2026-09-24. The founder applied the AppProject and hand-synced the
root (`8d878cc`) and `eso-token-renewer` (`b2ebe10`). The app is
Synced/Healthy. A first manual Job completed in 9 seconds, and all five lanes
returned `ok: true`. The tokens are still pre-T03, so their TTLs cannot be
extended. **The earliest expiry is canned-prompts, about 2026-10-10**, not
2026-10-25. Then audit-core, about 2026-10-17. Evidence:
`docs/evidence/2026-09-24-eso-token-renewer-first-run.json`.
## T05 Move consumers off leases from the old tokens before 2026-10-25
```task
@ -147,7 +155,7 @@ revoke their leases when they do. ESO refreshes every 5 minutes, so within
minutes of T03 each target Secret holds credentials from the new token. The
mounted files update, but a process that reads its password only at startup
keeps the old one. core-hub runs a credential watcher. Restart the others once
after T03, at least 10 minutes later and well before 2026-10-25:
after T03, at least 10 minutes later and well before the earliest old-token expiry (canned-prompts, about 2026-10-10):
`audit-core/audit-core`, `canned-prompts/canned-prompts`,
`sbom-nexus/sbom-nexus`, `tenant-engine/tenant-engine`. Check readiness after
each restart. Then confirm that core-hub-api and core-hub-api-candidate stay