From 1f8fbc7584b9bcac259e2bf5cf9d70e010dd1148 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 23 Oct 2026 17:42:39 +0200 Subject: [PATCH] Point bao-notice at the rapp-openbao copy of the page. The Application keeps a pinned revision and no automated sync. The cluster still serves the previous revision until that Application is synced by hand. Assistant: grok Assistant-Session: 01a16923-5dc2-7a33-94e9-834572d7bba0 --- .../platform-addons/bao-notice/default.conf | 35 ---- argocd/platform-addons/bao-notice/index.html | 19 -- .../bao-notice/kustomization.yaml | 18 -- .../platform-addons/bao-notice/manifests.yaml | 177 ------------------ .../applications/bao-notice.application.yaml | 8 +- ...-WP-0047-bao-coulomb-social-notice-page.md | 8 +- 6 files changed, 11 insertions(+), 254 deletions(-) delete mode 100644 argocd/platform-addons/bao-notice/default.conf delete mode 100644 argocd/platform-addons/bao-notice/index.html delete mode 100644 argocd/platform-addons/bao-notice/kustomization.yaml delete mode 100644 argocd/platform-addons/bao-notice/manifests.yaml diff --git a/argocd/platform-addons/bao-notice/default.conf b/argocd/platform-addons/bao-notice/default.conf deleted file mode 100644 index 7493c08..0000000 --- a/argocd/platform-addons/bao-notice/default.conf +++ /dev/null @@ -1,35 +0,0 @@ -# Static notice for bao.coulomb.social (RPF-WP-0047). Serves one page; proxies nothing. -server { - listen 8080; - server_name _; - server_tokens off; - root /usr/share/nginx/html; - - add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'" always; - add_header Strict-Transport-Security "max-age=31536000" always; - add_header X-Content-Type-Options "nosniff" always; - add_header Referrer-Policy "no-referrer" always; - add_header Cache-Control "no-store" always; - add_header X-Robots-Tag "noindex, nofollow" always; - - location = / { - try_files /index.html =404; - } - location = /robots.txt { - default_type text/plain; - return 200 "User-agent: *\nDisallow: /\n"; - } - location = /healthz { - access_log off; - default_type text/plain; - return 200 "ok\n"; - } - # Any other path (e.g. /v1/sys/health, /ui/) is 404 with the same notice, never 200. - location / { - error_page 404 /index.html; - return 404; - } - location = /index.html { - internal; - } -} diff --git a/argocd/platform-addons/bao-notice/index.html b/argocd/platform-addons/bao-notice/index.html deleted file mode 100644 index 6346724..0000000 --- a/argocd/platform-addons/bao-notice/index.html +++ /dev/null @@ -1,19 +0,0 @@ - - - - - - -Not publicly available - - - -

Not publicly available

-

This address belongs to an internal service that is not offered publicly.

-

There is nothing to sign in to here. If you were sent to this address, please contact the person who gave it to you.

- - diff --git a/argocd/platform-addons/bao-notice/kustomization.yaml b/argocd/platform-addons/bao-notice/kustomization.yaml deleted file mode 100644 index e454999..0000000 --- a/argocd/platform-addons/bao-notice/kustomization.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -# RPF-WP-0047. Read only by argocd/railiance01/applications/bao-notice.application.yaml. - -resources: - - manifests.yaml - -generatorOptions: - disableNameSuffixHash: false - -configMapGenerator: - - name: bao-notice-conf - namespace: bao-notice - files: [default.conf] - - name: bao-notice-html - namespace: bao-notice - files: [index.html] diff --git a/argocd/platform-addons/bao-notice/manifests.yaml b/argocd/platform-addons/bao-notice/manifests.yaml deleted file mode 100644 index 755857b..0000000 --- a/argocd/platform-addons/bao-notice/manifests.yaml +++ /dev/null @@ -1,177 +0,0 @@ -# RPF-WP-0047: static "not publicly available" notice for bao.coulomb.social. -# OpenBao stays non-public (RMASTER-WP-0020-T09). This namespace has no route -# to OpenBao: ingress only from Traefik, no egress at all. -apiVersion: v1 -kind: Namespace -metadata: - name: bao-notice - labels: - app.kubernetes.io/part-of: railiance-platform ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: bao-notice-isolation - namespace: bao-notice -spec: - podSelector: {} - policyTypes: [Ingress, Egress] - ingress: - - from: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: kube-system - podSelector: - matchLabels: - app.kubernetes.io/name: traefik - ports: - - {protocol: TCP, port: 8080} - egress: [] ---- -# cert-manager HTTP-01 solver pods run in this namespace on 8089 during -# issuance and renewal; Traefik must reach them or the challenge gets 502. -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: bao-notice-acme-solver - namespace: bao-notice -spec: - podSelector: - matchLabels: - acme.cert-manager.io/http01-solver: "true" - policyTypes: [Ingress] - ingress: - - from: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: kube-system - podSelector: - matchLabels: - app.kubernetes.io/name: traefik - ports: - - {protocol: TCP, port: 8089} ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: bao-notice - namespace: bao-notice - labels: - app.kubernetes.io/name: bao-notice -spec: - replicas: 1 - revisionHistoryLimit: 2 - selector: - matchLabels: - app.kubernetes.io/name: bao-notice - template: - metadata: - labels: - app.kubernetes.io/name: bao-notice - spec: - automountServiceAccountToken: false - enableServiceLinks: false - securityContext: - runAsNonRoot: true - runAsUser: 101 - runAsGroup: 101 - seccompProfile: - type: RuntimeDefault - containers: - - name: nginx - image: nginxinc/nginx-unprivileged@sha256:65e3e85dbaed8ba248841d9d58a899b6197106c23cb0ff1a132b7bfe0547e4c0 - ports: - - {name: http, containerPort: 8080} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: [ALL] - resources: - requests: {cpu: 5m, memory: 16Mi} - limits: {cpu: 100m, memory: 64Mi} - readinessProbe: - httpGet: {path: /healthz, port: http} - periodSeconds: 20 - livenessProbe: - httpGet: {path: /healthz, port: http} - periodSeconds: 60 - volumeMounts: - - {name: conf, mountPath: /etc/nginx/conf.d, readOnly: true} - - {name: html, mountPath: /usr/share/nginx/html, readOnly: true} - - {name: tmp, mountPath: /tmp} - volumes: - - name: conf - configMap: - name: bao-notice-conf - items: [{key: default.conf, path: default.conf}] - - name: html - configMap: - name: bao-notice-html - items: [{key: index.html, path: index.html}] - - name: tmp - emptyDir: {sizeLimit: 16Mi} ---- -apiVersion: v1 -kind: Service -metadata: - name: bao-notice - namespace: bao-notice -spec: - selector: - app.kubernetes.io/name: bao-notice - ports: - - {name: http, port: 80, targetPort: http} ---- -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: redirect-https - namespace: bao-notice -spec: - redirectScheme: - scheme: https - permanent: true ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: bao-notice - namespace: bao-notice - annotations: - cert-manager.io/cluster-issuer: letsencrypt-prod - traefik.ingress.kubernetes.io/router.entrypoints: websecure - traefik.ingress.kubernetes.io/router.tls: "true" -spec: - ingressClassName: traefik - tls: - - hosts: [bao.coulomb.social] - secretName: bao-notice-tls - rules: - - host: bao.coulomb.social - http: - paths: - - path: / - pathType: Prefix - backend: - service: {name: bao-notice, port: {number: 80}} ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: bao-notice-http-redirect - namespace: bao-notice - annotations: - traefik.ingress.kubernetes.io/router.entrypoints: web - traefik.ingress.kubernetes.io/router.middlewares: bao-notice-redirect-https@kubernetescrd - traefik.ingress.kubernetes.io/router.priority: "1" -spec: - ingressClassName: traefik - rules: - - host: bao.coulomb.social - http: - paths: - - path: / - pathType: Prefix - backend: - service: {name: bao-notice, port: {number: 80}} diff --git a/argocd/railiance01/applications/bao-notice.application.yaml b/argocd/railiance01/applications/bao-notice.application.yaml index 9436272..bdb0a22 100644 --- a/argocd/railiance01/applications/bao-notice.application.yaml +++ b/argocd/railiance01/applications/bao-notice.application.yaml @@ -1,6 +1,8 @@ # railiance01 child Application (RPF-WP-0047, founder request 2026-09-23 via # user-engine 7d8982c2). Static notice only; OpenBao stays non-public. # No automated sync, no finalizer; targetRevision is the reviewed commit. +# Manifests moved to rapp-openbao on 2026-10-23. This Application stays the +# GitOps attachment. Sync it by hand after that commit is on the remote. apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -14,9 +16,9 @@ metadata: spec: project: railiance-tenants source: - repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git - targetRevision: 9ee20967ca7b50a8926c99ae86fa027f8bfb0fa3 - path: argocd/platform-addons/bao-notice + repoURL: https://forgejo.coulomb.social/coulomb/rapp-openbao.git + targetRevision: a1f5851e8ad16df5689ef8c91273d77590863089 + path: manifests/bao-notice destination: server: https://kubernetes.default.svc namespace: bao-notice diff --git a/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md b/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md index d8240fa..35f01e8 100644 --- a/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md +++ b/workplans/RPF-WP-0047-bao-coulomb-social-notice-page.md @@ -8,7 +8,7 @@ status: finished owner: railiance-platform topic_slug: railiance created: "2026-09-24" -updated: "2026-09-24" +updated: "2026-10-23" related: [RPF-WP-0025, RMASTER-WP-0020] state_hub_workstream_id: "6ab44339-66d3-522b-9d34-fc9ff6f20d1b" --- @@ -34,7 +34,11 @@ priority: high state_hub_task_id: "caa019c6-dfdb-5f17-b860-67e1feaebd51" ``` -`argocd/platform-addons/bao-notice/` holds: +Moved on 2026-10-23 to `rapp-openbao` at `manifests/bao-notice/` (commit +`a1f5851`). This Application still attaches the page. It has not been synced, +so the cluster keeps rendering the copy from `9ee20967` until a hand sync. + +`argocd/platform-addons/bao-notice/` held, until that move: - A namespace `bao-notice` with a NetworkPolicy: ingress only from Traefik (kube-system) on 8080, no egress at all, so there is no path to OpenBao.