coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0046-T03/T05 done: periodic ESO DB tokens live, consumers restarted
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-24 00:42:35 +02:00
parent 2ee3cac0ef
commit 29ad9d7838
2 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/evidence/2026-09-23-eso-db-token-periodic.status Normal file
View file

@ -0,0 +1,22 @@
BAO_ADDR=http://127.0.0.1:18200 remote=railiance01 period=168h lanes=audit-core canned-prompts core-hub sbom-nexus tenant-engine
renewable=True period=604800 policies=default,external-secrets-audit-core orphan=True
audit-core: minted periodic and verified
audit-core: secret openbao-audit-core-eso-token applied
audit-core: annotation check clean
renewable=True period=604800 policies=default,external-secrets-canned-prompts-database orphan=True
canned-prompts: minted periodic and verified
canned-prompts: secret openbao-canned-prompts-eso-token applied
canned-prompts: annotation check clean
renewable=True period=604800 policies=default,external-secrets-core-hub-database orphan=True
core-hub: minted periodic and verified
core-hub: secret openbao-core-hub-eso-token applied
core-hub: annotation check clean
renewable=True period=604800 policies=default,external-secrets-sbom-nexus-database orphan=True
sbom-nexus: minted periodic and verified
sbom-nexus: secret openbao-sbom-nexus-eso-token applied
sbom-nexus: annotation check clean
renewable=True period=604800 policies=credential-broker-tenant-engine-migration,credential-broker-tenant-engine-runtime,default orphan=True
tenant-engine: minted periodic and verified
tenant-engine: secret openbao-tenant-engine-eso-token applied
tenant-engine: annotation check clean
exit 0

20
workplans/RPF-WP-0046-eso-database-token-renewal.md
View file

@ -88,7 +88,7 @@ parity with the CronJob mounts is tested.
```task ```task
id: RPF-WP-0046-T03 id: RPF-WP-0046-T03
status: wait status: done
priority: high priority: high
state_hub_task_id: "211bc548-34af-5f3a-ab2c-bf29d33f97ad" state_hub_task_id: "211bc548-34af-5f3a-ab2c-bf29d33f97ad"
``` ```
@ -145,7 +145,7 @@ extended. **The earliest expiry is canned-prompts, about 2026-10-10**, not
```task ```task
id: RPF-WP-0046-T05 id: RPF-WP-0046-T05
status: wait status: done
priority: high priority: high
state_hub_task_id: "acf49bee-e40a-533c-b1f0-4152c989211d" state_hub_task_id: "acf49bee-e40a-533c-b1f0-4152c989211d"
``` ```
@ -194,3 +194,19 @@ state_hub_task_id: "2f528e56-ebf0-547e-8d4f-3cb34c348d46"
- **Rollback.** Suspend the CronJob, or delete the Application with prune. - **Rollback.** Suspend the CronJob, or delete the Application with prune.
Re-minting 768h tokens with rapp-postgres `apply-eso-token-attended.sh` Re-minting 768h tokens with rapp-postgres `apply-eso-token-attended.sh`
restores today's state. restores today's state.
## Execution record — 2026-09-23 (founder go-ahead)
- **T03 done.** Attended periodic re-mint at about 22:40Z. For all five lanes:
`renewable=True`, `period=604800`, policies unchanged, `orphan=True`, and
each Secret was applied clean (no last-applied annotation). The script
exited 0. Trace: `docs/evidence/2026-09-23-eso-db-token-periodic.status`.
After a forced refresh, all six stores are `Valid` and 13 ExternalSecrets
synced at 22:40:51–55Z. A second renewer Job returned `ttl: 604800` for
every lane.
- **T05 done.** Rolling restarts, one at a time, all rolled out and 1/1 Ready:
canned-prompts, audit-core, sbom-nexus, tenant-engine. core-hub-api and
core-hub-api-candidate stayed 1/1 without a restart (credential watcher).
State Hub `/repos` returns 200. No workload now depends on a lease from the
replaced max-TTL tokens. Those tokens expire on their own, from about
2026-10-10.