Document recovered ESO lanes and recognize explicit invalid-token responses
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 18:51:40 +02:00
parent 153223983f
commit 3759850cc4
6 changed files with 78 additions and 8 deletions

View file

@ -196,15 +196,18 @@ The GitOps contract uses:
`ClusterSecretStore/openbao` is limited to the `issue-core` namespace on
coulombcore.
**Railiance01 interim stores** (read coulombcore OpenBao at
`https://bao.coulomb.social` until Wave 7) are **not** managed by coulombcore
ArgoCD. Apply per workload:
**Railiance01 stores** use the private railiance01 OpenBao service and are
**not** managed by coulombcore ArgoCD. Apply per workload:
| Store | Bootstrap |
| --- | --- |
| `openbao-forgejo` | `railiance-apps` `make forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy` |
| `openbao-forgejo` | Dedicated Kubernetes auth; `docs/eso-auth-recovery.md` |
| `openbao-activity-core` | `activity-core` `make openbao-eso-token-apply` + `kubectl apply -f …/openbao-activity-core.clustersecretstore.yaml` |
| `openbao-reuse` | `railiance-apps` `make reuse-openbao-eso-token-apply reuse-openbao-store-deploy` |
| `openbao-reuse` | Dedicated Kubernetes auth; `docs/eso-auth-recovery.md` |
| `openbao-target-revenue` | Dedicated Kubernetes auth; `docs/eso-auth-recovery.md` |
The three recovered stores no longer use the old `*-eso-token-apply` bootstrap
targets. Do not recreate static delivery tokens for them.
Manifests live under `argocd/platform-addons/openbao-secretstore/` but are
excluded from the coulombcore kustomization. Broaden or add stores only with