coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(security): record verified annotation guard and approved orphan cleanup
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
This commit is contained in:
codex 2026-09-28 18:14:34 +02:00
parent db51ec8028
commit 48a0fca631
1 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
argocd/platform-addons/secret-annotation-guard/README.md
View file

@ -45,10 +45,11 @@ existing data templates and remote references. Do not waive ESO from the policy
or upgrade the controller as a shortcut. Rerun cleanup, native admission tests
and an ESO refresh integration test, then include the binding and update the pin.
The absent `platform-pg-drill` namespace still has an orphan Secret `drill-minio`,
a Deployment referencing it, a PVC and Service. Metadata patch fails because the
namespace is absent. No orphan object was deleted or namespace recreated. Its
disposition stays in CUST-WP-0073-T03; do not report cluster-wide cleanup complete.
An orphan Secret `platform-pg-drill/drill-minio` initially blocked complete
cleanup because its namespace was absent. The founder subsequently approved
deleting only that Secret. UID-bound deletion and absence were verified; the
bound 3 GiB PVC was unchanged. No other resources or namespace were changed.
Receipt: the-custodian/docs/evidence/2026-09-28-orphan-secret-deletion.json.
Source for the diagnosed behavior:
https://github.com/external-secrets/external-secrets/blob/v0.16.1/pkg/controllers/externalsecret/externalsecret_controller_template.go
@ -73,3 +74,12 @@ rotated by the metadata maintenance. ESO uses its normal credential refresh path
Detailed preflight, publication and before/after integration receipts live in
`the-custodian/docs/evidence/2026-09-28-eso-*.json`. The earlier rollout failure
and rescue remain recorded; remediation does not count as unchanged success.
## Verified completion
The binding is active at source `7daf7e9`, application declaration `db51ec8`.
Argo reports Synced/Healthy. All nine native admission checks pass and all 39
ExternalSecrets completed fresh successful refreshes under Deny. All 257 Secrets
in existing namespaces passed the forbidden-annotation scan. The one orphan
exception was subsequently resolved as above. CUST-WP-0073-T03 is complete;
agent-runtime isolation and deferred credential rotation are separate tasks.