coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(security): record verified annotation guard and approved orphan cleanup
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
This commit is contained in:
codex 2026-09-28 18:14:34 +02:00
parent db51ec8028
commit 48a0fca631
1 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
argocd/platform-addons/secret-annotation-guard/README.md
View file

@ -45,10 +45,11 @@ existing data templates and remote references. Do not waive ESO from the policy
or upgrade the controller as a shortcut. Rerun cleanup, native admission tests or upgrade the controller as a shortcut. Rerun cleanup, native admission tests
and an ESO refresh integration test, then include the binding and update the pin. and an ESO refresh integration test, then include the binding and update the pin.
The absent `platform-pg-drill` namespace still has an orphan Secret `drill-minio`, An orphan Secret `platform-pg-drill/drill-minio` initially blocked complete
a Deployment referencing it, a PVC and Service. Metadata patch fails because the cleanup because its namespace was absent. The founder subsequently approved
namespace is absent. No orphan object was deleted or namespace recreated. Its deleting only that Secret. UID-bound deletion and absence were verified; the
disposition stays in CUST-WP-0073-T03; do not report cluster-wide cleanup complete. bound 3 GiB PVC was unchanged. No other resources or namespace were changed.
Receipt: the-custodian/docs/evidence/2026-09-28-orphan-secret-deletion.json.
Source for the diagnosed behavior: Source for the diagnosed behavior:
https://github.com/external-secrets/external-secrets/blob/v0.16.1/pkg/controllers/externalsecret/externalsecret_controller_template.go https://github.com/external-secrets/external-secrets/blob/v0.16.1/pkg/controllers/externalsecret/externalsecret_controller_template.go
@ -73,3 +74,12 @@ rotated by the metadata maintenance. ESO uses its normal credential refresh path
Detailed preflight, publication and before/after integration receipts live in Detailed preflight, publication and before/after integration receipts live in
`the-custodian/docs/evidence/2026-09-28-eso-*.json`. The earlier rollout failure `the-custodian/docs/evidence/2026-09-28-eso-*.json`. The earlier rollout failure
and rescue remain recorded; remediation does not count as unchanged success. and rescue remain recorded; remediation does not count as unchanged success.
## Verified completion
The binding is active at source `7daf7e9`, application declaration `db51ec8`.
Argo reports Synced/Healthy. All nine native admission checks pass and all 39
ExternalSecrets completed fresh successful refreshes under Deny. All 257 Secrets
in existing namespaces passed the forbidden-annotation scan. The one orphan
exception was subsequently resolved as above. CUST-WP-0073-T03 is complete;
agent-runtime isolation and deferred credential rotation are separate tasks.