coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix openbao-secretstore ArgoCD health: coulombcore scope only
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Remove interim ClusterSecretStores (forgejo, activity-core, reuse) from
coulombcore ArgoCD kustomization. Those stores target railiance01 namespaces
and are bootstrapped via railiance-apps/activity-core Make targets.
This commit is contained in:
tegwick 2026-07-08 15:41:04 +02:00
parent 6076d57218
commit 6abf6b56a0
2 changed files with 23 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
argocd/platform-addons/openbao-secretstore/kustomization.yaml
View file

@ -1,8 +1,10 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
# Coulombcore ArgoCD scope: in-cluster OpenBao only (issue-core Kubernetes auth).
# Interim cross-cluster stores (openbao-forgejo, openbao-activity-core, openbao-reuse)
# target railiance01 namespaces — deploy via railiance-apps / activity-core Make
# targets, not this kustomization. See docs/argocd-gitops.md § Platform add-ons.
resources: resources:
- openbao.clustersecretstore.yaml - openbao.clustersecretstore.yaml
- openbao-activity-core.clustersecretstore.yaml
- openbao-forgejo.clustersecretstore.yaml
- openbao-reuse.clustersecretstore.yaml

26
docs/argocd-gitops.md
View file

@ -188,17 +188,27 @@ The GitOps contract uses:
- `railiance-platform-addons` AppProject for cluster add-ons. - `railiance-platform-addons` AppProject for cluster add-ons.
- `external-secrets` ArgoCD Application for the public Helm chart. - `external-secrets` ArgoCD Application for the public Helm chart.
- `openbao-secretstore` ArgoCD Application for the OpenBao - `openbao-secretstore` ArgoCD Application for the in-cluster OpenBao
`ClusterSecretStore`. `ClusterSecretStore` on coulombcore (`openbao` only).
- OpenBao Kubernetes auth role `external-secrets-issue-core` for the - OpenBao Kubernetes auth role `external-secrets-issue-core` for the
issue-core pilot. issue-core pilot.
- OpenBao Kubernetes auth role `external-secrets-activity-core` for the
activity-core/llm-connect provider-secret lane once approved.
`ClusterSecretStore/openbao` is limited to the `issue-core` namespace. `ClusterSecretStore/openbao` is limited to the `issue-core` namespace on
`ClusterSecretStore/openbao-activity-core` is limited to the `activity-core` coulombcore.
namespace and is intended for the llm-connect provider-secret lane. Broaden or
add stores only with platform review. **Railiance01 interim stores** (read coulombcore OpenBao at
`https://bao.coulomb.social` until Wave 7) are **not** managed by coulombcore
ArgoCD. Apply per workload:
| Store | Bootstrap |
| --- | --- |
| `openbao-forgejo` | `railiance-apps` `make forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy` |
| `openbao-activity-core` | `activity-core` `make openbao-eso-token-apply` + `kubectl apply -f …/openbao-activity-core.clustersecretstore.yaml` |
| `openbao-reuse` | `railiance-apps` `make reuse-openbao-eso-token-apply reuse-openbao-store-deploy` |
Manifests live under `argocd/platform-addons/openbao-secretstore/` but are
excluded from the coulombcore kustomization. Broaden or add stores only with
platform review.
Configure the OpenBao side without printing token values: Configure the OpenBao side without printing token values: