tegwick
5a0f4cb5c8
Registers the repo with State Hub (agents / practice, prefix RCP-WP) and fills in the rapp shape. declarations/rapp.yaml declares a manifest-managed platform service owned by canned-prompts, bound to rail-kubernetes and reef-railiance, with rollout, smoke and rollback contracts. The image pin says `pending-publication` rather than carrying a placeholder digest. The image builds and was verified locally (canned-prompts CANP-WP-0006-T06) but has never been pushed, so no registry digest exists. A placeholder shaped like a real digest would be worse than a sentinel: it could be mistaken for something deployable. manifests/ follows the rapp-sbom-nexus shape: namespace labelled for the postgres client, external secrets from OpenBao, a migration Job, and the runtime Deployment with a ClusterIP-only Service, dedicated ServiceAccount and default-deny plus runtime NetworkPolicies. Three choices worth stating. Credentials arrive as mounted files, never env vars — an env var holding a password is visible in kubectl describe, in crash dumps, and to anything that can read /proc. Migrations run as a Job rather than at start-up, so a schema rollback stays separate from a code rollback and replicas do not race. Liveness points at /healthz, which checks only that the process is up: pointing it at a database-dependent path would restart every replica during a database blip. Egress is PostgreSQL and DNS only. A package arrives by publish; the registry never reaches out, so it is given no path to. tools/smoke.sh checks what only the cluster can answer and calls canned-prompts' service/tools/smoke.py for health and migration head, rather than holding a second opinion about whether the service is healthy. RCP-WP-0002 carries the two operator actions that block a first rollout — publishing the image and provisioning database roles — and records per-publisher identity as a decision belonging upstream, which this repo must not paper over with cluster configuration implying finer control than exists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
90 lines
2.6 KiB
YAML
90 lines
2.6 KiB
YAML
# Two credentials, deliberately. The runtime role can read and write rows; the
|
|
# migration role owns the schema. A service that can ALTER its own tables at
|
|
# runtime turns any code defect into a schema defect.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-canned-prompts-database
|
|
labels:
|
|
app.kubernetes.io/name: canned-prompts
|
|
railiance-platform/component: external-secrets
|
|
spec:
|
|
conditions:
|
|
- namespaces:
|
|
- canned-prompts
|
|
provider:
|
|
vault:
|
|
server: http://openbao.openbao.svc:8200
|
|
path: database
|
|
version: v1
|
|
auth:
|
|
tokenSecretRef:
|
|
name: openbao-canned-prompts-eso-token
|
|
namespace: external-secrets
|
|
key: token
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: canned-prompts-postgres-runtime
|
|
namespace: canned-prompts
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-canned-prompts-database
|
|
target:
|
|
name: canned-prompts-postgres-runtime
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
url: >-
|
|
postgresql+psycopg://{{ .username | urlquery }}:{{ .password | urlquery }}@platform-pg-2-rw.databases.svc.cluster.local:5432/canned_prompts?sslmode=require
|
|
dataFrom:
|
|
- extract:
|
|
key: creds/canned-prompts-runtime
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: canned-prompts-postgres-migration
|
|
namespace: canned-prompts
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-canned-prompts-database
|
|
target:
|
|
name: canned-prompts-postgres-migration
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
url: >-
|
|
postgresql+psycopg://{{ .username | urlquery }}:{{ .password | urlquery }}@platform-pg-2-rw.databases.svc.cluster.local:5432/canned_prompts?sslmode=require
|
|
dataFrom:
|
|
- extract:
|
|
key: creds/canned-prompts-migration
|
|
---
|
|
# The publish token. Absent, the service is read-only — which is the correct
|
|
# posture until per-publisher identity exists (canned-prompts service/auth.py).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: canned-prompts-publish-token
|
|
namespace: canned-prompts
|
|
spec:
|
|
refreshInterval: 15m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-canned-prompts-database
|
|
target:
|
|
name: canned-prompts-publish-token
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
dataFrom:
|
|
- extract:
|
|
key: creds/canned-prompts-publish
|