tegwick
4d5af7698d
RCP-WP-0002 T02-T04 done, readiness_state verified with evidence attached rather than ahead of it. rapp-postgres provisioned canned_prompts on platform-pg-2 and sent a database-owner receipt with 12 checks proven live. creds/canned-prompts-publish was deliberately not issued, so the service runs read-only and POST /packages returns 503 explaining why — the intended posture, not a gap. Four defects surfaced that only a real rollout could expose, two of them silent: - SET ROLE opened an implicit transaction that Alembic nested inside rather than owning, so every revision logged as applied and was rolled back. Alembic reported success against an empty database. - The egress NetworkPolicy selected app.kubernetes.io/name, which the migration Job does not carry. The Job matched only the default-deny and succeeded exactly once, because it ran before the policies existed; the next migration would have failed on DNS. Now selects part-of, with ingress split into its own policy so the Job is never reachable. - env.py read database_url rather than resolved_database_url, so the migration could never run where the credential is a mounted file. - live-image-digest-match extracted the pin with a line-offset grep, which returned empty once comments were added above `version:`. The check degraded to reporting "not pinned yet" while a digest was pinned — it could not have passed for any pin. Now parsed as YAML. A verification step that cannot fail is worth less than none, because it is trusted. Evidence: docs/evidence/RCP-WP-0002-T04-first-deployment-2026-09-08.md Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
87 lines
2.9 KiB
YAML
87 lines
2.9 KiB
YAML
# Two credentials, deliberately. The runtime role can read and write rows; the
|
|
# migration role owns the schema. A service that can ALTER its own tables at
|
|
# runtime turns any code defect into a schema defect.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-canned-prompts-database
|
|
labels:
|
|
app.kubernetes.io/name: canned-prompts
|
|
railiance-platform/component: external-secrets
|
|
spec:
|
|
conditions:
|
|
- namespaces:
|
|
- canned-prompts
|
|
provider:
|
|
vault:
|
|
server: http://openbao.openbao.svc:8200
|
|
path: database
|
|
version: v1
|
|
auth:
|
|
tokenSecretRef:
|
|
name: openbao-canned-prompts-eso-token
|
|
namespace: external-secrets
|
|
key: token
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: canned-prompts-postgres-runtime
|
|
namespace: canned-prompts
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-canned-prompts-database
|
|
target:
|
|
name: canned-prompts-postgres-runtime
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
url: >-
|
|
postgresql+psycopg://{{ .username | urlquery }}:{{ .password | urlquery }}@platform-pg-2-rw.databases.svc.cluster.local:5432/canned_prompts?sslmode=require
|
|
dataFrom:
|
|
- extract:
|
|
key: creds/canned-prompts-runtime
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: canned-prompts-postgres-migration
|
|
namespace: canned-prompts
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-canned-prompts-database
|
|
target:
|
|
name: canned-prompts-postgres-migration
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
url: >-
|
|
postgresql+psycopg://{{ .username | urlquery }}:{{ .password | urlquery }}@platform-pg-2-rw.databases.svc.cluster.local:5432/canned_prompts?sslmode=require
|
|
dataFrom:
|
|
- extract:
|
|
key: creds/canned-prompts-migration
|
|
---
|
|
# The publish token is deliberately NOT declared as an ExternalSecret.
|
|
#
|
|
# rapp-postgres confirmed on 2026-09-08 that `creds/canned-prompts-publish`
|
|
# does not exist and is not being created, at our request. An ExternalSecret
|
|
# pointing at it would sit permanently unresolved — indistinguishable from a
|
|
# broken deployment, and an invitation for the next operator to "fix" it by
|
|
# minting a credential nobody decided to issue.
|
|
#
|
|
# Without the secret the service runs READ-ONLY, which is the intended posture
|
|
# until per-publisher identity exists upstream (RCP-WP-0002-T05). The runtime
|
|
# Deployment mounts the secret `optional: true`, so it starts cleanly without it
|
|
# and picks the token up if one is ever added.
|
|
#
|
|
# To enable publishing later: have rapp-postgres issue
|
|
# `creds/canned-prompts-publish`, add the ExternalSecret here, and revisit the
|
|
# NetworkPolicy ingress rule, which currently admits any namespace.
|