From 706f6c70fe831df7a997c8846452192898f61b54 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 8 Jul 2026 00:01:22 +0200 Subject: [PATCH] Document OpenBao-delivered runtime secrets for reuse-surface on K8s Note REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET and CCR-2026-0005 ExternalSecret delivery in the deploy guide. --- docs/deploy/reuse-kubernetes.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/deploy/reuse-kubernetes.md b/docs/deploy/reuse-kubernetes.md index 158001c..e92221b 100644 --- a/docs/deploy/reuse-kubernetes.md +++ b/docs/deploy/reuse-kubernetes.md @@ -16,11 +16,15 @@ docker push gitea.coulomb.social/coulomb/reuse-surface: | Variable | Purpose | |---|---| | `REUSE_SURFACE_TOKEN` | Bearer token for write API | +| `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` | HMAC for `POST /v1/webhooks/forgejo` | | `REUSE_SURFACE_DB` | SQLite path (default `/data/reuse.db`) | | `REUSE_SURFACE_CACHE_DIR` | Remote index cache (default `/data/cache`) | -Mount a PVC at `/data` for persistence. Inject secrets via Kubernetes Secret -`reuse-surface-env`. +Mount a PVC at `/data` for persistence. Production injects secrets via +`ExternalSecret reuse-surface-runtime` → Kubernetes Secret `reuse-surface-env` +(OpenBao path `platform/workloads/reuse/reuse-surface/runtime-secrets`, +CCR-2026-0005). Operator runbook: `railiance-apps/docs/reuse-surface-on-railiance01.md`; +rotation: `railiance-platform/docs/reuse-surface-runtime-secrets-rotation-runbook.md`. ## Probes