coulomb/state-hub
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
state-hub/deploy/railiance
History
tegwick 470ece82ed
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Multi-Context Image / build-and-push (push) Successful in 27s
Details
feat(forge): resolve an optional forge read credential (STATE-WP-0084-T02/T03) 
Nine repositories are invisible to derivation because central may not read
them. This adds the consuming half of the credential lane MASON-WP-0003 built.

The cluster has no agent injector and no secrets-store CSI driver, so the pod
authenticates to OpenBao with a projected ServiceAccount token (audience
`openbao`, not the API server) and reads the KV path itself. `forgeRead.*`
carries coordinates only; no credential is a chart value, an image layer, or a
Kubernetes Secret.

The credential reaches git through GIT_CONFIG_* setting http.extraHeader, not
through `-c` and not through userinfo in the clone URL — both of those put the
token in the process listing. It is redacted from ForgeDeriveError, which is
logged, stored in reset outcomes, and returned over the API.

Absent stays a supported state: with no credential, or with OpenBao
unreachable, resolution returns None and public derivation runs unchanged.
Raising would turn "nine repositories are unreadable" into "the pass failed",
which is what T01 exists to prevent.

Chart default is disabled. 717 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-27 23:12:57 +02:00
..
apps feat(forge): resolve an optional forge read credential (STATE-WP-0084-T02/T03) 2026-08-27 23:12:57 +02:00
platform feat(statehub): deploy empty railiance state hub 2026-06-25 15:39:53 +02:00
README.md Migrate state-hub image and clone refs to Forgejo (RAIL-HO-WP-0006) 2026-07-09 11:59:08 +02:00

README.md

State Hub Railiance Deployment Handoff

This directory contains the State Hub deployment handoff for CUST-WP-0011. It is source-owned by state-hub and split along the Railiance ownership boundaries used for the actual cluster rollout.

Ownership

  • deploy/railiance/platform/ is the railiance-platform handoff for the state-hub-db CloudNativePG cluster, database bootstrap credential, and database NetworkPolicies in the databases namespace.
  • deploy/railiance/apps/ is the railiance-apps handoff for the State Hub API Helm chart, non-secret production values, and app namespace runtime Secret template.
  • Runtime secret values are not stored here. Replace placeholder passwords only in an operator-controlled file, then encrypt or deliver through the approved platform secret path.

Image

The current image is pinned to:

forgejo.coulomb.social/coulomb/state-hub:f2e042a

railiance01 has already pulled this tag with crictl, and the image serves GET /state/health against the local WSL database in smoke testing.

Render And Dry-Run

Render the app chart without touching the cluster:

make railiance-state-hub-render

Run client-side Kubernetes validation for the platform manifests, app Secret template, and rendered chart:

make railiance-state-hub-client-dry-run

Run server-side dry-run against the configured representative cluster:

KUBECONFIG=~/.kube/config-hosteurope make railiance-state-hub-server-dry-run

Server-side dry-run requires the CNPG CRDs, namespace permissions, and dry-run permission for resources in databases and state-hub. Before the state-hub namespace exists, Kubernetes cannot server-dry-run namespaced app objects into that namespace because dry-run Namespace creation is not persisted. The Make target therefore server-validates the platform and Namespace manifests, then falls back to client dry-run for namespaced app manifests with an explicit notice.

Promotion Notes

Platform promotion into railiance-platform:

  • copy platform/state-hub-db-credentials.sops.yaml.template to a real SOPS secret file with an operator-generated password;
  • apply or GitOps-manage platform/state-hub-db-cluster.yaml;
  • apply or GitOps-manage platform/state-hub-db-networkpolicies.yaml.

App promotion into railiance-apps:

  • copy apps/charts/state-hub/ to charts/state-hub/;
  • copy apps/helm/state-hub-values.yaml to helm/state-hub-values.yaml;
  • apply or GitOps-manage apps/manifests/state-hub-namespace.yaml;
  • create state-hub-env in the state-hub namespace from the approved secret-delivery path;
  • deploy with Helm using the production values file, which sets namespace.create=false, only after state-hub-db is healthy.

Runtime Secret Contract

The app chart expects a Kubernetes Secret named state-hub-env in the state-hub namespace with at least:

DATABASE_URL=postgresql+asyncpg://state_hub:<url-encoded-password>@state-hub-db-rw.databases.svc.cluster.local:5432/state_hub

Optional runtime settings such as CORS_ORIGINS can live in the chart ConfigMap. The default chart keeps public ingress disabled; access should use the existing private tunnel/ops-bridge path until a separate exposure decision is recorded.