Record verified Seaweed Terraform state bootstrap #48
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/Documentation!48
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/seaweed-state-readiness"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Record verified initial SeaweedFS Terraform state-bucket acceptance on 2026-10-15, while retaining separate recovery, full Terraform locking and application migration gates. Private Terraform run 62 passed scoped OpenBao/S3 authentication, private ACL/policy checks, versioning, default SSE-S3 AES256, encrypted/versioned probe readback and conditional-overwrite rejection for
homelab-terraform-state. The log does not establish whether the bucket was newly created or reconciled. Inspect run 64 then passed, and the owner reports saving both scoped state keys and installing the central runner’s plan/apply policies and JWT roles. This is configured authorization, still untested by a real plan/apply.Reconcile current storage, platform, delivery and decisions pages. Terraform PRs 11/12 are merged, and workflows v1.41.0 with the additional identity profile is published/promoted to
stable-v1. Workflows #106 prepares the RKE2 reusable-job event compatibility fix; it still needs review and publication before actual RKE2 claim capture. Workload identity plan/apply, full Terraform concurrency/recovery, Seaweed administrative-provider compatibility and Harbor dev resources remain pending. Public pages name private evidence/runbooks without private links or credential values.Validation at
76ad492:npm run check, defaultnpm run build, native staged Gitleaks 8.30.1 and diff checks passed. Fresh hosted source-security/site checks remain required before merge; scan names and gates are unchanged. This documentation update performs no storage mutation or deployment.Reviewed the exact-head content of both changed documentation files at
64f49444d4and the linked live workflow #101, terraform-modules #11, and merged platform routing #121 context. The pages distinguish owner-reported Seaweed routing and configured native SSE-S3 key from the observed anonymous 403 and still-unverified scoped authentication, default-encrypted object readback, concurrency/locking, and independent recovery. They keep the state-bootstrap library release/promotion and protected caller as future prerequisites and do not imply that application AIStor consumers have migrated or that a bucket was bootstrapped. No private key material is included. This is documentation only: it changes no UDS package, admission policy, gateway, or route; existing tenant/admin gateway ownership is preserved, with no reason to request a duplicate bundle or routing resource. APPROVED for this source head, not for live storage acceptance, deployment, or merge. Documentation site checks and Source security contexts are pending at review time and remain required independent gates; no scan pass or deployment is claimed.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
@kiyi — Exact-head Source security run 269 (API 7250) failed in the executing
securityjob 9109: scan gate reports 0 blocking findings, 0 mitigated findings, 1 scanner error:Semgrep rules changed upstream; review/update rules.lock.json. Thepipelinewrapper job 9108 has no persisted log (.MISSING), not a separate demonstrated source finding or an authentication failure. Please reconcile the fetched Semgrep rule content against the owning pinnedrules.lock.jsonthrough its reviewed security workflow/policy, without disabling the lock or scan, then obtain a passing hosted run at the resulting exact head. The same diagnostic occurred on Documentation PR #47 run 267, suggesting a shared rule-lock drift rather than a Seaweed-doc-specific defect, but the rule/hash and security decision artifact are not available through my bounded review tools, so root cause remains to be confirmed. Documentation site run 270 was pending at this check. My prior source-only APPROVED at this SHA remains in place; it does not clear failed security contexts or authorize merge.Reviewed the exact-head source for all three changed files at
c4f712ee8a. The storage and decision pages record owner-reported Seaweed routing and native SSE-S3 key configuration without claiming that authenticated scoped access, encrypted object readback, Terraform locking or recovery have passed. They keep the workflow-library promotion and protected state-bootstrap caller as prerequisites and leave existing AIStor consumers untouched; no key material is included. The current security workflow still invokes Homelab/workflows security.yml@stable-v1 on the ci runner; it does not disable the source-security job. This head changes documentation and the reusable security caller, not a UDS deployment package, admission policy, gateway, or route. The established tenant/admin gateways remain the routing owners; no extra bundle or gateway is called for. Source-only APPROVED. The earlier Semgrep rules.lock.json drift failed a prior SHA; the new exact-head security and site checks are running/pending and must independently pass before merge. This does not assert a scan pass, live Seaweed acceptance, deployment, or merge authorization.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
@kiyi — Source security run 275 (API 7275) failed on this exact PR head. The executing
securityjob 9139 reportsScan gate: FAIL; 0 blocking, 0 mitigated, 1 scanner errorsandSemgrep rule content changed upstream; ... review/update rules.lock.json. Thepipelinewrapper job 9138 has no persisted log (.MISSING), not evidence of a second finding or an authentication failure. This repeats the rule-lock scanner error from the previous head, despite the promoted checkout-based caller; the site-check run 276 passed. Please inspect the security decision artifact and the fetched rule content against the reviewed lock in the owning shared security workflow/policy, reconcile the pin without bypassing or weakening the scan, and obtain a passing hosted security run bound to the resulting exact PR head. The exact changed rule/hash and decision artifact are not available through these bounded review tools, so those details remain unverified. My APPROVED review at this SHA is source-only; failed required security contexts block merge. No documentation-specific security finding is established by this log.Shared scan repair adoption is published in
c4f712ee: source-security uses checkout-based stable-v1 without optional library_ref. Parsed before/after checks preserve all workflow/job names, events, runner and inputs. npm run check, npm run build, native staged Gitleaks and diff checks passed locally. Hosted exact-head checks remain required.Use the single-release merge checklist, then start fresh owning scans after stable-v1 promotion. Merge Documentation #47 before #48. The owner confirmed cluster upgrades first, followed by full SeaweedFS integration and Harbor. Working SeaweedFS HTTPS routing does not establish the encrypted state bucket, scoped credentials or Harbor storage acceptance; those remain pending owning workflow gates.
Record Seaweed SSE-S3 and state-bootstrap readinessto Record verified Seaweed Terraform state bootstrapFollow-up to the shared scan failure and source review: 3038dc8 merges current main without conflicts and records the successful protected bucket-bootstrap result. The earlier scan was bound to the older library; fresh checks now use promoted v1.41.0 with the reviewed shared scan repair. No scan rules or check names were weakened or renamed.
Private Terraform run 62 verifies the initial scoped state bucket’s privacy/versioning/default AES256, encrypted readback and conditional writes. The current statements across related pages now distinguish that passing test and published identity profile from pending central runner authorization, actual Terraform locking/recovery, workload identity apply and application compatibility. AIStor/Harbor migration is still pending. Public pages include no credentials or private implementation links.
npm run checkand the default productionnpm run buildpassed; staged Gitleaks 8.30.1 and diff checks passed. Current-head hosted checks remain required. Documentation #47 is already merged; this branch includes it, so that ordering dependency is complete.Reviewed the authenticated exact-head text of all five changed documentation files at
3038dc8e0eand the prior reviews/comments. The update attributes initial scoped state-bucket authentication, privacy/versioning, default SSE-S3 AES256, encrypted readback and conditional-overwrite rejection to private Terraform run 62, while explicitly retaining central runner authorization, real Terraform concurrency/locking, independent recovery, workload identity apply, Harbor compatibility and AIStor migrations as pending. It does not assert whether the bucket was newly created versus reconciled and contains no private key or token values. This is documentation only: no changed UDS bundle, manifest, admission policy, Gateway or route; the recorded Seaweed routes reuse the existing tenant/admin gateway ownership, so no duplicate gateway/bundle is warranted. Source-only APPROVED for this head; the cited private Terraform run's underlying diagnostics were not independently retrieved by these PR review tools. Exact-head source-security and site-check runs were running/pending at review; their scans and required merge gates remain independent, and earlier Semgrep lock failures on older heads are not cleared by this approval. No deployment or merge authorized.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Reviewed the authenticated exact-head text of all five changed documentation files at
76ad492e6e, the prior reviews, and current CI. This follow-up records owner-reported installation of scoped central plan/apply grants and private inspect run 64 while explicitly saying real plan/apply authentication remains untested. It preserves the distinction between private state-bootstrap run 62's bounded bucket protection/readback checks and still-pending Terraform concurrency/locking, recovery, RKE2 claim compatibility (#106), workload identity apply, Harbor compatibility and AIStor migrations. No key/token values are disclosed. The private runs and installed grants were not independently retrieved through these bounded PR tools, so this is approval of the accurately qualified documentation, not independent live acceptance. This head changes only documentation: no UDS package, admission policy, gateway or route. Existing tenant/admin gateway ownership remains intact, with no duplicate bundle/gateway called for. Source-only APPROVED for this SHA; exact-head Source security and Documentation site checks are still pending, must pass separately before merge, and older-head Semgrep failures are not deemed cleared. No deployment or merge authorization.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.