Support isolated SeaweedFS Terraform state bootstrap #101
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!101
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/seaweed-state-bootstrap"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The state bucket must be bootstrapped on SeaweedFS before application provisioning can begin. Add a reserved
state-bootstrapselector to the existing Terraform workflow, backed by a library-owned Seaweed profile. It uses the existing scoped OpenBao bootstrap key and loads no application root, provider, runtime or credential seed. Plan/apply cannot use this selector.The acceptance upload omits an encryption override, so AES256/version metadata and byte-for-byte readback prove the bucket default encrypts ordinary writes. Conditional overwrite must still fail with HTTP 412. Select the established
deploypool instead of the retireddeploy-k8slabel. Workflow names, job IDs and required check names are preserved. Existing application/legacy AIStor contracts are unchanged.Validation: 37 targeted Terraform/catalog/bootstrap/caller tests pass, plus the stable-channel compiler preservation test across every reusable workflow. Changed YAML/JSON contracts and Git diff checks pass; the native Gitleaks hook reports no findings. The broader channel suite has two shell-execution test methods failing in this Windows environment; Linux hosted checks remain required. No real credentials, bucket bootstrap or Terraform plan/apply were used locally.
Delivery: merge, publish a numbered workflow release, promote it to
stable-v1, then start a fresh owning bootstrap run after merging the paired terraform-modules caller. Scoped key/role setup and live encryption/locking/recovery acceptance remain pending. Related work: Homelab/platform#120 and Homelab/terraform-modules#8.Reviewed the exact-head workflow, library policy, bootstrap selector/dispatch path, S3 client, and bootstrap/legacy tests. The reserved state-bootstrap selector resolves its Seaweed endpoint, region, bucket, role, and credential from library policy; it rejects plan/apply before credential exchange and avoids application root/provider/seed loading. The bootstrap probe is written without an SSE override, requires version/AES256 metadata and byte-for-byte readback, and rejects an if-none-match collision unless HTTP 412. The workflow uses the deploy runner label. This is a Terraform workflow/library change, not a UDS package, admission, or Istio routing change; no additional gateway or bundle is indicated. Source review approves this head, not deployment or live S3 compatibility. Workflow acceptance, repository security, and Library checks were pending at review time; required exact-head checks and live Seaweed encryption/locking and scoped OpenBao acceptance remain separate gates before use. No merge/release is authorized by this approval.
CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
kiyi referenced this pull request from Homelab/Documentation2026-10-14 20:22:57 -05:00
Exact-head CI follow-up for kiyi: run 691 (API 7247),
test-library.ymljob 9104, failed on this SHA. Its bounded authenticated diagnostics show aterraform.yml-associated test ending inFAIL, but the returned excerpt is truncated and does not expose the assertion/traceback; inspect the full job log and reproduce that test on Linux before changing the contract. Independently, run 690 (API 7246), repository-security job 9103, failed with zero blocking findings and one scanner error: the fetched Semgrep rule bytes no longer match the pinnedrules.lock.jsondigest. Review the upstream rule change and update the pin only if the rule content is acceptable, then require the scanner to complete with zero errors on a new exact-head run; do not skip or relax the gate. Workflow acceptance run 689 succeeded. My existing source approval on this same SHA remains source-only, not CI or merge acceptance; both failing checks block merge. No UDS deployment/routing boundary is introduced here.New commits pushed, approval review dismissed automatically according to repository settings
Reviewed the current
b827e9a96esource, policy, workflow, bootstrap/S3 implementation, and targeted tests after the previous CI follow-up. The reserved state-bootstrap catalog selector maps to the library-owned Seaweed origin, bucket, region, OpenBao role and state-only credential; plan/apply are rejected before credential exchange and the bootstrap path does not load an application root, provider or runtime seed. The ordinary probe PUT has no SSE override, requires AES256/version metadata and exact readback, and requires HTTP 412 for the conditional-write collision. The provision job uses the existing deploy role. This is not a UDS packaging, admission, or Istio routing change; no duplicate gateway/bundle is indicated. Source-only APPROVED for this head. The rules.lock.json digest was updated after the earlier rule-checksum failure, but this approval does not attest to the fetched Semgrep rules or a successful security scan. Workflow acceptance, repository security and Library checks are currently pending at this SHA: all must pass before merge, especially the previously failing Terraform-associated Library test and pinned rule evaluation. Live scoped OpenBao access and Seaweed encryption/conditional writes/Terraform locking and recovery remain first-use acceptance. No merge, release, deployment or gate waiver authorized.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Addressed the remaining CI contracts in
1fdae6a6a6: the Terraform runner assertion now matches the existing deploy pool. Refreshed the reviewed Semgrep full-content checksum inb827e9a96e. All 225 rule detections are unchanged; upstream only added metadata.semgrep.dev.rule.path. Local validation: 46 Terraform/runner contract tests and 54 scanner/reporting tests passed. The new hosted Repository security and Workflow acceptance checks have passed. No required check names changed. This belongs in the single combined workflow release with #99, #100, #102 and #103.New commits pushed, approval review dismissed automatically according to repository settings
Run 697 follow-through: the clean synthetic source scan passed with zero blocking findings, zero mitigations and zero scanner errors. The next fixture failed during the Semgrep HTTPS download with ConnectionResetError 104; the log does not report rule-content drift.
Fixed in
868553c, which also integrates merged #103/main. Downloads now make at most three attempts with one/two-second backoff for temporary transport or HTTP 408/429/500/502/503/504 failures. TLS verification and full-content pinning remain intact. Bad certificates, other HTTP errors, malformed rules and checksum/count changes fail without retry; exhausted downloads produce a blocking scanner decision/report instead of an uncaught traceback. No fallback pack or gate waiver is used.Validation: 115 local scanner, reporting, Terraform and native-Gitleaks payload tests passed. The combined batch at
b955d25completed 177 cases with eight Windows symlink skips; all merge commits passed the active staged Gitleaks hook and diff checks. The new push starts fresh owning checks; hosted full Linux/source-scan acceptance remains required. Existing workflow/job/status names are unchanged. The remaining merge order stays #101 → #99 → #100 → #102, followed by one combined release and stable-v1 promotion.Reviewed current
868553c8aasource after kiyi's comment 6648 and prior approvals on older SHAs. The Semgrep download now retries only bounded transient transport/HTTP 408/429/500/502/503/504 failures, preserves TLS and verified full-content rule pinning, rejects bad certificates/client errors/content drift without retry, and records exhausted downloads as scanner errors in a failing decision. The synthetic tests cover recovery, exhaustion, TLS/client failures, changed rules, and fail-closed source-scan reporting. The state-bootstrap path still selects the library-owned Seaweed backend and scoped OpenBao key without an application root/provider, rejects plan/apply, and checks ordinary default-encrypted/versioned S3 probe readback plus HTTP 412 conditional-write failure. Workflow runner label remains deploy. This does not alter UDS packaging, admission, or Istio routing; no extra gateway/bundle is indicated. APPROVED is source-only: the exact-head Workflow acceptance, Repository security, Security image compatibility, and Library checks remain pending and must pass before merge. Live scoped OpenBao access and Seaweed encryption, locking, and recovery remain separate first-use acceptance. No merge, release, or deployment authorized.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.