Preserve RKE2 preflight errors when OpenBao cleanup fails #109

Merged

gitchegumi merged 1 commit from kiyi/rke2-session-cleanup into main

2026-10-15 23:29:34 -05:00

kiyi commented

2026-10-15 23:22:26 -05:00

Member

Preserve the original operation/issuance error or interruption when self-revocation also fails. Always attempt cleanup, label that stage explicitly, print only a fixed secondary diagnostic, and continue failing an otherwise successful operation if cleanup fails. Keep the public RKE2 policy export aligned with the companion Terraform correction: only exact account issuance plus update on auth/token/revoke-self. Default-policy exclusion, claims, TTLs, Kubernetes RBAC/admission, signed archive verification and all workflow/job/status names remain unchanged.

Validation at 48df1de73b: all 74 RKE2 delivery/admission-download and Terraform identity/delivery regressions pass. New regressions fail against the old implementation and cover all three component policies, primary failures before/after credential validation, interruption, cleanup-only failure, private kubeconfig removal and suppression of synthetic private cleanup details. Native staged Gitleaks 8.30.1 and diff checks passed. All APIs were mocked; no credentials or live deployment were used. Hosted checks remain required.

Review/merge this and the companion Terraform policy correction, then publish/promote one workflow release. Obtain a fresh owning Terraform plan and separately approved apply before a fresh bootstrap deployment attempt. The unchanged signed bootstrap release rke2-bootstrap-bundle-v0.1.0-r7501 can be reused. The original preflight failure is still unresolved until a fresh run reports it; this PR does not claim live bootstrap or upgrade acceptance.

Private platform bootstrap deployment run 4974 verified the signed release, obtained the expected Kubernetes credential and passed five permission probes, then stopped before deployment. Its RKE2 policy omitted self-revocation while the login omitted the default policy. The resulting cleanup HTTP 403 replaced the original preflight error. Preserve the original operation/issuance error or interruption when self-revocation also fails. Always attempt cleanup, label that stage explicitly, print only a fixed secondary diagnostic, and continue failing an otherwise successful operation if cleanup fails. Keep the public RKE2 policy export aligned with the companion Terraform correction: only exact account issuance plus update on auth/token/revoke-self. Default-policy exclusion, claims, TTLs, Kubernetes RBAC/admission, signed archive verification and all workflow/job/status names remain unchanged. Validation at 48df1de73bff003a4b1b7d2d668709ba27c27d91: all 74 RKE2 delivery/admission-download and Terraform identity/delivery regressions pass. New regressions fail against the old implementation and cover all three component policies, primary failures before/after credential validation, interruption, cleanup-only failure, private kubeconfig removal and suppression of synthetic private cleanup details. Native staged Gitleaks 8.30.1 and diff checks passed. All APIs were mocked; no credentials or live deployment were used. Hosted checks remain required. Review/merge this and the companion Terraform policy correction, then publish/promote one workflow release. Obtain a fresh owning Terraform plan and separately approved apply before a fresh bootstrap deployment attempt. The unchanged signed bootstrap release rke2-bootstrap-bundle-v0.1.0-r7501 can be reused. The original preflight failure is still unresolved until a fresh run reports it; this PR does not claim live bootstrap or upgrade acceptance.

kiyi added 1 commit

2026-10-15 23:22:26 -05:00

Preserve RKE2 failures during OpenBao session cleanup

Workflow acceptance / acceptance (pull_request) Successful in 1m31s

Details

Repository security / security-1 (pull_request) Successful in 4m29s

Details

Library checks / tests (pull_request) Successful in 5m6s

Details

48df1de73b

portegumi approved these changes

2026-10-15 23:23:42 -05:00

portegumi left a comment

Reviewed the exact-head credential context manager, OpenBao policy export, targeted regressions, and delivery documentation. The issuance/operation failure (including interruption) is retained when revocation raises a normal exception; cleanup remains attempted, successful operations still fail on cleanup error, and the kubeconfig temporary directory is removed before revocation. The exported policies add only update on auth/token/revoke-self alongside exact-account credential issuance, without expanding UDS routing, deployment resources, RBAC/admission, or bypassing signed-release/security gates. The tests exercise all three identities and failure/cleanup cases with mocked APIs. Source approval only: Workflow acceptance, Repository security, and Library checks are still pending at this head; no live OpenBao policy, Terraform apply, release promotion, or deployment acceptance is verified. Do not merge until required head-bound checks and companion deployment prerequisites pass.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added this to the Homelab Roadmap project

2026-10-15 23:24:12 -05:00

kiyi referenced this pull request from Homelab/Documentation

2026-10-15 23:25:23 -05:00

Record converged OpenBao apply and blocked RKE2 bootstrap #51