Support Terraform-managed private UDS bundle settings #123

Merged

gitchegumi merged 1 commit from kiyi/terraform-bundle-configuration into main

2026-10-17 23:02:21 -05:00

kiyi commented

2026-10-17 22:53:54 -05:00

Member

The plan gate requires the exact declared resource/path/revision, write-only payloads, disabled ordinary secret reads and permanent deletion disabled. It rejects secret-reading imports, persisted KV contents, replacement/deletion, unknown public settings and competing record owners. Existing identity retirement, actor/OIDC, state, approval and status-name contracts are preserved. Records are captured only in memory, and apply verifies that every other KV field is unchanged.

Release/promote this support before merging or dispatching the Terraform declaration. The existing runner still cannot administer its own trust; its operator installs the reviewed exact Core-record permission addition once. No new login, state-storage key or CI secret is introduced, and this does not deploy UDS.

Validation: 47 focused Terraform delivery tests passed; complete Linux library suite ran 532 tests with no failures and 20 tool-dependent skips; workflow YAML/Bash and 16 mocked shell cases passed; native Gitleaks 8.30.1 staged scan passed. Hosted checks and separately approved owning plan/apply remain required.

Core upgrades need the private OpenBao bundle versions updated through Terraform. Extend the existing terraform.yml / openbao-identities profile to accept explicitly adopted UDS bundle records described by the owning Terraform repository. The companion source is Terraform commit 515722f18b2e7be974228e8389e315396b236b95. The plan gate requires the exact declared resource/path/revision, write-only payloads, disabled ordinary secret reads and permanent deletion disabled. It rejects secret-reading imports, persisted KV contents, replacement/deletion, unknown public settings and competing record owners. Existing identity retirement, actor/OIDC, state, approval and status-name contracts are preserved. Records are captured only in memory, and apply verifies that every other KV field is unchanged. Release/promote this support before merging or dispatching the Terraform declaration. The existing runner still cannot administer its own trust; its operator installs the reviewed exact Core-record permission addition once. No new login, state-storage key or CI secret is introduced, and this does not deploy UDS. Validation: 47 focused Terraform delivery tests passed; complete Linux library suite ran 532 tests with no failures and 20 tool-dependent skips; workflow YAML/Bash and 16 mocked shell cases passed; native Gitleaks 8.30.1 staged scan passed. Hosted checks and separately approved owning plan/apply remain required.

kiyi added 1 commit

2026-10-17 22:53:54 -05:00

Support Terraform-managed private UDS bundle settings

Repository security / security-1 (pull_request) Successful in 2m18s

Details

Workflow acceptance / acceptance (pull_request) Successful in 2m19s

Details

Library checks / tests (pull_request) Successful in 7m56s

Details

eba9d192c6

portegumi approved these changes

2026-10-17 22:55:22 -05:00

portegumi left a comment

Reviewed the exact head's Terraform OpenBao contract, delivery path, policy selector and focused tests. The optional bundle declaration is constrained to explicit existing Core/application KV paths and write-only records; the plan gate rejects imports, persisted KV payloads, unapproved addresses and deletion/replacement, while the apply path compares all preserved KV fields. This extends configuration delivery, not UDS runtime routing or deployment, so no new gateway/route or UDS bundle is warranted by this diff. Source review has no blocker. The owning Terraform module/declaration at 515722f18b2e7be974228e8389e315396b236b95 and any live OpenBao access/readback remain separate release/plan/apply acceptance; I have not verified them here. Workflow acceptance, Repository security and Library checks are pending at this head, so this approval does not mark CI passed or authorize merge, release, or apply.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.