Support scoped runtime image updates in OpenBao Terraform records #126

Merged

gitchegumi merged 1 commit from kiyi/terraform-runtime-images into main

2026-10-18 10:18:09 -05:00

kiyi commented

2026-10-18 02:06:52 -05:00

Member

The refreshed GitchAuth image needs its immutable digest written into the existing private Core runtime YAML through Terraform. The current bundle contract only permits package/version edits and requires every other KV field to stay byte-for-byte unchanged.

Add optional runtime_images to that existing contract: one separate YAML field, explicitly named image variables under declared packages, and immutable image digests only. Preflight requires the selected variables to already contain image digests. Post-apply readback verifies each declared replacement and every undeclared runtime value, including passwords, multiline strings, other packages and scalar types. Unrelated KV fields stay byte-for-byte unchanged. YAML aliases, duplicate keys, invalid structures and arbitrary parser messages cannot bypass checks or expose private values. Reuse the existing hash-pinned PyYAML lock.

The absent/null option retains bundle-only behavior. Existing state keys, resource addresses, delegated paths, workflow inputs, job/status names, plan/apply approval and credential gates remain unchanged. No new permission, identity, state or private value is introduced.

Validation: all 62 Terraform workflow tests pass, including privacy and tampering cases; the actual companion Terraform declaration loads successfully and matches the published image digest. git diff --check and native Gitleaks 8.30.1 pass. No real plan/apply or deployment was run.

Release and promote this change to stable-v1 before the companion Terraform image declaration is used. Then the owning provision-openbao.yml follows its normal reviewed plan/apply flow.

The refreshed [GitchAuth image](https://git.gitchegumi.com/Homelab/platform/releases/tag/gitchauth-theme-v2026.10.18-r7907) needs its immutable digest written into the existing private Core runtime YAML through Terraform. The current bundle contract only permits package/version edits and requires every other KV field to stay byte-for-byte unchanged. Add optional `runtime_images` to that existing contract: one separate YAML field, explicitly named image variables under declared packages, and immutable image digests only. Preflight requires the selected variables to already contain image digests. Post-apply readback verifies each declared replacement and every undeclared runtime value, including passwords, multiline strings, other packages and scalar types. Unrelated KV fields stay byte-for-byte unchanged. YAML aliases, duplicate keys, invalid structures and arbitrary parser messages cannot bypass checks or expose private values. Reuse the existing hash-pinned PyYAML lock. The absent/null option retains bundle-only behavior. Existing state keys, resource addresses, delegated paths, workflow inputs, job/status names, plan/apply approval and credential gates remain unchanged. No new permission, identity, state or private value is introduced. Validation: all 62 Terraform workflow tests pass, including privacy and tampering cases; the actual companion Terraform declaration loads successfully and matches the published image digest. `git diff --check` and native Gitleaks 8.30.1 pass. No real plan/apply or deployment was run. Release and promote this change to `stable-v1` before the companion Terraform image declaration is used. Then the owning `provision-openbao.yml` follows its normal reviewed plan/apply flow.

kiyi added 1 commit

2026-10-18 02:06:53 -05:00

Verify scoped runtime image updates in Terraform bundle records

Repository security / security-1 (pull_request) Successful in 2m29s

Details

Workflow acceptance / acceptance (pull_request) Successful in 2m31s

Details

Library checks / tests (pull_request) Successful in 7m6s

Details

e2324b84e2

portegumi approved these changes

2026-10-18 08:08:54 -05:00

portegumi left a comment

Reviewed exact head e2324b84e2 against base 5a4caecb19. The optional runtime_images contract selects only named variables under declared packages in a separate existing YAML field, requires immutable sha256 digests before update, and verifies that no undeclared runtime setting or unrelated OpenBao KV field changes after apply. The private YAML parser rejects aliases, duplicate keys, and unsupported values without leaking parser text; absent/null retains bundle-only behavior. PyYAML is included via the existing hash-pinned lock. I inspected all three changed-file diffs, ran the 62 Terraform workflow tests and independent nested-duplicate/alias probes, and git diff --check passed. All three exact-head repository security, acceptance, and library contexts are successful. No UDS routing/package change. Source approval only: the companion declaration requires a reviewed release promoted to stable-v1, then a separate live plan/apply and readback; none was performed here.

Reviewed exact head e2324b84e22f5d18512303d7766ab05f05e6c74d against base 5a4caecb1955fd39ebc51417829902ad759aaf64. The optional runtime_images contract selects only named variables under declared packages in a separate existing YAML field, requires immutable sha256 digests before update, and verifies that no undeclared runtime setting or unrelated OpenBao KV field changes after apply. The private YAML parser rejects aliases, duplicate keys, and unsupported values without leaking parser text; absent/null retains bundle-only behavior. PyYAML is included via the existing hash-pinned lock. I inspected all three changed-file diffs, ran the 62 Terraform workflow tests and independent nested-duplicate/alias probes, and git diff --check passed. All three exact-head repository security, acceptance, and library contexts are successful. No UDS routing/package change. Source approval only: the companion declaration requires a reviewed release promoted to stable-v1, then a separate live plan/apply and readback; none was performed here.