feat(deploy): consume automatically managed app credentials #38
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!38
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/app-onboarding"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
GitchAlerts run 19 stopped because automatic credential issuance still required a hand-authored application contract. Add managed deployment modes that resolve authenticated repository IDs, consume platform-generated contracts from OpenBao, and verify namespace boundaries before issuing a short-lived kubeconfig. New applications no longer need per-app role inputs or a workflow-library release containing their contract. Existing credential modes remain available.
Depends on Homelab/platform#39. Planned consumer release: v1.9.0; do not switch callers until the platform onboarding service is installed and that release is published. This proposal does not enable live access.
Validation: all 133 shared-workflow tests passed under Linux, including eight managed-credential tests; scaffold YAML/Bash validation and 16 mocked cases passed. Live OpenBao and Kubernetes onboarding remains pending.
Refs #19 and Homelab/platform#24, Homelab/platform#28.
Contracts use the paired platform writer’s json-v1 KV envelope: decode one complete JSON string after checking the exact format and 30,000-byte envelope bound, then apply the existing identity/provenance/permission checks. Unknown, malformed, oversized or unwrapped records stop before Kubernetes issuance and revoke the OpenBao session. This addresses Homelab/platform#39’s real OpenBao JSON-complexity failure without dropping any permission probes or increasing listener limits. Both dev/prod records from the pinned OpenBao 2.6.2 regression were decoded and validated through this consumer.
One remaining P2 documentation/integration blocker: the required platform installation guide points to the deleted dependency branch. Homelab/platform#39 is now merged, and authenticated content lookup returns 404 at kiyi/app-onboarding while the identical path on main returns 200. Please switch the guide to the durable main URL (inline).
No implementation blocker found in the managed credential path. Reviewed all changed files and the handoff through the owner/protected-dispatch guard, managed identity selection, bounded contract decoder, required/forbidden permission checks, kubeconfig export, cleanup, and both workflow shell routes. The Kubernetes canary intentionally retains its existing allowlist, as documented.
Validation: all 133 unit tests pass locally; YAML/Bash scaffold plus 16 mocked cases pass. Exact operation-shell probes preserve validation failures and never route managed-validate to delivery; the skipped-setup import path also works with Python site packages disabled. The paired pinned-real-OpenBao test already passed for this exact consumer SHA during platform#39 re-review, decoding both environments without losing probes. All 4 exact-head hosted statuses are successful; hosted logs confirm 133 tests, scaffold, Kubernetes negative cases, and real source scans. Inspected security artifact 755: passed=true, no blockers or scanner errors, with existing exact mitigations.
No live token issuance, bootstrap or deployment performed. Live acceptance and the published consumer release remain prerequisites before enabling callers.
@ -0,0 +2,4 @@Prepared for the next workflow release (planned v1.9.0). The platform implementationand one-time installation are documented in[platform onboarding](https://git.gitchegumi.com/Homelab/platform/src/branch/kiyi/app-onboarding/infrastructure/deployment/onboarding/README.md).P2 — Restore the required platform-installation guide after the dependency merge. Homelab/platform#39 has merged and its kiyi/app-onboarding branch is gone. Authenticated GET /repos/Homelab/platform/contents/infrastructure/deployment/onboarding/README.md?ref=kiyi/app-onboarding returns 404; the same request at ref=main returns 200. This is the guide operators are sent to for the mandatory one-time trust installation, so the newly documented onboarding path currently dead-ends. Replace the URL with https://git.gitchegumi.com/Homelab/platform/src/branch/main/infrastructure/deployment/onboarding/README.md (or an immutable merged-commit URL).
Fixed in
cab5e5cb2a: the installation guide now links to the merged platform runbook on main. Verified the destination opens and contains the one-time installation instructions; searched the repository for the deleted platform branch URL and found no remaining references. git diff --check passed, and a read-only fetch confirmed the published tree matches the local correction with kiyi as both author and committer. This is a documentation-only change; fresh hosted checks are running.WIP: feat(deploy): consume automatically managed app credentialsto feat(deploy): consume automatically managed app credentialsApproved on re-review; supersedes my previous REQUEST_CHANGES review. The only intervening change replaces the deleted platform feature-branch installation-guide URL with the durable main URL. Authenticated lookup of the exact corrected path returns HTTP 200 and a regular file. No implementation or workflow changes were introduced, so the previous code/test review remains applicable. All four exact-head CI statuses are now successful; diff checks pass and the checkout is clean.
No remaining review blockers. Published consumer release, platform trust installation and live acceptance remain prerequisites before enabling callers. No deployment or production credential issuance was performed.