sean/platform-seanfarm
Watch
1
0
Fork
You've already forked platform-seanfarm
 0
Code Issues Pull requests 10 Projects Releases 120 Packages Wiki Activity

merge cnpg/p05-wave4-gcp (e870e7f0c0) #417

Open
pipeline-bot wants to merge 6 commits from cnpg/p05-wave4-gcp into trunk
pull from: cnpg/p05-wave4-gcp
merge into: sean:trunk
Conversation 0 Commits 6 Files changed 5 +49 -134
pipeline-bot commented 2026-07-23 10:14:37 +00:00
Collaborator
Copy link
No description provided. 
The openbao CRs configuring vault (not the DB) move out of the cnpg-platform
catchall into the OpenBao singleton ns, ahead of the postgres cutover.
Wave 1 = the pure vault-config DNS trio: policies gcp-external-dns-{stack},
gcp-lease-cleanup-{stack} + auth-roles external-dns-{stack},
cert-manager-{stack}, gcp-lease-cleanup-{stack}. Placement now follows
spec.openbaoNamespace (same knob as the server address) instead of
cnpg-{vaultName}. Vault state is untouched: operators adopt existing
paths; old CRs in cnpg-platform are orphaned (deletionPolicy=Retain)
and deleted manually after the new ones go Ready.
The hourly lease-cleanup CronJob has failed since birth (05-19): the pod
runs as runAsUser 65534 but the script's first line is 'apk add curl jq',
which needs root to lock /lib/apk. Swap to alpine/k8s:1.31.0 (curl+jq
baked, already the convention for this composition's other jobs), drop the
runtime fetch, and set readOnlyRootFilesystem now that nothing writes.
Transit backend transit-{platform} + policy cosign-signer-{platform}
(XPlatform), auth-role build-pipeline-{stack} (XStack, policyRefs resolve
same-ns so it moves with the cosign policy), and the forgejo instance-signing
pair forgejo-signing-{tenant} / {tenant}-forgejo-signing (XForgejo,
hardcoded ns literals). Vault paths (transit/*, kv/*) are ns-independent;
operators adopt existing state — key versions unchanged.
pki-root-{platform} backend + root cert, pki-internal-{platform} backend +
intermediate CA, and the 3 PKI roles (cnpg-server/cnpg-client/bundle-export
rsa-yellow). Controllers adopt existing vault mounts (read->exists->status-only)
so root/intermediate serials are unchanged; the k8s trust materialization
(OpenBaoPKICertificate internal-ca-bundle-source-platform + Bundles) lives in
ns cert-manager and is untouched. The 2 OpenBaoPKIIssuers reference the backend
by vault path string and stay with the postgres certs until the DB cutover.
The clouddns-service-account connection secret (seed key for the OpenBao gcp
mount, minted from the shared seanfarm-platform-iam SA) moves with its only
reader: OpenBaoGCPSecretsBackend gcp-{stack} resolves credentialsSecretRef in
its own ns, so secret + backend + the Object dependsOn gate + the
external-dns-{stack} roleset all flip together. The secret is byte-copied to
ns openbao before this lands so neither upjet state reconstruction nor the
backend reconcile ever sees a missing key (no SA-key re-mint).
This pull request has changes conflicting with the target branch.
  • apis/platform/README.md
  • apis/stack/composition.yaml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin cnpg/p05-wave4-gcp:cnpg/p05-wave4-gcp
git switch cnpg/p05-wave4-gcp
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/platform-seanfarm!417
No description provided.