feat(binjovi): bind the application accounts to the database policies #138

Merged

binjovi-bot merged 2 commits from feat/binjovi-app-db-roles into trunk 2026-09-01 12:45:18 +00:00

Conversation 0 Commits 2 Files changed 17 +460 -1

sean commented 2026-09-01 12:36:54 +00:00

Owner

Copy link

First half of the OpenBao-direct database credentials change (the binjovi PR carries the workload flip and the connection-pool code). Two OpenBaoKubernetesAuthRole objects bind the binjovi and binjovi-staging application ServiceAccounts to the existing database-binjovi and database-binjovi-staging read policies (infrastructure/tenantdatabase/policy.yaml), token TTL 120s, same shape as the binjovi-forgejo-jwt role beside them.

Why: this morning the operator reconcile freeze let a rotation land in PostgreSQL without reaching the synced Secret, and staging crash-looped on invalid_password. With the pool reading static-creds from OpenBao before every connection attempt, a rotated password heals on the next attempt - no sync loop, no Secret, no restart. These roles are inert until the binjovi workload flip deploys.

https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

First half of the OpenBao-direct database credentials change (the binjovi PR carries the workload flip and the connection-pool code). Two OpenBaoKubernetesAuthRole objects bind the binjovi and binjovi-staging application ServiceAccounts to the existing database-binjovi and database-binjovi-staging read policies (infrastructure/tenantdatabase/policy.yaml), token TTL 120s, same shape as the binjovi-forgejo-jwt role beside them. Why: this morning the operator reconcile freeze let a rotation land in PostgreSQL without reaching the synced Secret, and staging crash-looped on invalid_password. With the pool reading static-creds from OpenBao before every connection attempt, a rotated password heals on the next attempt - no sync loop, no Secret, no restart. These roles are inert until the binjovi workload flip deploys. https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

sean added 1 commit 2026-09-01 12:36:55 +00:00

feat(binjovi): bind the application accounts to the database policies ... 7b8713dda1

The Binjovi pods read their PostgreSQL static credentials from OpenBao
before every connection attempt, so a rotation heals on the next
attempt without an operator-synced Secret or a restart. Two
OpenBaoKubernetesAuthRole objects bind the binjovi and binjovi-staging
ServiceAccounts to the existing database-binjovi and
database-binjovi-staging read policies. The workload flip lands in the
binjovi repository; these roles are inert until it does.

Claude-Session: https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

sean added 1 commit 2026-09-01 12:43:23 +00:00

test(binjovi): audit the database access roles into the guard ... 542469a3c7

The kustomization count moves to 31 and the guard pins the shape of
db-access.yaml: two OpenBaoKubernetesAuthRole objects, one bound
ServiceAccount and one read policy each, and no wildcard binding.

Claude-Session: https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

binjovi-bot merged commit 542469a3c7 into trunk 2026-09-01 12:45:18 +00:00

sean referenced this pull request 2026-09-01 13:52:33 +00:00

fix(binjovi): attach the database policies by name #142

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!138

No description provided.