feat(binjovi): the package lanes read their object-store keys from RustFS

sean commented

2026-09-10 04:08:19 +00:00

Owner

The thirteen native package identities (rpg/zdns/zelnet/zerotea build, promote, read; zelnetsdkread) are provisioned on RustFS by the converge with their MinIO policies verbatim. Their binjovi-native-*-s3 ExternalSecrets now read the RustFS keys through the per-identity ClusterSecretStores, and the zdns/zelnet execution network policies name rustfs instead of minio. Lands back-to-back with the binjovi-plans publisher v9 bump. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-10 04:08:19 +00:00

feat(binjovi): the package lanes read their object-store keys from RustFS

binjovi/ci Binjovi failed the frozen plan

Details

f685b4691d

Stage 3, workflows and pkg, consumer side in this repository. Held until the
catalog has converged the thirteen identities onto RustFS, both mirrors have
reached zero, and sean/binjovi pins the v9 package publisher -- the image that
carries the endpoint. Three things move together here, and two of them fail
silently apart.

THIRTEEN ExternalSecrets change store. Each binjovi-native-*-s3 Secret in
binjovi-builds now reads accesskey and secretkey from that identity's own
RustFS chain (rustfs-<identity>-s3-credentials, admitting this namespace only)
instead of from a 52-day-old imperative Secret in namespace workflows via the
shared package stores. The Secret keeps its name and its two keys, and the
accesskey VALUE is unchanged because each RustFS user carries the MinIO user's
name, so no agent that mounts one learns anything new. The three RPG entries
lose their scoped_key template: the RustFS chain already shapes the Secret.

FIVE egress selectors move from namespace minio to namespace rustfs in the zdns
and zelnet package policies, same port. A repoint that leaves the policy behind
is the failure that does not announce itself -- the pod is Ready, the build
runs, and every PUT to the store times out.

The shared stores binjovi-native-zelnet-secrets and
binjovi-native-server-package-secrets stay: they still deliver signing keys
and Forgejo tokens that have nothing to do with the object store. The MinIO
generators, converge Job and the zelnet SDK tenantbucket slice retire with
MinIO in Stage 5, not here.

tests/binjovi.sh and tests/binjovi-zelnet-prerequisites.sh pinned
values: [minio] in three places; they pin [rustfs] now.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean force-pushed sean/package-lanes-rustfs from f685b4691d

binjovi/ci Binjovi failed the frozen plan

Details

to e5409bfd1a

binjovi/ci Binjovi completed the frozen plan

Details

2026-09-10 04:09:12 +00:00

Compare

sean force-pushed sean/package-lanes-rustfs from e5409bfd1a

binjovi/ci Binjovi completed the frozen plan

Details

to 4ba52d35ef