feat(rustfs): deliver the thirteen native package identities

sean commented

2026-09-10 00:33:20 +00:00

Owner

Source side for workflows and pkg: the thirteen native package identities (zdns/zelnet/zerotea build/read/promote, three IBM i RPG keys, the zelnet SDK reader) generated, frozen, delivered to binjovi-builds and wired into the converge. Same user names as MinIO so the agents' accesskey values do not change. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-10 00:33:22 +00:00

feat(rustfs): deliver the thirteen native package identities

binjovi/ci Binjovi failed the frozen plan

Details

48ee456f2c

Stage 3, the last two buckets, source side. workflows and pkg have exactly
thirteen writers: the zdns, zelnet and zerotea build/read/promote keys, the
three IBM i RPG keys, and the zelnet SDK reader. This generates, freezes and
delivers each of them to namespace binjovi-builds, and adds each generated key
to the converge's reader scope and its delivered key set. No consumer moves
yet; the agents' ExternalSecrets are repointed once the buckets are declared,
converged and mirrored.

WHY THIRTEEN AND NOT EIGHTY-FIVE. The live MinIO tenant carries 55 policies on
workflows and 30 on pkg. Twelve of the thirteen identities that matter are
52-day-old Secrets in namespace workflows that nothing in git produces --
created by the retired MinIO resource operator and Pipelines -- and the rest
of those 85 are the same generation, dead. The set here is what seanfarm's own
binjovi/*-agent-secrets.yaml files actually deliver to the agents, read out of
git rather than out of the tenant.

THE ACCESS KEY IS THE IDENTITY NAME, AND THE NAME IS THE MINIO USER NAME, on
purpose. Every package agent mounts its binjovi-native-*-s3 Secret and reads
two files, accesskey and secretkey; the publisher tools hand that access key to
`mc alias set`. Declaring the RustFS identities under the same names means the
value in `accesskey` does not change, so the cutover is an endpoint change in
one image and a store change in one ExternalSecret, and no agent learns
anything new. zot's chain shipped the wrong name yesterday and CrashLooped six
times on "Access Key Id does not exist"; tests/rustfs-identities.sh now checks
the literal access key against the file name for the `accesskey` spelling too.

Eighteen identities pass the class guard: keyed, frozen, reader scope pinned
to each identity's two Secrets, every ClusterSecretStore conditioned to one
namespace, and every generated key present in the converge's delivered set.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean force-pushed sean/rustfs-package-identities from 48ee456f2c

binjovi/ci Binjovi failed the frozen plan

Details

to 9ca2426ca1

binjovi/ci Binjovi completed the frozen plan

Details

2026-09-10 00:38:00 +00:00

Compare

binjovi-bot merged commit 9ca2426ca1 into trunk

2026-09-10 00:44:13 +00:00

Rows
Columns

feat(rustfs): deliver the thirteen native package identities #514