feat(rpg): the RPG keys come from RustFS only; the MinIO half was a timed landmine

sean commented

2026-09-10 08:10:18 +00:00

Owner

binjovi/ibmi-rpg-storage.yaml still carried three generated keys in namespace minio, a reader ServiceAccount/Role/RoleBinding, a ClusterSecretStore and a Job that converged them into the deleted tenant. The Job succeeded at 03:31, minutes before the deletion; its TTL is 86400 s, so Flux would have recreated it a day later and it would have failed, taking the binjovi Kustomization to Ready: False. The guard that read that Job's script is replaced by what is now true: one scoped RustFS store per role, exactly one store declared, no MinIO outside a comment -- the policies themselves are declared in binjovi-plans and proved by the converge. The Job was the last minio/mc pin, so the inventory record goes too. Full tests/check.sh green. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-10 08:10:18 +00:00

feat(rpg): the RPG keys come from RustFS only; the MinIO half was a timed landmine

binjovi/ci Binjovi completed the frozen plan

Details

cb238aa059

`binjovi/ibmi-rpg-storage.yaml` carried both halves of the RPG credential
chain. The RustFS half -- three scoped keys delivered into `binjovi-builds`
under the names the package agents already read -- has been live since the
package lanes were repointed. The MinIO half was still there: three
generated keys in namespace `minio`, a reader ServiceAccount, Role and
RoleBinding, a ClusterSecretStore serving them, and a Job that converged
them into the MinIO tenant.

Both halves were dead the moment the tenant was deleted, and the Job was
worse than dead. It shows `succeeded` from 03:31, minutes before the
deletion, and its `ttlSecondsAfterFinished` is 86400: the TTL controller
reaps it, Flux finds it absent, recreates it, and it fails against a store
that does not exist -- taking the `binjovi` Kustomization to Ready: False
about a day after everything looked finished. That is the same shape as
every "a reference outlives its declaration" entry in this migration's
notes, with a timer attached.

`tests/binjovi-ibmi-rpg-native.sh` read that Job's script and asserted the
three policies, their prefixes and counts, and the readback probe. Those
properties are not unproved now -- they moved to where they are declared
and exercised, which is stronger than a guard reading a shell script:
`sean/binjovi-plans` object-store.json declares each policy,
`tests/object-store-test` refuses a bad one before it is committed, and the
object-store converge proves on every release that each key reaches its own
prefixes and is refused the rest, on both verbs. What the guard asserts here
is what remains its business: one scoped RustFS store per role, exactly one
store declared in the file, and no MinIO outside a comment. Both controls
run and confirmed.

That Job was also the last `minio/mc` pin in the tree, so the inventory
record goes with it.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit cb238aa059 into trunk

2026-09-10 08:16:23 +00:00

Rows
Columns

feat(rpg): the RPG keys come from RustFS only; the MinIO half was a timed landmine #535