coilyco-flight-deck/infrastructure
2
0
Fork 0
Code Issues 118 Pull requests Projects Releases Packages Wiki Activity Actions 2

RBAC: migrate eco-app/open-webui deployer off raw Secrets/RBAC to ExternalSecrets, drop supplemental Roles #467

New issue
Closed
opened 2026-07-04 08:03:56 +00:00 by coilysiren · 2 comments
coilysiren commented 2026-07-04 08:03:56 +00:00
Owner
Copy link

Follow-up to #466 (zero-per-service RBAC via the cluster-wide deployer-apps ClusterRole).

deployer-apps deliberately excludes cluster-wide secrets and rbac (roles/rolebindings) writes - the two real escalations. As a result three namespaces still carry a small supplemental namespaced deployer Role in deploy/forgejo-runner-deploy.yml:

  • atlas - secrets (tailnet sidecar ts-state Secret)
  • coilysiren-eco-app - secrets + roles/rolebindings
  • open-webui - secrets + roles/rolebindings

Goal

Migrate each of these services off deploying raw Secrets and RBAC:

  • Move Secret material to ExternalSecrets (SSM-backed, synced by the cluster-scoped external-secrets operator), which deployer-apps already grants cluster-wide.
  • If the roles/rolebindings a service creates are only for its own tailnet sidecar state, evaluate whether they can be pre-provisioned once (operator step) rather than reconciled by CD each deploy.

Once a namespace no longer creates raw Secrets or RBAC at deploy time, delete its supplemental Role+RoleBinding block. When all three are gone, the CD runner reaches zero namespaced RBAC entirely.

Refs

  • Parent: #466
  • Manifest: deploy/forgejo-runner-deploy.yml
  • Docs: docs/cd-runner.md (Identity + blast radius)
Follow-up to #466 (zero-per-service RBAC via the cluster-wide `deployer-apps` ClusterRole). `deployer-apps` deliberately excludes cluster-wide `secrets` and `rbac` (roles/rolebindings) writes - the two real escalations. As a result three namespaces still carry a small supplemental namespaced `deployer` Role in `deploy/forgejo-runner-deploy.yml`: - **atlas** - `secrets` (tailnet sidecar `ts-state` Secret) - **coilysiren-eco-app** - `secrets` + `roles`/`rolebindings` - **open-webui** - `secrets` + `roles`/`rolebindings` ## Goal Migrate each of these services off deploying **raw** Secrets and RBAC: - Move Secret material to **ExternalSecrets** (SSM-backed, synced by the cluster-scoped external-secrets operator), which `deployer-apps` already grants cluster-wide. - If the `roles`/`rolebindings` a service creates are only for its own tailnet sidecar state, evaluate whether they can be pre-provisioned once (operator step) rather than reconciled by CD each deploy. Once a namespace no longer creates raw Secrets or RBAC at deploy time, delete its supplemental `Role`+`RoleBinding` block. When all three are gone, the CD runner reaches zero namespaced RBAC entirely. ## Refs - Parent: #466 - Manifest: `deploy/forgejo-runner-deploy.yml` - Docs: `docs/cd-runner.md` (Identity + blast radius)
coilyco-ops commented 2026-07-10 11:32:58 +00:00
Member
Copy link

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-467 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-10T11:32:57Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)
  • Resolved: coilyco-flight-deck/infrastructure#467 · branch issue-467 · harness codex · workflow direct-main
  • Run: engineer-codex-infrastructure-467 · ward v0.580.0 · dispatched 2026-07-10T11:32:57Z
  • Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0).

— Codex, via ward agent

<!-- ward-agent-reservation --> WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-467` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-10T11:32:57Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#467` · branch `issue-467` · harness `codex` · workflow `direct-main` - **Run:** `engineer-codex-infrastructure-467` · ward `v0.580.0` · dispatched `2026-07-10T11:32:57Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.580.0). </details> </details> <!-- ward-agent-signature --> — Codex, via `ward agent`
coilyco-ops commented 2026-07-10 11:40:36 +00:00
Member
Copy link

WARD-OUTCOME: done

details

workflow: direct-main; review summary: review gate skipped by ~/.ward/config.yaml default

felt: mechanical. confidence: high. surprise: Forgejo Actions API shape was odd, but the landed push was green. follow-ups: none.

WARD-OUTCOME: done <details><summary>details</summary> workflow: direct-main; review summary: review gate skipped by ~/.ward/config.yaml default felt: mechanical. confidence: high. surprise: Forgejo Actions API shape was odd, but the landed push was green. follow-ups: none. </details>
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue-515
issue-486
issue-529
issue-500
issue-483
No results found.
Labels
Clear labels   
burndown-2026-06
Backlog burndown June 2026

  
coherence-core
Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  
consult
A human decision, design, or external action must happen first. Fail-closed default for unlabeled/low-confidence.

  
headless
Agent can take it from open issue to merged change with no human in the loop. The auto-burndown queue.

  
interactive
Agent does the work but pauses at a human checkpoint mid-flight (design choice, destructive step, human-only verification).

  
P0
now / blocking / urgent

  
P1
next / important

  
P2
backlog / will do

  
P3
someday / low

  
P4
icebox / frozen / reopen if it becomes real

No labels
burndown-2026-06
coherence-core
consult
headless
interactive
P0
P1
P2
P3
P4
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
coilyco-flight-deck/infrastructure#467
No description provided.