Apply Forgejo runner registration token TTL to build and tap-writer runners #511

New issue

Closed

opened 2026-07-09 22:02:14 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-09 22:02:14 +00:00

Member

Problem

The deploy runner auto-rotation follow-up is tracked in infrastructure#510, but the same persistent .runner pattern exists on the other Forgejo runner StatefulSets:

deploy/forgejo-runner.yml - build runners, 4 replicas, /data/.runner on a PVC.
deploy/forgejo-runner-tap-writer.yml - tap writer, 1 replica, /data/.runner on a PVC.

Each init container skips registration whenever .runner exists, so runner auth tokens can live indefinitely until a manual PVC/config cleanup.

Desired behavior

Apply the same bounded .runner TTL policy to all Forgejo runner StatefulSets, not just forgejo-runner-deploy:

Keep ordinary pod restarts stable.
If /data/.runner is older than the chosen TTL, remove it before registration.
Re-register with the same labels and runner names.
Avoid logging token material.
Document the policy once so operator rotation and automatic rotation are coherent.

Notes

This should coordinate with infrastructure#510. If #510 lands a shared shell snippet or doc pattern, reuse it rather than inventing a second implementation.

## Problem The deploy runner auto-rotation follow-up is tracked in infrastructure#510, but the same persistent `.runner` pattern exists on the other Forgejo runner StatefulSets: - `deploy/forgejo-runner.yml` - build runners, 4 replicas, `/data/.runner` on a PVC. - `deploy/forgejo-runner-tap-writer.yml` - tap writer, 1 replica, `/data/.runner` on a PVC. Each init container skips registration whenever `.runner` exists, so runner auth tokens can live indefinitely until a manual PVC/config cleanup. ## Desired behavior Apply the same bounded `.runner` TTL policy to all Forgejo runner StatefulSets, not just `forgejo-runner-deploy`: - Keep ordinary pod restarts stable. - If `/data/.runner` is older than the chosen TTL, remove it before registration. - Re-register with the same labels and runner names. - Avoid logging token material. - Document the policy once so operator rotation and automatic rotation are coherent. ## Notes This should coordinate with infrastructure#510. If #510 lands a shared shell snippet or doc pattern, reuse it rather than inventing a second implementation.

coilyco-ops added the

headless

labels

2026-07-09 22:02:14 +00:00

coilyco-ops commented

2026-07-09 22:02:37 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-infrastructure-511 on host kais-macbook-pro-2.local.

Reserved by ward agent --harness codex (reserved 2026-07-09T22:02:34Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL). --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/infrastructure#511 · branch issue-511 · harness codex · workflow direct-to-main
Run: engineer-codex-infrastructure-511 · ward v0.493.0 · dispatched 2026-07-09T22:02:34Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.493.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-infrastructure-511` on host `kais-macbook-pro-2.local`. Reserved by `ward agent --harness codex` (reserved 2026-07-09T22:02:34Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL). `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/infrastructure#511` · branch `issue-511` · harness `codex` · workflow `direct-to-main` - **Run:** `engineer-codex-infrastructure-511` · ward `v0.493.0` · dispatched `2026-07-09T22:02:34Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.493.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a commit

2026-07-09 22:14:21 +00:00

feat(forgejo): bound runner registration tokens

coilyco-ops closed this issue

2026-07-09 22:14:21 +00:00

coilyco-ops commented

2026-07-09 22:16:00 +00:00

Author

Member

WARD-OUTCOME: done ✅

details

workflow: direct-to-main; review summary: review gate skipped by ~/.ward/config.yaml default
retrospective: the change felt routine once I dropped the stale local snippet and kept the remote deploy-runner TTL work as the source of truth.
confidence: high
surprises: origin/main advanced mid-run, so I had to merge the sibling TTL landing and preserve the unrelated staged tree already in the repo.
follow-ups: none

WARD-OUTCOME: done ✅ <details><summary>details</summary> workflow: direct-to-main; review summary: review gate skipped by ~/.ward/config.yaml default retrospective: the change felt routine once I dropped the stale local snippet and kept the remote deploy-runner TTL work as the source of truth. confidence: high surprises: origin/main advanced mid-run, so I had to merge the sibling TTL landing and preserve the unrelated staged tree already in the repo. follow-ups: none </details>