arcodange-org/tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(vault): erp prod runtime may read the shared GCS backup creds (kv_read_paths) #5

Merged
arcodange merged 1 commits from claude/erp-backup-vault-read into main 2026-06-30 17:40:34 +02:00
Conversation 0 Commits 1 Files Changed 5 +26 -5
arcodange commented 2026-06-30 16:29:46 +02:00
Owner
Copy Link

Active les creds du CronJob de backup Dolibarr dédié (erp#32) sans dupliquer de secret ni emprunter le secret Longhorn cross-namespace.

Ajoute une liste optionnelle kv_read_paths au module app_policy (défaut []) : la policy runtime env=prod d'une app peut lire des paths kvv2 supplémentaires. Plumbée dans le schéma applications + l'appel du module (règle dynamic, read+list).

Posée pour erp :

kv_read_paths = ["kvv2/data/longhorn/gcs-backup"]

→ le VaultStaticSecret du CronJob (chart erp, gated) lit les creds HMAC GCS existants avec le rôle Vault d'erp.

Surface : no-op pour toutes les autres apps (défaut []). Seule la policy runtime erp gagne une règle read,list. Validé tofu init (graphe parse OK ; l'erreur validate restante = auth JWT du provider, fournie par la CI).

🤖 Generated with Claude Code

Active les creds du **CronJob de backup Dolibarr dédié** ([erp#32](https://gitea.arcodange.lab/arcodange-org/erp/pulls/32)) sans dupliquer de secret ni emprunter le secret Longhorn cross-namespace. Ajoute une liste optionnelle **`kv_read_paths`** au module `app_policy` (défaut `[]`) : la policy runtime **env=prod** d'une app peut lire des paths kvv2 supplémentaires. Plumbée dans le schéma `applications` + l'appel du module (règle `dynamic`, `read`+`list`). Posée pour erp : ```hcl kv_read_paths = ["kvv2/data/longhorn/gcs-backup"] ``` → le `VaultStaticSecret` du CronJob (chart erp, gated) lit les creds HMAC GCS existants avec le rôle Vault d'erp. **Surface :** no-op pour toutes les autres apps (défaut `[]`). Seule la policy runtime `erp` gagne **une** règle `read,list`. Validé `tofu init` (graphe parse OK ; l'erreur `validate` restante = auth JWT du provider, fournie par la CI). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
arcodange added 1 commit 2026-06-30 16:29:48 +02:00
feat(vault): erp prod runtime may read the shared GCS backup creds (kv_read_paths)
All checks were successful
Helm Charts / Detect changed charts (push) Successful in 21s
Details
Helm Charts / Library charts tool (push) Has been skipped
Details
Helm Charts / Application charts pgcat (push) Has been skipped
Details
Helm Charts / Detect changed charts (pull_request) Successful in 14s
Details
Helm Charts / Library charts tool (pull_request) Has been skipped
Details
Helm Charts / Application charts pgcat (pull_request) Has been skipped
Details
2953ec3202 
Adds an optional kv_read_paths list to the app_policy module (default []) so an
app's env=prod runtime policy can read extra kvv2 data paths — e.g. a shared
backup-creds path owned by another app. Plumbed through the root applications
schema + module call (dynamic rule, read+list).

Set for erp: kv_read_paths = ["kvv2/data/longhorn/gcs-backup"], so the dedicated
Dolibarr backup CronJob (erp chart, gated) can read the existing GCS HMAC creds
via its own VaultStaticSecret instead of borrowing the Longhorn secret
cross-namespace or duplicating credentials.

No-op for every other app (default []). Only the `erp` runtime policy gains one
read+list rule.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
arcodange merged commit 5b24738dcf into main 2026-06-30 17:40:34 +02:00
arcodange deleted branch claude/erp-backup-vault-read 2026-06-30 17:40:35 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
arcodange
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: arcodange-org/tools#5
Delete Branch "claude/erp-backup-vault-read"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?