Repository navigation
Add oap render: a GitOps-ready kustomize overlay for the install - #33
Open
josephschorr wants to merge 1 commit into
Open
josephschorr wants to merge 1 commit into
josephschorr wants to merge 1 commit into
Conversation
`oap install` brings a cluster up imperatively. `oap render` instead emits a self-contained kustomize overlay into deploy/oap for Argo CD / Flux to reconcile, never mutating the cluster — its only remote call is read-only image-digest resolution, skipped with --no-digest-pin. The overlay is a pure function of its flags, so re-rendering identical inputs is byte-identical and GitOps controllers see no phantom drift. It provisions every internal Secret, with nothing external by default: - A pre-start bootstrap Job (the operator image's `bootstrap-secrets` entrypoint) mints the memory tokens, admind token, passthrough key, NATS identity/TLS/client creds, and the SpiceDB + Postgres tokens — idempotently, before the operator and data plane start. The Job's name carries a hash of its pod template, so an operator-image upgrade yields a new Job object the controller prunes-and-creates rather than an immutable-pod-template apply conflict. - cert-manager (a self-signed Issuer + Certificate + ca-injector annotation on the webhook configuration) provisions the operator's webhook serving cert. All internal-secret minting is consolidated into pkg/platform/bootstrap as the single source; `oap install` delegates to it, and the operator's leader-elected bootstrap runnable is now schema-only. The NATS minting (identity/TLS/creds and the webd publish-surface grant, with its adversarial test) moved verbatim. Escape hatches: --external-spicedb / --external-postgres / --external-webhook-tls for instances you run yourself, and per-component --channelsd/--webd/--authzd- memory-token-secret links. webd's token must resolve to a different Secret than channelsd/authzd (effective-name compare, since the Job mints the defaults regardless of links): webd is browser-facing and its token is read-only, while channelsd/authzd tokens can write the audit log. `oap render --validate` lints the built overlay in-process (every non-optional Secret reference has a creator, AP_CLUSTER_KIND is stamped, first-party images are pinned); `oap check` verifies the memory-token Secrets after a sync. Only --with-postgres is offered among the dependency components — its token is Job-minted, so it works end to end; Graphiti/Neo4j need a user-supplied LLM key the overlay cannot mint, deferred to a follow-up. Guide: site/content/docs/gitops.mdx.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
oap renderemits a GitOps-ready kustomize overlay intodeploy/oapfor Argo CD / Flux — an alternative tooap installmutating a cluster directly. The overlay is a pure function of its flags (byte-identical re-render → no phantom drift) and provisions every internal Secret, with nothing external by default.How
bootstrap-secretsentrypoint) mints the memory/admind/passthrough/NATS/SpiceDB/Postgres secrets idempotently before the operator and data plane start. Its name carries a content hash, so an operator-image upgrade is a new Job object (prune-and-create) instead of an immutable-pod-template apply conflict.pkg/platform/bootstrapas the single source:oap installdelegates to it, the operator's leader-elected bootstrap runnable is now schema-only, and the NATS publish-surface grant moved verbatim with its adversarial test.--external-spicedb/--external-postgres/--external-webhook-tls, and per-component--channelsd/--webd/--authzd-memory-token-secretlinks. webd's token must resolve to a different Secret than channelsd/authzd (effective-name compare) — webd is browser-facing and read-only, the others can write the audit log.oap render --validatelints the built overlay (every non-optional Secret has a creator,AP_CLUSTER_KINDstamped, images pinned);oap checkverifies the memory tokens post-sync. Guide:site/content/docs/gitops.mdx.Scope notes
--with-postgresis the only dependency component offered — its token is Job-minted, so it works end to end. Graphiti/Neo4j need a user-supplied LLM key the overlay cannot mint; their GitOps support is a follow-up (oap installstill handles them).Tests
mage test:unitandmage test:integrationboth green. A fresh whole-branch code review was run; 4 findings were fixed via TDD (including one security-critical webd capability-leak guard bypass) and 2 minors deferred.