APS-4720: Stage edge signing secrets separately from Kong restart - #15
APS-4720: Stage edge signing secrets separately from Kong restart#15Elson9 wants to merge 9 commits into
Conversation
…mote after the hook
… the staged cert handoff
…s not nil-pointer
phowells
left a comment
phowells
left a comment
There was a problem hiding this comment.
Merge conflicts need to be resolved.
Keep the 0.3.5 reuse-values render check, and document that bootstrap is now a pre-upgrade hook.
|
@phowells fixed merge conflicts |
| `--reuse-values` persists flags in the release, so stage and promote must | ||
| clear one-shot values instead of only toggling `stageSecret`. | ||
|
|
||
| 1. Create a one-time CA token, then bootstrap with staging. Helm waits for |
There was a problem hiding this comment.
I think the merge changed the lifecycle behind this command. The bootstrap Job is now a pre-install,pre-upgrade hook, while the token Secret it mounts—and the ServiceAccount/RBAC it uses—are ordinary release resources. Helm runs the hook before those resources are created or updated, so a fresh install has neither dependency, and this staging upgrade will either see the previous token Secret or, after the documented promotion cleared it, no Secret at all. Could we make the hook dependencies earlier pre-hooks (using hook weights), or return this Job to the normal release lifecycle, and then exercise a post-merge stage → promote run? The earlier live test covered the pre-merge, non-hook behaviour.
There was a problem hiding this comment.
@phowells Agreed — the merge pulled in dev's pre-install,pre-upgrade hook while the token Secret and sdx-job-cert-bootstrap SA/RBAC stayed ordinary release resources, so a staging upgrade would run the Job before those were created or updated.
Hook-weighting the dependencies would also turn that SA into a hook, and the promote Job still uses it as a post-upgrade hook. Safer to put bootstrap back on the normal release lifecycle (this PR's original shape). Stage again uses --wait --wait-for-jobs.
I have not re-run stage → promote on a live edge since this revert; I can do that next on the same Gold pzgw path.
There was a problem hiding this comment.
@phowells Re-ran stage → promote on Gold pzgw / b8840c-dev (local chart) after the revert. Stage Job was a normal release resource, wrote client-next, Kong stayed at gen 133. Promote cleared the token with no immutable-spec error and rolled Kong to 134, then rotation.promote=false. Chart bumped to 0.3.7 so we do not republish over GHCR 0.3.6.
A pre-upgrade hook runs before the token Secret and ServiceAccount are created or updated, so staging would see a stale or missing Secret.
2 participants
Summary
bootstrap.stageSecretwrites{release}-client-nextwithout restarting.rotation.promotecopies the staged secret to live client/server TLS secrets and rolling-restarts Kong (chart 0.3.6).Test plan
stageSecret=truecreates-client-nextand skip Kong restart (helm template)rotation.promote=truepromotes next → live and restarts (helm template)