chart: let the ingress carry TLS, and stop shipping a job to read a log #23

Merged

PerishFire merged 1 commit from chart-shrink into main

2026-07-21 13:04:52 +00:00

PerishFire commented

2026-07-21 13:00:35 +00:00

Owner

No description provided.

PerishFire added 1 commit

2026-07-21 13:00:35 +00:00

chart: let the ingress carry TLS, and stop shipping a job to read a log

guard / guard (pull_request) Successful in 4m7s

Details

9f655b9b70

The ingress could not express TLS at all: no annotations, no tls block,
and no values to inject either. It gains both, so a cluster holding a
default certificate can be asked for TLS without naming one, and a
cluster that issues per host can pass a secretName the usual way.
Annotations render through range plus quote, because a value that arrives
as a bare true is rejected by the API server and the template should not
depend on the caller quoting it.

The genesis job is deleted, along with its ServiceAccount, Role and
RoleBinding. It captured the sudo token out of the api log into a
<rel>-sudo Secret, but nothing in the cluster ever consumed that Secret —
the only reader was a human, following NOTES.txt. So a namespace-scoped
grant to read every pod log and write secrets, a third-party image, and
about ninety lines of chart existed to move a string from one place a
person can read to another. NOTES.txt now says to read the log directly,
and says to do it before the pod restarts, which is the same race the job
had and never actually closed.

Neither change alters what the token is or how it is minted. Making
bind() return it, so the api could persist it to the vault volume that
already exists, remains the keel-side fix.

Also drops "pinned" from the negentropy workflow step name, which stopped
being true one commit ago.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

PerishFire merged commit eff91e862b into main

2026-07-21 13:04:52 +00:00

PerishFire deleted branch chart-shrink

2026-07-21 13:04:52 +00:00

PerishFire referenced this pull request from a commit

2026-07-21 13:04:53 +00:00

chart: let the ingress carry TLS, and stop shipping a job to read a log (#23)