feat(libation): seed the token master key onto the PVC

TokenStorageMethod is Encrypted and the container has no OS secret store, so LibationCli falls back to minting a portable master key at /config-internal/libation-master.key -- a path that is not a mounted volume. The key is therefore new on every run and discarded at exit, which is why the entrypoint logs LAST-RESORT on each pass. The entrypoint looks for the key at ${LIBATION_CONFIG_DIR}/ libation-master.key, i.e. on the PVC, and copies it into place when found. The key is now stored in OpenBao alongside the other bootstrap files, so seed it like them: without it a rebuilt PVC would hold tokens encrypted under a key that no longer exists. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix(libation): persist refreshed Audible tokens back to the PVC
2026-09-16 18:47:24 +02:00 · 2026-09-16 18:26:49 +02:00
1 changed files with 24 additions and 3 deletions
@@ -42,9 +42,11 @@ spec:
              type: RuntimeDefault
          initContainers:
            # Seed the libation-config PVC from the bootstrap secret on
-            # first run only — sentinel file gates re-runs so token
-            # refreshes in AccountsSettings.json and DB updates from
-            # subsequent liberate passes are preserved.
+            # first run only — sentinel file gates re-runs so DB updates
+            # from subsequent liberate passes are preserved. Refreshed
+            # Audible tokens are preserved by the container args, not by
+            # this sentinel: the entrypoint copies AccountsSettings.json
+            # into ephemeral /config-internal rather than symlinking it.
            - name: seed-config
              image: busybox:1.37.0
              command: ["/bin/sh", "-eu", "-c"]
@@ -66,6 +68,11 @@ spec:
                  install -m 660 /bootstrap/AccountsSettings.json /libation-state/AccountsSettings.json
                  install -m 660 /bootstrap/Settings.json          /libation-state/Settings.json
                  install -m 660 /bootstrap/LibationContext.db     /libation-state/LibationContext.db
+                  # Without this key the seeded tokens cannot be decrypted:
+                  # TokenStorageMethod is Encrypted and the container has no
+                  # OS secret store, so a missing key file makes the
+                  # entrypoint mint a throwaway one on every run.
+                  install -m 660 /bootstrap/libation-master.key   /libation-state/libation-master.key
                  touch /libation-state/.bootstrapped
                  ls -la /libation-state
              volumeMounts:
@@ -88,6 +95,20 @@ spec:
              # Pinned by digest: Spegel caches mutable tag resolutions, so
              # :latest stayed on 13.7.11 despite imagePullPolicy Always.
              image: docker.io/rmcrackan/libation:14.2.1@sha256:6f9d8ba19dc3803dd6ba295ab5a7abfb6ff3bc06286eebf4ecd8ccbe43245888
+              # The entrypoint stages config into ephemeral /config-internal
+              # by copy (only the DB is symlinked to the PVC), so Audible
+              # tokens refreshed during a run are lost at container exit.
+              # Passing args makes the entrypoint set up the environment and
+              # then exec this instead of its own loop; the trap copies the
+              # refreshed file back to the PVC on every exit path.
+              args:
+                - /bin/sh
+                - -c
+                - |
+                  trap 'cp /config-internal/AccountsSettings.json /libation-state/AccountsSettings.json' EXIT
+                  set -e
+                  /libation/LibationCli scan
+                  /libation/LibationCli liberate
              env:
                - name: LIBATION_CONFIG_DIR
                  value: /libation-state