konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 9 Packages Projects Releases 1 Wiki Activity

fix(rotation): repin every rotator to a dated tag, not a digest #459

Merged
k.renner merged 4 commits from rotator-repin into master 2026-07-30 17:44:23 +00:00
Conversation 2 Commits 4 Files Changed 15
+61 -32
15 changed files with 61 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kubernetes/infrastructure/openbao/rotation/authentik.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["random"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/claude-oauth.yaml
+1 -1
View File
@@ -68,7 +68,7 @@ spec:
type: RuntimeDefault
containers:
- name: sync-woodpecker
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:828bf4863286411bfd7ef9fdff617586588050c814743bec601a9222692162e4
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["woodpecker-secret"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/cloudflare.yaml
+1 -1
View File
@@ -61,7 +61,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:978fe53cad83a8d55319f6201ecd171775a101b21aaa21b7ec3c7b14304c6a42
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["cloudflare-roll"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/crowdsec-bouncer-key.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["random"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/external-dns.yaml
+1 -1
View File
@@ -56,7 +56,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:978fe53cad83a8d55319f6201ecd171775a101b21aaa21b7ec3c7b14304c6a42
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["cloudflare-roll"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/flux-git.yaml
+1 -1
View File
@@ -84,7 +84,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:b41cc3645f144179dddaa5ab1d32282c57c257432a613c15a6e15634fd0c4b81
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["gitea-token"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/home-assistant.yaml
+3 -3
View File
@@ -68,7 +68,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["ha-token"]
securityContext:
allowPrivilegeEscalation: false
@@ -130,7 +130,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["ha-token"]
securityContext:
allowPrivilegeEscalation: false
@@ -192,7 +192,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["ha-token"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/kustomization.yaml
+40
View File
@@ -4,6 +4,46 @@ kind: Kustomization
# (intra-namespace OpenBao access → no NetworkPolicy needed). One file per rotated
# secret. The matching OpenBao policy/role for each lives in ../policies/ and is
# bootstrapped manually (not GitOps-managed).
#
# IMAGE PINNING: every rotator here uses a DATED TAG of secret-rotator
# (`:YYYY-MM-DD`), never a digest and never `:latest`. This is a registry-local
# image, so it does not need digest pinning, and a dated tag makes "what actually
# runs" a reviewable diff.
#
# Digests were tried and actively broke: untagged manifests are garbage-collected
# once :latest and the dated tags move past them, so a digest pinned today stops
# resolving after a few rebuilds. That decay is driven by edits to
# .woodpecker/build-ci-images.yml — a shared file — so adding an UNRELATED image
# republishes secret-rotator and orphans the manifest every rotator here was
# pinned to. 11 of these were pinned to digests that no longer existed and would
# have ImagePullBackOff'd on their first scheduled run (issue #458); because they
# are quarterly, that would have looked like nothing happening rather than like a
# failure.
#
# Keep them all on one tag: it is a single binary containing every mode
# (random | ha-token | cloudflare-roll | netbird-key | proxmox-token |
# gitea-token | woodpecker-secret), so a split serves no purpose and just makes
# the next bump partial.
#
# ADDING A ROTATOR: copy an existing file, and check you did not inherit a
# digest pin from an older example — nothing enforces this automatically, so it
# is easy to reintroduce silently and the failure only shows up months later on
# the first scheduled run:
#
# grep -l 'image:.*@sha256' \
# kubernetes/infrastructure/openbao/rotation/*.yaml | grep -v kustomization.yaml
#
# (want: no output. The trailing filter is not padding — this file documents the
# pattern, so it necessarily matches its own grep. Verified both directions:
# silent across this directory as it stands, and it still reports a file that
# actually carries an `image: …@sha256:` pin.)
#
# BUMPING the tag: verify the new one exists BEFORE committing — a tag that was
# never built fails exactly like the digests did, and just as quietly:
#
# kubectl run tagcheck --rm -i --restart=Never \
# --image=gitea.renner.uno/gitea_admin/secret-rotator:<DATE> \
# --command -- /secret-rotator # prints the usage/mode list if the tag resolves
resources:
- paperless.yaml
- woodpecker.yaml
kubernetes/infrastructure/openbao/rotation/mosquitto-health.yaml
+5 -16
View File
@@ -88,22 +88,11 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
# DATED TAG, not a digest and never :latest — this is our own
# image, so it does not need digest pinning, and a floating tag
# would make what runs here unreviewable.
#
# Deliberately NOT copying the sibling rotators' digest pins: those
# digests NO LONGER EXIST in the registry (verified by pulling them
# — NotFound), because untagged manifests are garbage-collected
# once :latest and the dated tags move past them. 11 of the 14
# existing rotators are pinned that way and will ImagePullBackOff
# on their first run — see issue #458. Copying the convention would
# have shipped a CronJob broken from the day it was written.
#
# Verified for THIS tag: it pulls, `random` is among its modes, and
# it carries the RANDOM_BYTES>=16 floor documented below
# (RANDOM_BYTES=8 exits "refusing to generate a weak secret").
# Bumping the date is a deliberate, reviewable edit.
# Dated tag, per the convention documented in kustomization.yaml —
# every rotator here now uses the same one. Verified for this tag:
# it pulls, `random` is among its modes, and it carries the
# RANDOM_BYTES>=16 floor documented below (RANDOM_BYTES=8 exits
# "refusing to generate a weak secret").
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["random"]
securityContext:
kubernetes/infrastructure/openbao/rotation/netbird-ingress.yaml
+1 -1
View File
@@ -59,7 +59,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:49bfddd8eeb5fd871cbeb05bc3b4e2fcaaab7d9e24cc3007caae6084b4634c18
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["netbird-key"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/paperless.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["random"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/pve-exporter.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:97c22bcff324a93d2bb7bf3adb2894b405ed1a8035d02ad1ff6baced3813cefe
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["proxmox-token"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/review-bot.yaml
+2 -2
View File
@@ -81,7 +81,7 @@ spec:
type: RuntimeDefault
initContainers:
- name: rotate-mint
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:828bf4863286411bfd7ef9fdff617586588050c814743bec601a9222692162e4
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["gitea-token"]
securityContext:
allowPrivilegeEscalation: false
@@ -128,7 +128,7 @@ spec:
memory: 48Mi
containers:
- name: sync-woodpecker
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:828bf4863286411bfd7ef9fdff617586588050c814743bec601a9222692162e4
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["woodpecker-secret"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/shelly-manager.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["random"]
securityContext:
allowPrivilegeEscalation: false
kubernetes/infrastructure/openbao/rotation/woodpecker.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
type: RuntimeDefault
containers:
- name: rotate
image: gitea.renner.uno/gitea_admin/secret-rotator@sha256:159e5888ff4e23f5fe7fb1284711d81591635f840888e61402af311b0a76ba92
image: gitea.renner.uno/gitea_admin/secret-rotator:2026-07-30
args: ["random"]
securityContext:
allowPrivilegeEscalation: false