From 1f3369adc28461f3d05c82cd2062ce2f44e27d4b Mon Sep 17 00:00:00 2001 From: Bartek Kus <7887446+bartekus@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:03:36 -0600 Subject: [PATCH] feat(009,012): re-pin the Deployment to the spec 012 operator-dashboard image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Digest ce8edee5 (tag dfe27c1, the PR #55 merge): backend/obs/ + the gated admin surface + the frontend-admin bundle + app-model.json enter production, alongside the first deploy of the spec 011 tenant-lifecycle code. The one-time user_account ALTER (spec 011 §9) was applied to the live database before this pin; RAUTHY_API_KEY stays an open spec 011 operator act and degrades gracefully. Spec 009 records the re-pin. --- .../by-spec/009-control-plane-deploy.json | 2 +- .../by-spec/009-control-plane-deploy.json | 3 ++- .../statecraft-hetzner/statecraft/deployment.yaml | 15 ++++++++------- specs/009-control-plane-deploy/spec.md | 12 ++++++++++++ 4 files changed, 23 insertions(+), 9 deletions(-) diff --git a/.derived/codebase-index/by-spec/009-control-plane-deploy.json b/.derived/codebase-index/by-spec/009-control-plane-deploy.json index e35b41c..b9fc8d4 100644 --- a/.derived/codebase-index/by-spec/009-control-plane-deploy.json +++ b/.derived/codebase-index/by-spec/009-control-plane-deploy.json @@ -81,5 +81,5 @@ "specStatus": "approved" }, "schemaVersion": "1.1.0", - "shardHash": "de36b2b91cdecc01aadc858fe6c4b6f9b3351673e1e740c0eb0dec75d9e26066" + "shardHash": "9502ec116c9edf7b497e1b1556bf6a75fcdfa143b4b21db86ec968b23d0a1af4" } diff --git a/.derived/spec-registry/by-spec/009-control-plane-deploy.json b/.derived/spec-registry/by-spec/009-control-plane-deploy.json index ad79bad..7566709 100644 --- a/.derived/spec-registry/by-spec/009-control-plane-deploy.json +++ b/.derived/spec-registry/by-spec/009-control-plane-deploy.json @@ -50,6 +50,7 @@ "5.1 Bring-up outcome, 2026-07-21", "6. Human checkpoints", "7. Out of scope", + "Amendment (2026-07-22): re-pin to the spec 012 image", "Amendment (2026-07-22): spec 012 frontend-admin adoption, deploy env" ], "specPath": "specs/009-control-plane-deploy/spec.md", @@ -57,6 +58,6 @@ "summary": "Stand the control plane up on the spec 010 cluster as a platform-grade K8s deployment at app.statecraft.ing. Rewritten ground-up 2026-07-19 to the two-plane thesis (001 section 3), which unpauses it. The rewrite inverts the deploy's job: the published image is embedded-rauthy and self-seeds its own identity on first boot, so the shared-rauthy secret set is void, five of the eleven Encore secrets are discarded by the entrypoint if injected, and the /data volume becomes the identity anchor of the platform. What the deploy still owes the container: nine real secrets, the non-secret env, a Postgres URL, an ingress, and one seeder pass for the only thing first boot cannot seed (the upstream GitHub provider, which rauthy has no declarative bootstrap for). Operator surfaces gate on the custom statecraft_operator role, seeded here; rauthy_admin stays break-glass. Live bring-up is a human checkpoint.\n", "title": "The control-plane deploy: one governed container on the statecraft cluster" }, - "shardHash": "8825544b805aa6b0ef80ab3eef700714af5fbc7bab60b22919354b8db827c0b8", + "shardHash": "b4a0c075332734b13c529d7137363b0483b99b7e1dadebfcb484abd1587ccd01", "specVersion": "1.1.0" } diff --git a/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml b/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml index e4c87a2..99ee6f9 100644 --- a/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml +++ b/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml @@ -51,13 +51,14 @@ spec: - name: statecraft # Pinned by digest, never `:latest`. The tag is recorded alongside # for human legibility only; the digest is what is deployed. - # tag: 4d0a392 (009-proxy-secfetch, 2026-07-21) - the rauthy proxy - # strips Sec-Fetch-* so the GitHub upstream login callback is not - # blocked as a forged cors request (spec 002, fifth chassis hunk). The - # prior digest (baf41728, built from 2e3c9d7) added SMTP 587/STARTTLS - # but still corrupted Sec-Fetch-Mode in the proxy, so upstream login's - # return leg 400'd. - image: ghcr.io/statecrafting/statecraft@sha256:e4cc8b90f07b6d0ccd7074b1eecef94f1d262250aad240f0cec094b07dd90d9d + # tag: dfe27c1 (012-frontend-admin-adoption merge, 2026-07-22) - the + # operator dashboard adoption (spec 012): backend/obs/ (/metrics + + # the trace plane), backend/admin/ + the frontend-admin bundle gated + # on statecraft_operator, app-model.json in the image, and the spec + # 011 tenant-lifecycle code's first deploy (its user_account ALTER + # was applied to the live database before this pin). The prior + # digest (e4cc8b90, built from 4d0a392) is the Sec-Fetch proxy fix. + image: ghcr.io/statecrafting/statecraft@sha256:ce8edee50114b655859e8d5b8c9e37fc9c5934de1daa402b47a7a9bf6faa2bca imagePullPolicy: IfNotPresent ports: - name: http diff --git a/specs/009-control-plane-deploy/spec.md b/specs/009-control-plane-deploy/spec.md index 7e13b61..afd566f 100644 --- a/specs/009-control-plane-deploy/spec.md +++ b/specs/009-control-plane-deploy/spec.md @@ -1140,6 +1140,18 @@ Live bring-up is operator work, proposed here rather than performed. structural, not deferred tuning). - Re-homing the marketing site: the apex stays GitHub Pages. +## Amendment (2026-07-22): re-pin to the spec 012 image + +The Deployment moves to digest `ce8edee5` (tag `dfe27c1`, the spec 012 +merge): the first image carrying the operator dashboard (spec 012) and +the spec 011 tenant-lifecycle code. The spec 011 §9 one-time +`user_account` ALTER (github_user_id + github_login) was applied to the +live database before this pin (its stamp_job precursor already +existed), so the new image's auth store boots against a compatible +schema. `RAUTHY_API_KEY` remains unminted (spec 011's remaining +deploy-time act); github-identity resolution degrades to a logged +`no_api_key` skip until it exists, which blocks nothing in this deploy. + ## Amendment (2026-07-22): spec 012 frontend-admin adoption, deploy env Spec 012 makes one coordinated edit in this spec's deploy manifest