fix(009): strip shell quotes from RAUTHY_API_KEY in the pod Secret#59
Merged
Conversation
The SOPS value carried literal single quotes copied from a shell-style env line, so the backend's rauthy admin calls (spec 011 §5.1 identity resolution) sent an unknown key name and got 404 no-rows-returned. Verified the unquoted value authenticates (200) against live rauthy before re-encrypting. Value-only change inside the encrypted blob.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SOPS value for RAUTHY_API_KEY carried literal single quotes copied from a shell-style env line. The backend's rauthy admin API calls (spec 011 §5.1 GitHub-identity resolution) therefore sent an unknown key name and got 404 no-rows-returned, which would have failed acceptance item 1 (populated githubUserId/githubLogin) on the live walk.
Caught during 011 acceptance pre-flight; the unquoted value was verified to authenticate (HTTP 200, read-users scope) against live rauthy before re-encrypting. Value-only change inside the encrypted blob; the key set (34) and catalog are unchanged.
After merge: Flux applies the Secret, then the pod gets deleted (not rollout-restarted) so envFrom picks up the clean value.
Spec-Drift-Waiver: value-only fix inside the encrypted statecraft-secrets blob; no design change to spec 010's secret catalog or key set.