Repository navigation
fix(openbao): grant external-secrets role write/read on apps/actual-budget path - #2343
Merged
devantler merged 1 commit intoJun 29, 2026
Merged
Conversation
…udget path PR #2331 added the `seed-actual-budget-enablebanking` PushSecret (writes secret/data/apps/actual-budget/enablebanking) and the actual-budget `external-secret-enablebanking` ExternalSecret (reads it), both via the `openbao` ClusterSecretStore → `external-secrets` Kubernetes auth role. But the OpenBao policies that role carries were never updated for the new apps/actual-budget path, so the PushSecret got 403 permission denied: GET .../v1/secret/data/apps/actual-budget/enablebanking Code: 403 ... permission denied The PushSecret stuck at InProgress, which failed the infrastructure Kustomization health check (20m timeout) and in turn blocked the apps Kustomization (dependency not ready) — i.e. a full reconcile stall in prod. Root cause: the policy set in the vault-config Job lists every other app path (fleetdm, wedding-app, umami, crossview, ...) but not actual-budget. Fix mirrors the crossview pattern exactly: - new `app-actual-budget-readonly` policy (read on secret/data/apps/actual-budget/*) - add actual-budget data+metadata paths to `vault-seed-write` (create/update/read) - add `app-actual-budget-readonly` to the `external-secrets` role policy list The Job carries `kustomize.toolkit.fluxcd.io/force: enabled`, so Flux recreates it on the next reconcile and re-applies the policies; the PushSecret then syncs and infrastructure → apps unblocks. Validated: `kubectl kustomize k8s/clusters/{local,prod}` and the hetzner infrastructure overlay all build; job dry-run applies clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Vault configuration job gains ACL support for the Vault ACL for actual-budget
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
🎉 This PR is included in version 1.88.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
devantler
added a commit
that referenced
this pull request
Jun 30, 2026
…subst (#2349) With the infrastructure→apps stall cleared (#2343), the apps Kustomization finally reconciled past its dependency gate and immediately failed: post build failed for 'ConfigMap/actual-budget-enablebanking-seed': envsubst error: variable substitution failed: unable to parse variable name The ConfigMap (added in #2331) embeds a Node.js reconcile script that uses JS template literals — `${DB_PATH}`, `${name}`, and crucially a multi-line `${ INTERVAL / 1000 }`. The apps Kustomization runs `substituteFrom`, so Flux's envsubst tries to expand these; the newline inside `${ ... }` can't be parsed as a variable name, which fails the WHOLE apps Kustomization (every app blocked). This was latent: apps never reconciled after #2331 merged because it was blocked on the infrastructure dependency (the PushSecret 403, #2343), so the error only surfaced once infrastructure went healthy. These are not Flux variables, so the ConfigMap needs no post-build substitution. Opt it out with `kustomize.toolkit.fluxcd.io/substitute: disabled` — the same pattern the KRO ResourceGraphDefinitions use for their CEL `${...}` expressions. Validated: kubectl kustomize k8s/clusters/{local,prod} and the actual-budget base build; rendered ConfigMap carries the annotation; dry-run applies clean. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 4, 2026
Closed
This was referenced Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem (live prod stall)
The prod
flux-system/infrastructureKustomization was stuckUnknown(Reconciliation in progress →HealthCheckFailedafter 20m), which in turn blockedflux-system/appswithdependency 'flux-system/infrastructure' is not ready.Root cause traced to the
seed-actual-budget-enablebankingPushSecret, stuckInProgress:Root cause
#2331 added both the PushSecret (writes
secret/data/apps/actual-budget/enablebanking) and the actual-budgetexternal-secret-enablebankingExternalSecret (reads it), both routed through theopenbaoClusterSecretStore →external-secretsKubernetes auth role. But the OpenBao policies that role carries (defined ink8s/bases/infrastructure/vault-config/job.yaml) were never extended to the newapps/actual-budgetpath — they list every other app (fleetdm, wedding-app, umami, crossview, …) but not actual-budget. Result: 403 on write, PushSecret never syncs, infra health check times out, apps blocked.Fix
Mirrors the existing crossview pattern exactly:
app-actual-budget-readonlypolicy —readonsecret/data/apps/actual-budget/*data+metadatapaths tovault-seed-write(create/update/read) so the PushSecret can seedapp-actual-budget-readonlyto theexternal-secretsrole policy listThe Job carries
kustomize.toolkit.fluxcd.io/force: enabled(and the infra Kustomization hasforce: true), so Flux recreates it on the next reconcile, re-applies the policies, the PushSecret syncs, andinfrastructure → appsunblocks.Validation
kubectl kustomize k8s/clusters/local/✅kubectl kustomize k8s/clusters/prod/✅kubectl kustomize k8s/providers/hetzner/infrastructure/✅ (renders the new path)kubectl apply --dry-run=clienton the Job ✅