unkin-agent
221c575a44
## Why arrproxy v0.5.0 ships per-token HTTP method scoping for machine tokens, so a minted token can be limited to e.g. `GET` only. Zero-downtime: the mint-API field is additive and existing tokens get an empty methods list, which means unrestricted — they behave exactly as before. ## How - Bump `arrproxy-api` and `arrproxy-ui` pins from v0.4.0 to v0.5.0. - Mirror repo migrations `0002_tier_tokens.sql` and `0003_token_methods.sql` into the migrations ConfigMap. It had drifted at 0001 while v0.4.0 already queried `tier`/`read_only`, and every v0.5.0 token query selects `methods` — without this the new API errors on every token read. - Have the wave-1 migrate Job apply all three files in order. Every statement is `IF NOT EXISTS`, so a resync over an already-migrated database is a no-op. Rendered `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` diff vs main is exactly the two image tags, the two added ConfigMap keys, and the two added `-f` args. Reviewed-on: #443 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
43 lines
2.0 KiB
YAML
43 lines
2.0 KiB
YAML
---
|
|
# arrproxy schema, mirrored from the arrproxy repo migrations/ (v0.5.0).
|
|
# arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies these in
|
|
# order once per sync as the app user. Every statement is idempotent, so a resync
|
|
# over an already-migrated database is a no-op. Keep in sync with the repo on
|
|
# schema bumps.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: arrproxy-migrations
|
|
namespace: arrstack
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
data:
|
|
0001_init.sql: |
|
|
-- arrproxy token store. Only token hashes are persisted; plaintext is shown
|
|
-- once at mint time and never recoverable.
|
|
CREATE TABLE IF NOT EXISTS tokens (
|
|
id TEXT PRIMARY KEY,
|
|
subject TEXT NOT NULL,
|
|
label TEXT NOT NULL DEFAULT '',
|
|
token_hash TEXT NOT NULL UNIQUE,
|
|
apps TEXT[] NOT NULL DEFAULT '{}',
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
expires_at TIMESTAMPTZ,
|
|
disabled BOOLEAN NOT NULL DEFAULT false,
|
|
last_used_at TIMESTAMPTZ
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
|
|
CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);
|
|
0002_tier_tokens.sql: |
|
|
-- Tier-scoped virtual API keys. Existing rows (tier '') remain legacy per-app
|
|
-- tokens validated on the unprefixed routes; tier keys carry a tier name and,
|
|
-- for read-only tiers (kids), read_only=true so writes are rejected.
|
|
ALTER TABLE tokens ADD COLUMN IF NOT EXISTS tier TEXT NOT NULL DEFAULT '';
|
|
ALTER TABLE tokens ADD COLUMN IF NOT EXISTS read_only BOOLEAN NOT NULL DEFAULT false;
|
|
0003_token_methods.sql: |
|
|
-- Per-token HTTP method scoping. An empty list (the default every existing row
|
|
-- gets) means unrestricted, so tokens minted before this column behave exactly
|
|
-- as before; a non-empty list limits the token to those methods.
|
|
ALTER TABLE tokens ADD COLUMN IF NOT EXISTS methods TEXT[] NOT NULL DEFAULT '{}';
|