unkinben
57691ef1d5
CNPG WAL archiving to Ceph RGW fails with CERTIFICATE_VERIFY_FAILED on six clusters because the reflected vault-ca-cert bundle carries a corrupt intermediate: the genuinely-signed cert has a typo'd AIA URL (vault.servuce.consul), and the committed copy was text-edited at some point to fix the typo — flipping one byte of signed data and invalidating the signature (openssl verify: error 7 certificate signature failure). Only radosgw surfaces it because it serves a bare leaf, forcing clients to verify the stored intermediate against the root; services presenting their own intermediate never exercised the corrupt copy. terraform-k8s's copy is defunct per Ben — this file is the authoritative source. - restore the original signed intermediate (one base64 character; sha256 E0:13:1B..., verified against the root, and the resulting bundle validates the live s3.ceph.unkin.net leaf) - add an explicit allow-plain-secret marker mechanism to ci/validate-no-secrets.sh for public-data bootstrap secrets, and mark vault-ca-cert.yaml with it (a CA bundle is public and cannot be Vault-sourced since it establishes Vault trust) After merge+sync the reflector propagates to all namespaces and barman's next retry (~1min) succeeds; base backups run on tonight's schedule. Follow-ups worth considering: re-issue the intermediate in Vault with a corrected AIA URL, and/or configure radosgw to serve its intermediate. Reviewed-on: #305 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
28 lines
970 B
Bash
Executable File
28 lines
970 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Check staged files for plain Kubernetes Secrets
|
|
ERRORS=0
|
|
|
|
while IFS= read -r -d '' file; do
|
|
# Skip if file doesn't exist (e.g., deleted files)
|
|
[[ -f "$file" ]] || continue
|
|
|
|
# Check if the file contains a plain Kubernetes Secret
|
|
if grep -q "^kind: Secret" "$file"; then
|
|
# Explicit opt-out for public-data bootstrap secrets (e.g. the CA bundle
|
|
# that establishes Vault trust and therefore cannot be Vault-sourced).
|
|
if grep -q "^# pre-commit: allow-plain-secret" "$file"; then
|
|
continue
|
|
fi
|
|
# Allow secure secret types
|
|
if ! grep -q -E "^kind: (SealedSecret|ExternalSecret|VaultStaticSecret|VaultDynamicSecret)" "$file"; then
|
|
echo "BLOCKED: $file contains a plain Kubernetes Secret" >&2
|
|
echo " Use VaultStaticSecret or VaultDynamicSecret instead" >&2
|
|
((ERRORS++))
|
|
fi
|
|
fi
|
|
done < <(git diff --cached --name-only --diff-filter=ACM -z | grep -zE '\.(yaml|yml)$')
|
|
|
|
exit $ERRORS
|