3 Commits

Author	SHA1	Message	Date
shankar0123	47da13e7a1	fix(helm): close BUNDLE 3 — Helm chart hardening + enterprise deploy ... Bundle 3 closure (2026-05-12 acquisition diligence audit). Closes the "chart claims production-ready but lying-fields silently break it" hazard cluster: README install command had wrong key, required secrets weren't fail-fast, external Postgres rendered the bundled StatefulSet hostname, container-only security hardening fields landed at pod scope (silently dropped by K8s API), and three advertised template surfaces (ServiceMonitor, PodDisruptionBudget, NetworkPolicy) didn't render at all even when their values.yaml toggles were on. Source findings closed: C2 C3 D1 D2 D3 D5 D7 D11 D12 (repo audit) OPS-L1 OPS-L2 (cowork audit) Source findings explicitly deferred (tracked in WORKSPACE-ROADMAP.md): D6 OPS-H1 (backup automation — operator must choose target storage) D10 (digest pinning of latest `:latest` tags) OPS-M1 (prometheus/client_golang migration) OPS-M2 (distributed tracing instrumentation) Chart truth table (rendered with helm 3.16.3): -f values.yaml + tls.existingSecret + auth.apiKey + pg.auth.password → 12 resources (default mode, no monitoring/PDB/networkpolicy) + postgresql.enabled=false + externalDatabase.url=… → NO StatefulSet, NO postgres-secret, NO postgres-service (D2) + server.tls.certManager.enabled=true → +1 Certificate (cert-manager mode) + replicas=3 + monitoring.enabled=true + serviceMonitor.enabled=true + podDisruptionBudget.enabled=true + networkPolicy.enabled=true → +1 ServiceMonitor + 1 PodDisruptionBudget + 1 NetworkPolicy (D5+D11) tls.existingSecret AND tls.certManager.enabled both set → REFUSED with "EXACTLY ONE TLS ownership path" error (D7) Missing required secrets (apiKey / pg password / external URL) → REFUSED at template time with operator-actionable guidance (D1) Closures by source ID: C2 — README Helm install example fixed. Was `--set postgresql.password=…` (does not exist); now `--set postgresql.auth.password=…` matching the chart key. README install block also wires TLS, mentions fail-fast at template time, and links the external-Postgres example. C3 — Kubernetes Secrets connector annotated PREVIEW in values.yaml. The chart still exposes `kubernetesSecrets.enabled` for the RBAC preview wiring, but the values block now states clearly that the production K8s client at internal/connector/target/k8ssecret/ k8ssecret.go::realK8sClient is a stub (verified — go.mod imports zero k8s.io/client-go packages). Production landing tracked in WORKSPACE-ROADMAP.md. D1 — `certctl.requiredSecrets` template helper. Fail-fasts at render time when (a) server.auth.type=api-key + apiKey empty, (b) postgresql.enabled=true + pg.auth.password empty, (c) postgresql.enabled=false + externalDatabase.url + legacy env CERTCTL_DATABASE_URL all empty. Each branch emits an operator-actionable diagnostic with the openssl rand command or values override needed. postgres-secret template additionally uses Helm's `required` builtin so it can't render with the empty fallback that pre-Bundle-3 produced ("changeme" literal). D2 — externalDatabase.url first-class. New top-level values block. certctl.databaseURL helper now branches on postgresql.enabled: bundled path uses the helper-emitted in-cluster URL; external path uses externalDatabase.url verbatim. postgres-secret, postgres-statefulset, and postgres-service ALL gate on postgresql.enabled — external mode renders ZERO postgres-* resources. POSTGRES_PASSWORD env in server-deployment also gates. D3 — Container-vs-pod security context split. K8s API silently drops readOnlyRootFilesystem / allowPrivilegeEscalation / capabilities / privileged when they land at pod scope (`spec.securityContext`); they only work at container scope (`spec.containers[].securityContext`). Pre-Bundle-3 all fields sat at pod scope so the chart's documented "read-only rootfs + drop-all caps" hardening was effectively unenforced. New certctl.podSecurityContext + containerSecurityContext helpers split the operator-facing securityContext map by field-name whitelist so existing values keep working byte-for-byte while fields render at the K8s-valid scope. Applied to both server-deployment.yaml and agent-daemonset.yaml (DaemonSet + Deployment branches). D5 — Prometheus ServiceMonitor template. New templates/servicemonitor.yaml. Renders when monitoring.enabled AND monitoring.serviceMonitor.enabled. Scrapes /api/v1/metrics/prometheus (rbac-gated on metrics.read — needs bearerTokenSecret with an API key holding that perm). values.yaml block extended with bearerTokenSecret, tlsConfig, and relabelings knobs and the operator-facing comment documenting the auth requirement. D7 — TLS both-set rejection. certctl.tls.required helper extended. Pre-Bundle-3 only the NEITHER-set case was caught; setting BOTH rendered a dangling cert-manager Certificate alongside an existing-Secret mount, two conflicting TLS sources of truth. Now refuses with "EXACTLY ONE TLS ownership path" + remediation steps for both possible operator intents. D11 — PodDisruptionBudget + NetworkPolicy templates. New templates/pdb.yaml (renders when podDisruptionBudget.enabled + server.replicas > 1) + templates/networkpolicy.yaml (renders when networkPolicy.enabled). PDB uses minAvailable / maxUnavailable exclusivity per K8s spec. NetworkPolicy default-allows in-namespace agent → server traffic, kube-DNS egress, and bundled-postgres egress (when postgresql.enabled), with operator-extensible extraIngress / extraEgress for CA / OIDC / SMTP egress. Both default off so existing deploys don't lose network reach unannounced. D12 — Database max-conn config wired. Pre-Bundle-3 internal/repository/postgres/db.go::NewDB hard-coded SetMaxOpenConns(25). config.go loaded CERTCTL_DATABASE_MAX_CONNS, Validate() enforced the >= 1 floor, values.yaml documented it, and docs/reference/configuration.md surfaced it — but the pool ignored every operator setting. New NewDBWithMaxConns threads the operator value into the pool with maxIdle = maxOpen / 5 (≥ 1) so the historical ratio carries forward. cmd/server/main.go calls the new constructor; NewDB stays for compat at the default 25. OPS-L1 — Chart version 0.1.0 → 1.0.0. Chart has shipped through 8 audit closures since 2026-02 (M-018, U-1, U-2, U-3, H-1, G-1, B1, B2); pre-1.0 version was implying instability the chart no longer has. OPS-L2 — External-Postgres path is now properly documented in values.yaml (externalDatabase block with mode-2 example), README install command links the existing examples/values-external-db.yaml, and the chart truth table above proves the external mode renders cleanly. Receipts: helm lint deploy/helm/certctl/ # clean helm template c deploy/helm/certctl/ \ --set server.tls.existingSecret=ci \ --set postgresql.auth.password=p \ --set server.auth.apiKey=k # 12 kinds, default helm template c deploy/helm/certctl/ \ --set server.tls.existingSecret=ci \ --set postgresql.enabled=false \ --set externalDatabase.url='postgres://u:p@h:5432/db?sslmode=require' \ --set server.auth.apiKey=k # 9 kinds, no postgres-* helm template c deploy/helm/certctl/ \ --set server.tls.certManager.enabled=true \ --set server.tls.certManager.issuerRef.name=letsencrypt \ --set postgresql.auth.password=p --set server.auth.apiKey=k # +1 Certificate (cert-manager) helm template c deploy/helm/certctl/ \ --set server.tls.existingSecret=ci \ --set postgresql.auth.password=p --set server.auth.apiKey=k \ --set server.replicas=3 \ --set monitoring.enabled=true \ --set monitoring.serviceMonitor.enabled=true \ --set podDisruptionBudget.enabled=true \ --set networkPolicy.enabled=true # +ServiceMonitor +PDB +NetworkPolicy (TLS both-set + missing apiKey + missing pg password + missing extDb URL all REFUSED.) gofmt -l # clean go vet ./internal/repository/postgres ./cmd/server # clean go build ./cmd/server # clean bash scripts/ci-guards/B3-helm-chart-coherence.sh # clean Remaining operator warnings (deferred, tracked in WORKSPACE-ROADMAP.md): - Backup CronJob + restore script (D6 + OPS-H1): operator chooses target (S3, GCS, Azure Blob, NFS). Sample CronJob yaml may ship in deploy/helm/examples/ once an operator workstation has run one full backup-restore cycle. - Distributed tracing (OPS-M2): otel/* are go.mod indirect deps, not actively instrumented. Adding spans is a v3 work item. - Prometheus client_golang migration (OPS-M1): the hand-rolled /metrics/prometheus exposition format works today; client_golang migration unlocks histograms + exemplars + native label sets. Audit-Closes: BUNDLE-3 C2 C3 D1 D2 D3 D5 D7 D11 D12 OPS-L1 OPS-L2 Audit-Defers: D6 D10 OPS-H1 OPS-M1 OPS-M2	2026-05-13 00:40:42 +00:00
shankar0123	0729ee46e0	chore: sweep github.com/shankar0123/certctl URL refs to certctl-io/certctl ... Post-transfer cosmetic + release-critical URL refresh after moving the repo from github.com/shankar0123/certctl to github.com/certctl-io/certctl (2026-05-03). GitHub HTTP redirects continue to forward old URLs forever, so existing operators are not broken — but aligns the canonical references with the new owner so: - procurement engineers / contributors browsing the docs see the right URL on first read - operators copying the agent install one-liner hit the new path directly without going through a redirect - the Helm chart's default image repository points at the canonical org registry path - the OnboardingWizard rendered to first-run UI users shows the new URL in the install snippets and doc anchor links - the GitHub Actions release workflow pushes container images to ghcr.io/certctl-io/certctl-{server,agent} (was: shankar0123) - the release-notes Markdown body in release.yml — which gets stamped into every future release page — references the post-transfer cert-identity (cosign keyless signing now uses the certctl-io workflow URL) and the post-transfer SLSA provenance source-uri. Without this, every cosign verify / slsa-verifier command on a v2.1.0+ release would fail because the cert-identity-regexp would not match the signing identity GitHub Actions OIDC issues post- transfer. Old releases (v2.0.67 and earlier) keep their immutable release-notes pointing at the shankar0123 path and remain verifiable via their own published instructions. Customer impact: - Operators on ghcr.io/shankar0123/certctl-{server,agent}:latest silently freeze on whatever tag was current at transfer time. They get no errors; they just stop receiving updates. The next release notes need a one-line callout (Phase 3.1 of cowork/transfer- certctl-to-org.md) telling them to update their image path to ghcr.io/certctl-io/certctl-{server,agent}. - All other URLs (git clone, install one-liner, raw.githubusercontent URLs, browser links, GitHub API) continue to resolve via permanent HTTP redirects. The sweep is cosmetic for those. Files swept (30 total): .github/workflows/release.yml — IMAGE_NAMESPACE, source-uri, cosign cert-identity-regexp, IMAGE= snippet (5 refs total). CHANGELOG.md, README.md — anchor links, badges, install one-liner, cosign verify snippets in operator-facing sections. api/openapi.yaml — info / externalDocs URLs. install-agent.sh — GITHUB_REPO const + systemd unit Documentation= field. deploy/ENVIRONMENTS.md, deploy/helm/{CHART_SUMMARY,INDEX, INSTALLATION,README}.md, deploy/helm/certctl/{Chart.yaml, README.md,values.yaml}, deploy/helm/examples/values-*.yaml — chart docs + image repository defaults across dev / prod-ha overrides. docs/{certctl-for-cert-manager-users,connector-iis,connectors, migrate-from-acmesh,migrate-from-certbot,quickstart,test-env, why-certctl}.md — operator-facing doc URLs. examples/{acme-nginx,acme-wildcard-dns01,multi-issuer, private-ca-traefik,step-ca-haproxy}/docker-compose.yml + examples/step-ca-haproxy/step-ca-haproxy.md — example image: paths and accompanying narrative. web/src/pages/OnboardingWizard.tsx — first-run-UI URL refs (curl install one-liners, agent docker image path, doc anchor links). Files intentionally NOT swept (Choice A from cowork/transfer-certctl- to-org.md): go.mod, go.sum — module declaration stays github.com/shankar0123/ certctl. Existing imports compile because Go uses the path declared in go.mod, not the URL it was fetched from. Internal- only project; no external Go consumers; rename will land as a mechanical sed when one materializes. ~250 *.go files — every import remains github.com/shankar0123/ certctl/internal/... deploy/test/f5-mock-icontrol/go.mod — separate test sub-module; same Choice A logic; module path stays. Files intentionally NOT swept (other reasons): README.md lines 244-245 — Scarf-pixel docker-pull commands. shankar0123.docker.scarf.sh/... is a Scarf-account hostname (per-user, not per-repo) and the pixel keeps tracking pulls against the operator's personal Scarf account. Migrating to a certctl-io Scarf account is a separate decision (create org Scarf account → re-create package → update README). deploy/test/f5-mock-icontrol/f5-mock-icontrol — checked-in compiled binary with shankar0123/certctl baked into Go build info via the sub-module path. Out of scope for a URL sweep; will refresh on the next `make test-integration` rebuild. Verification: gofmt: clean (no .go files touched). go vet ./...: clean (verified at this SHA in 1.3 of the transfer checklist; no .go changes since). go build ./...: clean (same). go test -short on representative packages: green (same). Diff shape: 30 files, 74 insertions / 74 deletions, net-zero size, pure URL substitution.	2026-05-03 23:39:50 +00:00
shankar0123	ec21c9bb29	feat(m28+m29+m30): ACME ARI, email digest, and Helm chart ... M28: ACME Renewal Information (RFC 9702) — CA-directed renewal timing with cert ID computation, directory endpoint discovery, graceful degradation for non-ARI CAs. 19 tests. M29: Email notifier wiring + scheduled certificate digest — SMTP connector bridged to service layer via NotifierAdapter, DigestService with HTML email template, 7th scheduler loop (24h), digest preview/send API endpoints and GUI card. 21 tests. M30: Production-ready Helm chart — server Deployment, PostgreSQL StatefulSet, agent DaemonSet, ConfigMaps, Secrets, Ingress, security contexts, health probes, example values for dev/prod/ACME scenarios. Also: OpenAPI spec updates, MCP tool additions, CI helm-lint job, documentation updates across 5 doc files and README. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-28 21:18:35 -04:00