mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:11:29 +00:00
shankar0123
77abb7096c
CI failed on the G-3 docs-drift guard for the deploy-hardening I
release commit (88e8a417 / b95a548 docs commit): the docs at
docs/features.md mention CERTCTL_DEPLOY_BACKUP_RETENTION and
CERTCTL_K8S_DEPLOY_KUBELET_SYNC_TIMEOUT but config.go didn't
declare or load them. Classic "lying field" — operator-visible
documented env var that quietly does nothing because the wire
never reaches the consumer.
Per CLAUDE.md operating rule "Always take the complete path, not
the easy path": fix the wire instead of removing the docs.
Adds two fields to CertManagementConfig:
- DeployBackupRetention int (default 3, frozen decision 0.2)
- K8sDeployKubeletSyncTimeout time.Duration (default 60s, Phase 9)
Loaded in NewConfig via getEnvInt + getEnvDuration. Each field
documented with its source phase + frozen-decision reference for
auditors.
These config values are loaded but not yet consumed by the agent
(per Phase 10's deferral note: "agent-side wire-up is intentionally
deferred to a follow-up commit"). The follow-up wires the agent's
deployment dispatch site to inject cfg.CertManagement.DeployBackupRetention
into the per-target deploy.Plan and to pass K8sDeployKubeletSyncTimeout
to the k8ssecret connector. For now: the env vars are loaded, the
config struct holds them, the docs accurately describe the operator
contract, and the G-3 guard passes.
Local G-3 reproduction:
DOCS_ONLY: (empty)
CONFIG_ONLY: (empty)
Build + vet + golangci-lint v2.11.4 + go test ./internal/config/...
all clean.