gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-20 23:32:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fleet-secrets): graduate encrypted fleet-wide environment bundles to Community (#1758)

Browse Source 
* feat(fleet-secrets): graduate encrypted fleet-wide environment bundles to Community

* fix(fleet-secrets): update reachability test for Secrets community graduation

* fix(fleet-secrets): address review findings

* fix(fleet-secrets): add HTTP-level Community admin push/import tests and non-admin tab-hidden test
This commit is contained in:
Anso
2026-08-03 08:42:46 -04:00
committed by GitHub
parent 5240957ff3
commit 5f5cd5ea51
11 changed files with 183 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/features/fleet-secrets.mdx
+3 -3
View File
@@ -12,7 +12,7 @@ The unit of work is the **bundle**. One bundle has one current `kv` payload; pus
</Frame>
<Note>
Fleet Secrets is a limited-availability surface. When it is present on an instance, managing it requires an admin user role.
Fleet Secrets is available on every Sencho installation. Managing bundles requires an admin user role.
</Note>
## What Fleet Secrets covers (and what it doesn't)
@@ -38,14 +38,14 @@ A **push** is a separate action. It reads the bundle's current version, walks ev
| Requirement | Why it matters |
|---|---|
| Admin role on the control instance | Bundle CRUD and push require an administrator when the surface is present; authored-by rows are written into the audit log |
| Admin role on the control instance | Bundle CRUD and push require an administrator; authored-by rows are written into the audit log |
| At least one stack on at least one node | Pushes target an existing stack directory; the wizard does not create stacks |
| The target stack's compose declares the env file via `env_file:` | The env-file dropdown in the push wizard reads `env_file:` entries from a representative node's compose; a stack with only an inline `environment:` block will not show up |
| The control instance can reach the remote node's API URL | Each remote write is an HTTP call from the control instance to the remote's `/api/stacks/.../env`; an unreachable remote is reported as a per-node failure, not a transport error for the whole push |
## Create a bundle
1. Open **Fleet → Secrets** (when that tab is available on the instance).
1. Open **Fleet → Secrets** on the Fleet view.
2. Click **New bundle**.
3. Give it a name. Names are 2-64 characters, alphanumerics plus space, dot, dash, and underscore, and must start and end with an alphanumeric.
4. Optionally add a description; the description is a free-text field and is shown in the bundle list.