mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix: project_create infra branch vs main + GITEA_MCP_TOKEN missing from SOPS secrets #14

New Issue
Closed
opened 2026-05-18 14:33:50 +00:00 by mathias · 1 comment
mathias commented 2026-05-18 14:33:50 +00:00
Owner
Copy Link
Copy Source

Two follow-up items from project_create e2e verification (2026-05-18)

Item 1 — infra namespace committed to branch, not main

project_create commits the staging namespace manifest to a staging/<name> branch
in the infra repo, not directly to main. This means Flux does NOT deploy the staging
namespace until the branch is manually merged.

This may be intentional (review gate before staging is activated) or a bug.

Decision needed: which behaviour do we want?

Option A — commit directly to main (fully automated)
staging namespace comes up automatically within 60s of project_create. No manual step.
Consistent with TBD. Change: update callInfraCommit in internal/skills/project/handlers.go
to use branch: "main" and remove the base: "main" param.

Option B — keep staging/ branch (manual review gate)
Human merges the branch when ready to activate staging. Adds friction but gives
explicit control over when Flux deploys the namespace.

Recommendation: Option A for experiment/throwaway projects. The namespace is just
a k8s namespace — it's low risk and Flux will reconcile it. Manual merge is unnecessary friction.

Item 2 — GITEA_MCP_TOKEN not in SOPS secrets

GITEA_MCP_TOKEN was patched imperatively into routing-secrets on 2026-05-18.
It will be lost if:

  • The secret is recreated from secrets.enc.yaml (SOPS restore)
  • The cluster is rebuilt from scratch (bootstrap)
  • Someone runs kubectl apply -f secrets.enc.yaml without the patch

Fix: Add GITEA_MCP_TOKEN to k3s/apps/routing/secrets.enc.yaml via SOPS:

# Decrypt, add token, re-encrypt
sops k3s/apps/routing/secrets.enc.yaml
# Add: GITEA_MCP_TOKEN: <value>
# Save and exit — SOPS re-encrypts automatically

This ensures the token survives cluster rebuilds and is tracked in git (encrypted).

Acceptance criteria

  • Decision made on Option A vs B for infra commit (document in DECISIONS.md)
  • If Option A: callInfraCommit updated to commit directly to main
  • GITEA_MCP_TOKEN added to secrets.enc.yaml via SOPS
  • routing-secrets regenerated from SOPS to verify round-trip works
## Two follow-up items from project_create e2e verification (2026-05-18) ### Item 1 — infra namespace committed to branch, not main `project_create` commits the staging namespace manifest to a `staging/<name>` branch in the infra repo, not directly to main. This means Flux does NOT deploy the staging namespace until the branch is manually merged. This may be intentional (review gate before staging is activated) or a bug. **Decision needed:** which behaviour do we want? **Option A — commit directly to main (fully automated)** staging namespace comes up automatically within 60s of `project_create`. No manual step. Consistent with TBD. Change: update `callInfraCommit` in `internal/skills/project/handlers.go` to use `branch: "main"` and remove the `base: "main"` param. **Option B — keep staging/<name> branch (manual review gate)** Human merges the branch when ready to activate staging. Adds friction but gives explicit control over when Flux deploys the namespace. Recommendation: **Option A** for experiment/throwaway projects. The namespace is just a k8s namespace — it's low risk and Flux will reconcile it. Manual merge is unnecessary friction. ### Item 2 — GITEA_MCP_TOKEN not in SOPS secrets `GITEA_MCP_TOKEN` was patched imperatively into `routing-secrets` on 2026-05-18. It will be lost if: - The secret is recreated from `secrets.enc.yaml` (SOPS restore) - The cluster is rebuilt from scratch (bootstrap) - Someone runs `kubectl apply -f secrets.enc.yaml` without the patch **Fix:** Add `GITEA_MCP_TOKEN` to `k3s/apps/routing/secrets.enc.yaml` via SOPS: ```bash # Decrypt, add token, re-encrypt sops k3s/apps/routing/secrets.enc.yaml # Add: GITEA_MCP_TOKEN: <value> # Save and exit — SOPS re-encrypts automatically ``` This ensures the token survives cluster rebuilds and is tracked in git (encrypted). ## Acceptance criteria - [ ] Decision made on Option A vs B for infra commit (document in DECISIONS.md) - [ ] If Option A: `callInfraCommit` updated to commit directly to main - [ ] `GITEA_MCP_TOKEN` added to `secrets.enc.yaml` via SOPS - [ ] `routing-secrets` regenerated from SOPS to verify round-trip works
mathias commented 2026-05-18 15:22:03 +00:00
Author
Owner
Copy Link
Copy Source

Both items resolved.

Item 1 — Option A chosen, shipped in 937355c

Decision recorded in DECISIONS.md (2026-05-18 entry). callInfraCommit now passes branch: "main" directly; the staging/<name> indirection and base param are gone. Flux reconciles within ~60s of project_create, no manual merge step.

Rationale (per ADR): staging namespaces are isolated, low blast-radius, and consistent with project-wide TBD. Manual review was friction with no compensating safety gain for experiment namespaces.

internal/skills/project/handlers.go | 12 +++++-------
DECISIONS.md                        | 21 +++++++++++++++++++++

Project skill tests pass. Note: TestRoutingPodEndToEnd is failing pre-existing this commit (port-wait flake, unrelated to project_create); to be tracked separately.

Item 2 — GITEA_MCP_TOKEN already in SOPS

Confirmed on infra@408a527:

$ sops -d k3s/apps/routing/secrets.enc.yaml | grep -E "GITEA_MCP_TOKEN|GITHUB_PAT|LITELLM_API_KEY|ROUTING_MCP_TOKEN"
LITELLM_API_KEY: <redacted>
ROUTING_MCP_TOKEN: <redacted>
GITHUB_PAT: <redacted>
GITEA_MCP_TOKEN: <redacted>

Round-trip verified against live cluster — same 4-key set:

$ kubectl get secret routing-secrets -n routing -o jsonpath='{.data}' | jq 'keys'
["GITEA_MCP_TOKEN", "GITHUB_PAT", "LITELLM_API_KEY", "ROUTING_MCP_TOKEN"]

Cluster rebuilds / SOPS restore now restore both tokens.

Closing.

Both items resolved. ### Item 1 — Option A chosen, shipped in 937355c Decision recorded in `DECISIONS.md` (2026-05-18 entry). `callInfraCommit` now passes `branch: "main"` directly; the `staging/<name>` indirection and `base` param are gone. Flux reconciles within ~60s of `project_create`, no manual merge step. Rationale (per ADR): staging namespaces are isolated, low blast-radius, and consistent with project-wide TBD. Manual review was friction with no compensating safety gain for experiment namespaces. ``` internal/skills/project/handlers.go | 12 +++++------- DECISIONS.md | 21 +++++++++++++++++++++ ``` Project skill tests pass. Note: `TestRoutingPodEndToEnd` is failing pre-existing this commit (port-wait flake, unrelated to project_create); to be tracked separately. ### Item 2 — `GITEA_MCP_TOKEN` already in SOPS Confirmed on `infra@408a527`: ```bash $ sops -d k3s/apps/routing/secrets.enc.yaml | grep -E "GITEA_MCP_TOKEN|GITHUB_PAT|LITELLM_API_KEY|ROUTING_MCP_TOKEN" LITELLM_API_KEY: <redacted> ROUTING_MCP_TOKEN: <redacted> GITHUB_PAT: <redacted> GITEA_MCP_TOKEN: <redacted> ``` Round-trip verified against live cluster — same 4-key set: ```bash $ kubectl get secret routing-secrets -n routing -o jsonpath='{.data}' | jq 'keys' ["GITEA_MCP_TOKEN", "GITHUB_PAT", "LITELLM_API_KEY", "ROUTING_MCP_TOKEN"] ``` Cluster rebuilds / SOPS restore now restore both tokens. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agent/ready
Meets the agent-ready contract; authorizes unattended execution
 blocked/client
Waiting on the client
 blocked/supplier
Waiting on a supplier
 blocked/upstream
Waiting on an upstream project or vendor
 risk/high
Irreversible, security-relevant, or control plane
 risk/low
Reversible, local, test-covered
 risk/medium
Touches shared state, deploys or data
 size/l
Too big - split it
 size/m
Under two days
 size/s
Under half a day
 size/xs
Under an hour
 status:dispatch
status:dispatched
status:review
status:reviewing
type/chore
Maintenance, no behaviour change
 type/decision
Human decision required; never agent/ready
 type/docs
Documentation only
 type/feat
New capability
 type/fix
Corrects broken behaviour
 type/ops
Infrastructure, deploy, runtime
 type/research
Investigate; output is a finding, not code
 type/test
Test coverage only
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot mathias
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mathias/hyperguild#14