fix(openbao): drop banned k. hostname → openbao.renner.uno + namespace CNP #180

2026-07-14T06:03:20Z

claude-bot commented

2026-07-14 06:03:20 +00:00

Per owner directive: *.k.renner.uno is a migration-era artifact, never a production convention, and must not be used. This PR:

Renames the ingress host openbao.k.renner.uno → openbao.renner.uno (rules, TLS, migration doc). cert-manager will issue the new cert; external-dns publishes the internal LB IP for it, same as every other internal app.
Explicit enforcement instead of incidental unreachability: verified the public edge (proxy.renner.uno) refuses TLS for SNI it isn't configured for — openbao is not configured there, so it is not internet-reachable by policy of the edge, not by hostname obscurity. Added network-policies/openbao-ns.yaml (CiliumNetworkPolicy, repo's <app>-ns.yaml default-deny pattern) pinning pod-level access to: traefik→8200, external-secrets→8200, intra-namespace (snapshot CronJob).
The wrong wiki note claiming a "dual-hostname convention" is being corrected in parallel so future sessions stop reinventing k. names; a standing memory rule now bans it outright.

Note: the external-secrets namespace remains unfenced (like cert-manager) — its webhook needs kube-apiserver ingress entities; can follow up separately if wanted.

After merge I'll verify the new hostname serves (cert + UI + CLI), confirm the k. name is gone, and that ESO still syncs with the CNP active.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Per owner directive: `*.k.renner.uno` is a migration-era artifact, never a production convention, and must not be used. This PR: - Renames the ingress host `openbao.k.renner.uno` → **`openbao.renner.uno`** (rules, TLS, migration doc). cert-manager will issue the new cert; external-dns publishes the internal LB IP for it, same as every other internal app. - **Explicit enforcement instead of incidental unreachability**: verified the public edge (`proxy.renner.uno`) refuses TLS for SNI it isn't configured for — openbao is not configured there, so it is not internet-reachable by policy of the edge, not by hostname obscurity. Added `network-policies/openbao-ns.yaml` (CiliumNetworkPolicy, repo's `<app>-ns.yaml` default-deny pattern) pinning pod-level access to: traefik→8200, external-secrets→8200, intra-namespace (snapshot CronJob). - The wrong wiki note claiming a "dual-hostname convention" is being corrected in parallel so future sessions stop reinventing k. names; a standing memory rule now bans it outright. Note: the `external-secrets` namespace remains unfenced (like cert-manager) — its webhook needs kube-apiserver ingress entities; can follow up separately if wanted. After merge I'll verify the new hostname serves (cert + UI + CLI), confirm the k. name is gone, and that ESO still syncs with the CNP active. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

claude-bot added 1 commit 2026-07-14 06:03:20 +00:00

fix(openbao): drop banned k.renner.uno hostname; fence namespace with CNP 7cb7b9e0d1

openbao.k.renner.uno -> openbao.renner.uno. The k. subdomain is a
migration-era artifact, never a production convention, and is banned
per owner directive 2026-07-14 — the wiki note that claimed a
dual-hostname convention was wrong and is being corrected.

Non-public reachability is a real control, not a hostname: the public
edge serves only explicitly configured SNI (openbao is not configured),
and the new CiliumNetworkPolicy default-denies the namespace with
explicit grants (traefik->8200, ESO->8200, intra-ns for the snapshot
CronJob) matching the <app>-ns.yaml pattern.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

k.renner merged commit 7541ec5b23 into master

2026-07-14 06:06:32 +00:00

k.renner referenced this issue from a commit

2026-07-14 06:06:32 +00:00

Merge pull request 'fix(openbao): drop banned k. hostname → openbao.renner.uno + namespace CNP' (#180) from openbao-hostname-fix into master

claude-bot referenced this issue from a commit

2026-07-23 09:49:42 +00:00

fix(ci): strip review_bot_token from the PR checkout before the agent runs

claude-bot referenced this pull request

2026-07-23 10:50:41 +00:00

fix(ci): pr-review.yml parse error — literal ${...} in a comment broke the live pipeline #367

claude-bot referenced this pull request