fix(cloudflare-rotation): enable — tested; pinned to the dedicated cert-manager token #309

2026-07-19T08:31:16Z

claude-bot commented

2026-07-19 08:31:16 +00:00

Enables #305 after end-to-end verification, and fixes a credential-ownership problem the staged test surfaced.

What the staged (non-destructive) check found

cert-manager was not using the dedicated token — OpenBao held the Caddy token (f40570b2…), scoped DNS Write on 4 zones (renner.uno, konstantin-renner.de, nerdcave.eu, sarah-renner.de), last used the same day and likely shared with something outside this repo. Meanwhile a properly-scoped Kubernetes Cert-Manager token (af708481…, Zone Read + DNS Write on renner.uno only) sat unused.

Rolling the OpenBao token would have rolled Caddy and broken its other consumer.

Fix

cert-manager switched to the dedicated token → drops write access to 3 personal zones
rotation token-id pinned to af708481… → Caddy is never touched
suspend: false

Verified

job rolls the token ✓ · OpenBao rotates ✓ · rolled token stays active with same scope ✓ · ESO syncs ✓ · cert-manager writes the DNS-01 TXT record, publicly resolvable ✓ · 27/27 production certs Ready ✓

Enables #305 after end-to-end verification, and fixes a **credential-ownership problem** the staged test surfaced. ### What the staged (non-destructive) check found cert-manager was **not** using the dedicated token — OpenBao held the `Caddy` token (`f40570b2…`), scoped **DNS Write on 4 zones** (`renner.uno`, `konstantin-renner.de`, `nerdcave.eu`, `sarah-renner.de`), last used the same day and likely shared with something outside this repo. Meanwhile a properly-scoped `Kubernetes Cert-Manager` token (`af708481…`, Zone Read + DNS Write on **renner.uno only**) sat unused. Rolling the OpenBao token would have rolled **Caddy** and broken its other consumer. ### Fix - cert-manager switched to the dedicated token → **drops write access to 3 personal zones** - rotation `token-id` pinned to `af708481…` → **`Caddy` is never touched** - `suspend: false` ### Verified job rolls the token ✓ · OpenBao rotates ✓ · rolled token stays active with same scope ✓ · ESO syncs ✓ · cert-manager writes the DNS-01 TXT record, publicly resolvable ✓ · 27/27 production certs Ready ✓

claude-bot added 1 commit 2026-07-19 08:31:16 +00:00

fix(cloudflare-rotation): enable — tested; pinned to the dedicated cert-manager token 1f40366c48

Staged verification found cert-manager was using an unrelated 4-zone token named 'Caddy' (renner.uno + 3 personal zones, shared with something outside this repo), not the dedicated 'Kubernetes Cert-Manager' token that already existed (renner.uno only). Switched cert-manager to the dedicated token and pinned the rotation token-id to it, so Caddy is never rolled. Net: cert-manager drops write access to 3 personal zones.
Verified end-to-end: job rolls token af708481, OpenBao rotates, rolled token stays active/same scope, ESO syncs, cert-manager writes the DNS-01 TXT record (publicly resolvable), 27/27 prod certs Ready. suspend: false.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ

k.renner merged commit f57d954b89 into master

2026-07-19 08:32:53 +00:00

k.renner referenced this issue from a commit

2026-07-19 08:32:54 +00:00

Merge pull request 'fix(cloudflare-rotation): enable — tested; pinned to the dedicated cert-manager token' (#309) from fix/cloudflare-rotation-enable into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#309