Trilltechnician/incredigo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rotate: promote k8s + mongo to LIVE-VM via real-target POCs

Browse Source 
Ran live cutover POCs in the sandbox VM against the real target software and
promoted both drivers from MOCK-ONLY to LIVE-VM in the proof table (data, not
driver behaviour):

- k8s: proven against real k3s v1.35 kube-apiserver + token controller
  (lab-provision-k8s.sh). The real apiserver serves a self-signed cert, so the
  driver gained CA-pinned TLS — blob params ca= (base64 PEM, pinned as the only
  trusted root) and insecure=1 (lab-only escape hatch), routed through a new
  clientFor(cr). Neither is test-awareness; a real deployment configures the same
  CA. Added TestK8sTLSTrust covering CA-pinned / insecure / untrusted-rejection
  and the blob round-trip.
- mongo: proven against real mongod 8.0 (lab-provision-mongo.sh).

npm stays MOCK-ONLY by decision (registry.npmjs.org not self-hostable; real
create-token requires the account password in the body) — documented as a
contract gap rather than faking a LIVE-VM. gcp/twilio/flyio remain MOCK-ONLY.

Live POCs surfaced real-target-only behaviour now recorded in the docs: the
apiserver's ~10s successful-auth cache (old token kept working ~7s after Secret
deletion) and real mongosh's stdout prompt. Full suite 104 green, -race clean.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
2026-06-18 21:50:21 -07:00
parent 35f19c007a
commit 9109da7ae4
5 changed files with 160 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/rotate/proofs.go
+2 -2
View File
@@ -54,6 +54,8 @@ var proofLevels = map[string]ProofLevel{
"wireguard": ProofLiveVM, // real wg (lab-provision-wg.sh)
"gitea": ProofLiveVM, // real Gitea (lab-provision-gitea.sh)
"appsecret": ProofLiveVM, // real local files (lab-provision-appsec.sh)
"mongo": ProofLiveVM, // real mongod 8.0 (lab-provision-mongo.sh)
"k8s": ProofLiveVM, // real k3s v1.35 (lab-provision-k8s.sh)
// proven only against an emulator / mock:
"aws": ProofMockOnly, // moto mock AWS in VM; real AWS never hit
@@ -63,12 +65,10 @@ var proofLevels = map[string]ProofLevel{
"cloudflare": ProofMockOnly, // httptest emulator; no self-host
"ghactions": ProofMockOnly, // httptest emulator; no self-host
"gitlab": ProofMockOnly, // httptest emulator; GitLab CE too heavy for the VM
"mongo": ProofMockOnly, // fake-mongosh stub; real-MongoDB VM POC not yet run
"npm": ProofMockOnly, // httptest emulator; real registry never hit
"gcp": ProofMockOnly, // httptest emulator (real RS256 JWT signing); no self-host
"twilio": ProofMockOnly, // httptest emulator; no self-host
"flyio": ProofMockOnly, // httptest GraphQL emulator; no self-host
"k8s": ProofMockOnly, // httptest apiserver emulator; real k3s POC not yet run
}
// ProofLevelOf returns the recorded proof level for a driver name. Unknown or