oeng/smol-k8s-lab

Watch

Fork 0

Add special OpenBao policy for the open engineering mail-stack to read-only grab certs from the core/traefik namespace #118

Open

jessebot wants to merge 17 commits from add-special-mail-stack-policy into main

jessebot commented

2026-10-15 08:41:55 +00:00

Owner

This PR also handles some other house cleaning:

update the docs for traefik, cert-manager, and mail-stack on how certs work and are backed up
additional documentation on how OpenBao works, including a basic diagram (Fixes #81)
documentation on optional cert-manager-sync tool
clean up arguments types according to various PEP8 and other python linting standards
reduces a tiny bit of complexity in openbao namespace checking operations
start using log.warning vs log.warn where space allows
finally get rid of the last of the bitnami valkey references

Most of this work relates to oeng/argocd-apps#125 (comment)

This PR also handles some other house cleaning: - update the docs for traefik, cert-manager, and mail-stack on how certs work and are backed up - additional documentation on how OpenBao works, including a basic diagram (Fixes #81) - documentation on optional cert-manager-sync tool - clean up arguments types according to various PEP8 and other python linting standards - reduces a tiny bit of complexity in openbao namespace checking operations - start using `log.warning` vs `log.warn` where space allows - finally get rid of the last of the bitnami valkey references Most of this work relates to https://git.open.engineering/oeng/argocd-apps/issues/125#issuecomment-3646

jessebot added the

minor

label

2026-10-15 08:41:55 +00:00

jessebot self-assigned this

2026-10-15 08:41:55 +00:00

jessebot added 5 commits

2026-10-15 08:41:55 +00:00

add special mail stack policy 072d890146

add docs and a diagram for how openbao works within smol-k8s-lab 559bbd8b19

make sure the mail stack app can only access *its own cert* 617e5b4fdc

add docs on traefik listenersets and cert backups 63d03cc009

udpate more info on cert-manager cert backups as well as cert-manager-sync

Test smol-k8s-lab / test_k3s (pull_request) Failing after 2m6s

Details

d10d65c944

jessebot added this to the Backup Certs project

2026-10-15 08:42:00 +00:00

jessebot added 1 commit

2026-10-15 09:02:16 +00:00

add more erorr handling for setting up OpenBao and fix more linting suggestions

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

cccf8f1073

jessebot added 1 commit

2026-10-15 09:35:13 +00:00

more linting and zitadel debug logging

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

f020289c73

jessebot added 2 commits

2026-10-15 09:57:31 +00:00

do some more basic linting d48fcecf77

set logging to debug in the ci pipeline

Test smol-k8s-lab / test_k3s (pull_request) Failing after 2m4s

Details

407f7358cd

jessebot added 2 commits

2026-10-15 10:05:24 +00:00

try to avoid container not found properly a40bbf1239

more linting

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

ab6de264df

jessebot added 1 commit

2026-10-15 10:27:00 +00:00

try new health endpoint

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

a6f6ca9a53

jessebot added 1 commit

2026-10-15 10:36:17 +00:00

use gateway during testing, not ingress

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

b8518c0b4a

jessebot added 1 commit

2026-10-15 11:35:35 +00:00

clean up libretranslate unused variable

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

9b17f8724c

jessebot referenced this pull request

2026-10-15 11:36:46 +00:00

Feature Request: Automated Cert restoration as part of standard restore operations #119

jessebot added 1 commit

2026-10-15 11:52:02 +00:00

update how we pass in gateway domains now that we're testing with gateway api

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

58250ea11f

jessebot added 1 commit

2026-10-15 12:03:15 +00:00

fix how we set traefik.gatewayDomains, again

Test smol-k8s-lab / test_k3s (pull_request) Has been cancelled

Details

b9f03ee26a

jessebot referenced this pull request from oeng/argocd-apps

2026-10-15 12:09:52 +00:00

Setup and test automatically syncing TLS certs into OpenBao #125

jessebot referenced this pull request from oeng/argocd-apps

2026-10-15 12:10:35 +00:00

use ESO to pull our TLS cert for mail stack from the core/traefik openbao namespace #128

jessebot added 1 commit

2026-10-15 15:13:07 +00:00

use official valkey all over the place, instead of bitnami woohoo

Test smol-k8s-lab / test_k3s (pull_request) Failing after 2h59m48s

Details

9b66811229

Test smol-k8s-lab / test_k3s (pull_request) Failing after 2h59m48s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin add-special-mail-stack-policy:add-special-mail-stack-policy

git switch add-special-mail-stack-policy

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff add-special-mail-stack-policy

git switch add-special-mail-stack-policy

git rebase main

git switch main

git merge --ff-only add-special-mail-stack-policy

git switch add-special-mail-stack-policy

git rebase main

git switch main

git merge --no-ff add-special-mail-stack-policy

git switch main

git merge --squash add-special-mail-stack-policy