v0.0.7

Changelog

• 057dcc5 1. RoleID-bound SecretID (AppRole-recreation detection) ensureAppRoleSecretID now takes the live RoleID and binds the generated SecretID to it via a new annotation openchami.org/vault-approle-role-id. The regeneration decision became three-way (internal/reconcilers/vault.go): - Absent / empty id → generate. - Non-empty id bound to the current RoleID → preserve (unchanged normal-reconcile behavior; no VSO churn). - Non-empty id bound to a different RoleID, or no binding annotation → regenerate. This handles your primary concern — the "Secret survives, Vault/AppRole recreated → new RoleID → stale 403" case now self-heals. A hand-created Secret with no annotation is treated as unbound and adopted (operator mints a SecretID of known provenance and stamps the annotation). As you noted, a manually revoked SecretID with an unchanged RoleID is not auto-detected; that would need active login-probing and is left as a separate concern. 2. Ownership / lifecycle of the operator-created Secret The operator-written Secret now carries the standard managed labels (openchami.org/managed-by=operator, app.kubernetes.io/name=vault-approle), matching the tokensmith_bootstrap.go convention. On the owner reference question: I deliberately did not add one. The OpenCHAMIControlPlane is namespaced and lives in a different namespace than the openchami- control-plane namespace, and Kubernetes forbids cross-namespace owner references. Cleanup is already handled correctly — the controller's deletion path deletes the entire openchami- namespace (openchamicontrolplane_controller.go:285), which garbage-collects this Secret along with everything else. I documented this rationale in the function godoc. 3. Vault RBAC documentation - docs/install-production.md §6.3 (new) — documents the operator's own Vault policy, explicitly including auth/approle/role//secret-id with create/update, flagged as the new capability required by this fix. - §8 rewritten — the manual staging is now marked "the operator provisions this for you," with §8.1 kept as the legacy/air-gapped path (including how to stamp the binding annotation for a fully admin-managed SecretID). - hack/local-dev/seed-vault.sh — dropped the manual kubectl create secret step (operator does it now); prints a note instead. - test/fixtures/production-controlplane.yaml.example and internal/admin/init.go — stale "create out-of-band" comments updated. Tests Updated/added in vault_test.go (all passing): - AppRoleSecretIDIdempotent — now seeds the matching RoleID annotation; asserts preserve + no GenerateSecretID. - AppRoleSecretIDRegeneratesOnRoleIDMismatch (new) — stale RoleID → regenerate + rebind annotation. - AppRoleSecretIDAdoptsUnboundSecret (new) — no annotation → regenerate + stamp annotation. - AppRoleSecretIDBootstrap — now also asserts the annotation and managed-by label.
• f37e1e7 Merge pull request #55 from OpenCHAMI/bug/54-vso-approle-management
• 08c5ea7 Merge pull request #56 from OpenCHAMI/feature/vault-oidc-cli-client
• ed82c01 Merge pull request #61 from OpenCHAMI/dev/oidc-redo
• 7ecc78a Operator OIDC management redo
• cc26ec3 Refactor rate limit type and error handling in S3 client
• da98359 Separated the two meanings of the Vault address;Made conflict-detecting (no silent overwrite); Webhook validation;updated tests; updated docs
• a229aca feat: Add CLI OIDC configuration for Tokensmith
• 6d3b006 fix Vault OIDC client is created without redirect URIs and Operator-created OIDC client not authorized on provider
• 34e9315 fix lint and test errors
• 3459a26 fix lint and test failures
• aa67aea fix linting failures
• a5906b5 fix more issues tieing the vault issuer uri back to the tokensmith OIDC provider uri
• d848cb1 fixed isClusterInternalHost() policy treating every single-label hostname as inherently cluster-internal
• ea98a17 make operator own AppRole secret
• 22e44c3 oidcIssuer now applies the same HTTP/HTTPS policy as vault.address; isValidOIDCIssuer now truly enforces scheme://host[:port]
• 2a24d32 oidcIssuer path/query/fragment now rejected, not silently stripped; read-back now strictly verifies the issuer; stale vault.address comments/docs updated
• 37a9009 set provider mode for tokensmith to be vault