Background
The sync_remote_eab_payloads() and sync_remote_responder_hmac_payloads() functions in rotate.rs only target RemoteBootstrap services. Once service sidecar ctmpl files are converted to KV-backed templates (see the parent issue), LocalFile services will also need per-service KV writes to receive rotated secrets via OpenBao Agent.
Current state
-
sync_remote_eab_payloads (src/commands/rotate.rs:530-554):
Filters with .filter(|entry| matches!(entry.delivery_mode, DeliveryMode::RemoteBootstrap)) (line 541), then writes EAB credentials to bootroot/services/{name}/eab.
-
sync_remote_responder_hmac_payloads (src/commands/rotate.rs:556-579):
Same RemoteBootstrap filter (line 566), writes HMAC to bootroot/services/{name}/http_responder_hmac.
-
rotate_trust_sync (src/commands/rotate.rs:1004):
Per-service trust KV writes (lines 1035-1042) also only target remote services.
Changes
-
Remove RemoteBootstrap filter — write per-service KV for all registered services (both LocalFile and RemoteBootstrap).
-
Rename functions to reflect broader scope:
sync_remote_eab_payloads → sync_service_eab_payloadssync_remote_responder_hmac_payloads → sync_service_responder_hmac_payloads
-
Initialize per-service KV at bootroot service add time — when a new service is registered, seed its KV paths (eab, http_responder_hmac, trust) with current global values so the service sidecar has valid secrets from the start.
Background
The
sync_remote_eab_payloads()andsync_remote_responder_hmac_payloads()functions inrotate.rsonly targetRemoteBootstrapservices. Once service sidecar ctmpl files are converted to KV-backed templates (see the parent issue),LocalFileservices will also need per-service KV writes to receive rotated secrets via OpenBao Agent.Current state
sync_remote_eab_payloads(src/commands/rotate.rs:530-554):Filters with
.filter(|entry| matches!(entry.delivery_mode, DeliveryMode::RemoteBootstrap))(line 541), then writes EAB credentials tobootroot/services/{name}/eab.sync_remote_responder_hmac_payloads(src/commands/rotate.rs:556-579):Same
RemoteBootstrapfilter (line 566), writes HMAC tobootroot/services/{name}/http_responder_hmac.rotate_trust_sync(src/commands/rotate.rs:1004):Per-service trust KV writes (lines 1035-1042) also only target remote services.
Changes
Remove
RemoteBootstrapfilter — write per-service KV for all registered services (bothLocalFileandRemoteBootstrap).Rename functions to reflect broader scope:
sync_remote_eab_payloads→sync_service_eab_payloadssync_remote_responder_hmac_payloads→sync_service_responder_hmac_payloadsInitialize per-service KV at
bootroot service addtime — when a new service is registered, seed its KV paths (eab,http_responder_hmac,trust) with current global values so the service sidecar has valid secrets from the start.