Build keys now come from the build namespace's own path apps/meru/<app>-build/build,
which the shared meru-build role reaches; setup-meru-shared.sh copied them there.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
sindri-registration becomes an ExternalSecret (role meru-<app>-build-eso,
apps/meru/<app>-build/eso/sindri-registration, Owner - D68). Store at
wave -2 so it is validated before the ExternalSecret asks; Namespace at -3
so a first install creates it before the objects inside it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
sindri jobs run as the new signer account with a 10-minute, OpenBao-only
token (projected, audience openbao) and an in-memory /keys; no Secrets
mounted. openbao-ca ConfigMap from openbao.caCert. README shows the
busybox fetch.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1Hfahkh27nfbtRVZ4CR
Generalised from the hand-made echo-build and thoth-build namespaces in
clockmost-infra (k8s/meru/*/build), Thoth's newer shape: job pods start
restricted with nothing, only the sindri label gets BuildKit + credentials.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1Hfahkh27nfbtRVZ4CR
MarioGLealP
