NationTech/harmony
3
0
Fork 2
Code Issues 38 Pull Requests 29 Actions Packages Projects Releases 1 Wiki Activity

feat/fleet-staging-openbao #313

Open
johnride wants to merge 11 commits from feat/fleet-staging-openbao into master
pull from: feat/fleet-staging-openbao
merge into: NationTech:master
Conversation 0 Commits 11 Files Changed 18 +813 -443
johnride commented 2026-05-30 02:41:26 +00:00
Owner
Copy Link
No description provided.
johnride added 2 commits 2026-05-30 02:41:27 +00:00
feat(fleet-staging): add OpenBao + seed FleetDeploySecrets; route operator creds through the deploy crate 0400e9d454 
fleet_staging_install now deploys OpenBao (co-located in fleet-staging,
cert-manager TLS at secrets-stg.<base>), configures it (fleet-deployer
read policy), and seeds the operator's FleetDeploySecrets so the operator
can be upgraded alone via 'harmony-fleet-deploy --from-tag'. Behavior of
the existing bring-up is unchanged.

Credential-TOML construction moved out of the example into
OperatorCredentials::zitadel_jwt (deploy crate) so all callers share it.
New openbao::cached_root_token() lets the seed reuse the root token setup
already cached. Seeding mirrors the harmony_sso port-forward pattern.
refactor(fleet-staging): use tracing instead of println for output
All checks were successful
Run Check Script / check (pull_request) Successful in 2m30s
Details
fac83d853d 
Swap env_logger for tracing_subscriber (its fmt bridges the framework's
log:: deploy-progress output) and route the install banner + step logs
through tracing::info! — no raw println.
johnride added 1 commit 2026-05-30 09:04:47 +00:00
feat: Use tracing instead of logger in harmon_cli and work on fleet_staging_install refactor to use harmony_cli properly, still some more work to do
All checks were successful
Run Check Script / check (pull_request) Successful in 2m16s
Details
199e285e52
johnride added 2 commits 2026-05-30 12:41:00 +00:00
refactor(harmony_cli): defer topology prep so --list/declined runs are no-ops af3205d353 
`Maestro::initialize` (hence `topology.ensure_ready()`) ran before `init`'s
`--list` / confirmation short-circuits, so merely listing a binary's scores —
or declining to run them — still prepared the topology (cert-manager install,
etc.). Build the maestro unprepared and call `prepare_topology()` only once we
commit to interpreting. Expose `Maestro::prepare_topology`; add tests proving
`--list` skips prep while the run path triggers it.
feat: Example openbao now can do openbao setup and better readme
Some checks failed
Run Check Script / check (pull_request) Failing after 51s
Details
4fef957edb
johnride added 2 commits 2026-05-30 15:13:53 +00:00
fix(harmony_cli): drop ANSI colour codes around log emojis 44aa83199a 
`console::style(emoji).green()/.yellow()/.red()/.blue()` embedded raw ANSI
escapes in the message string. `console` force-emits them off its own TTY
detection, which disagrees with the tracing writer, so they leaked as literal
`\x1b[..m` garbage around the emoji. Emit plain emojis — the glyph already
conveys status and the tracing fmt layer still colours the level.
fix(openbao): scope unseal-keys cache file per instance
Some checks failed
Run Check Script / check (pull_request) Failing after 53s
Details
57d056fced 
The root token + unseal keys were written to a single fixed
`~/.local/share/harmony/openbao/unseal-keys.json`, so deploying a second
OpenBao instance (different namespace/release) overwrote the first's keys —
after which the first could never be unsealed. Key the file by
namespace+release (`unseal-keys-<ns>-<release>.json`); `cached_root_token`
now takes the `OpenbaoInstance` to read the right one.
johnride added 1 commit 2026-05-31 13:06:25 +00:00
feat: fleet deploy uses configuration from configclient for all settings, update the 0_3 plan
Some checks failed
Run Check Script / check (pull_request) Failing after 51s
Details
d39aa15152
johnride added 3 commits 2026-06-01 15:42:36 +00:00
refactor(fleet-deploy): rename HARMONY_SECRET_NAMESPACE to HARMONY_CONFIG_NAMESPACE
Some checks failed
Run Check Script / check (pull_request) Failing after 51s
Details
f7299ebe2b 
The env var name was a misnomer — ConfigClient resolves both config and
secrets, not just secrets. The struct field was already config_namespace.
Legacy SecretManager keeps the old var; this forces migration to
ConfigClient for new code.
fix(openbao): remove extra blank line in example
All checks were successful
Run Check Script / check (pull_request) Successful in 2m26s
Details
2e9052b217 
Pre-existing formatting issue caught by cargo fmt --check.
Merge pull request 'refactor(fleet-deploy): rename HARMONY_SECRET_NAMESPACE to HARMONY_CONFIG_NAMESPACE' (#314) from refactor/config-namespace-env-var into feat/fleet-staging-openbao
All checks were successful
Run Check Script / check (pull_request) Successful in 2m17s
Details
5c2e1fa401 
Reviewed-on: #314
All checks were successful
Run Check Script / check (pull_request) Successful in 2m17s
Details
This pull request has changes conflicting with the target branch.
  • examples/fleet_staging_install/src/main.rs
  • fleet/harmony-fleet-deploy/src/main.rs
  • fleet/harmony-fleet-deploy/src/secrets.rs
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/fleet-staging-openbao:feat/fleet-staging-openbao
git checkout feat/fleet-staging-openbao
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Architecture Decision Record
Good first issue
RFC
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
johnride jvtrudel reda stremblay
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: NationTech/harmony#313
No description provided.
Delete Branch "feat/fleet-staging-openbao"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?