Repository navigation
Render the delivery path's own facts: the releaseGate ConfigMap, backup-pod policies and namespaced Vault names #199
Description
Parent
What to build
- The kubernetes adapter renders each Application's
releaseGateelement as a ConfigMap in its namespace, which the Release Gate reads. - The networking adapter renders one NetworkPolicy per Backup Identity: egress to the datastore surface it dumps, the cluster DNS, the Secret Store and, for an off-cluster copy, the destination; no ingress.
- Vault role and policy names become
<namespace>-<identity>, and${identity:vaultRole}, everyVaultAuthand the role documents follow.
Acceptance criteria
- The minimal and data golden trees show the ConfigMap, the backup policies and the namespaced names, byte for byte.
- Chapter 30's spelling table states each spelling.
- Both implementations agree where the parity table binds.
Activity
ExtraToast commentedon Oct 1, 2026
Scope note from the review of #208: the Vault role and policy rename to
<namespace>-<identity>, and the backup pods' ownNetworkPolicy, moved out of #208 into this ticket. That follows AGENTS.md: a model change lands with both implementations and the oracle files in one PR, and the code and oracles still encode the old names.This ticket now also carries:
<namespace>-<identity>.${identity:vaultRole}.src/resolve/process.tsidentity naming.${identity:vaultRole}resolution and its test.name.resolved.jsonand rendered*.role.json, plusworkload.yaml(VAULT_KUBERNETES_ROLE).vault-policy-<12 hex>by the documents' digest, and the<application>-release-gateConfigMap. Chapters 20 and 30 record that gap until this lands.The removed spec text is the diff of
dd5544bagainst4a217f8ondocs/206-delivery-spec-text.fix: write an identity's Vault documents at the name Vault holds them…
feat: render the Release Gate's inputs as a ConfigMap, and name a Vau…