bluejay/bluejay-infra
1
0
Fork 0
Code Issues Pull Requests 14 Actions Packages Projects Releases Wiki Activity

Add step-ca agent issuer manifest #21

Open
bluejay wants to merge 1 commits from sprint41/cx-2-step-ca-agent-provisioner into main
pull from: sprint41/cx-2-step-ca-agent-provisioner
merge into: bluejay:main
Conversation 0 Commits 1 Files Changed 2 +79
bluejay commented 2026-05-19 22:54:26 +00:00
Owner
Copy Link

Summary

  • Adds apps/fc-devicemgmt/clusterissuer-step-ca-agent.yaml as the Smallstep StepClusterIssuer for the live step-ca-agent provisioner.
  • References the live cert-manager/step-ca-agent-provisioner-password Secret without committing secret material.
  • Adds fc-devicemgmt lint coverage for issuer target, Secret reference, and traceability metadata.

Verification

  • dotnet.exe test tests\bluejay-infra-lint\BluejayInfraLint.Tests.csproj --filter "FullyQualifiedName~FcDeviceManagement" passed: 10/10.
  • dotnet.exe test tests\bluejay-infra-lint\BluejayInfraLint.Tests.csproj --filter "FullyQualifiedName~StepCaAgentIssuer" passed: 3/3.
  • kubectl apply --dry-run=server -f clusterissuer-step-ca-agent.yaml is blocked live because stepclusterissuers.certmanager.step.sm CRD is not installed yet.
  • Live noc1 smoke minted a 1-year CN/SAN fc-devicemgmt-runtime leaf via step-ca-agent.

Agent Report

  • Files created: D:\git\FlowerCore\bluejay-infra-sprint41-cx-2\apps\fc-devicemgmt\clusterissuer-step-ca-agent.yaml
  • Files modified: D:\git\FlowerCore\bluejay-infra-sprint41-cx-2\tests\bluejay-infra-lint\FleetManifestLintTests.cs
  • Tests before: 185 | Tests after: 193 | Delta: +8
  • Docs needing update: D:\git\FlowerCore\FlowerCore.Notes\docs\infrastructure\fc-devicemgmt-1p-provisioning-runbook.md may need a follow-up note that the live provisioner/password Secret now exist, and a separate lane should add/install Smallstep step-issuer CRDs/controller.
  • Decisions made (defaults): Used Smallstep StepClusterIssuer (certmanager.step.sm/v1beta1) rather than cert-manager ACME because the required agent provisioner is JWK-based and must allow 8760h leaves.
  • Build status: Pass with blocker (focused lint passes; server dry-run blocked by missing step-issuer CRD).
## Summary - Adds `apps/fc-devicemgmt/clusterissuer-step-ca-agent.yaml` as the Smallstep `StepClusterIssuer` for the live `step-ca-agent` provisioner. - References the live `cert-manager/step-ca-agent-provisioner-password` Secret without committing secret material. - Adds fc-devicemgmt lint coverage for issuer target, Secret reference, and traceability metadata. ## Verification - `dotnet.exe test tests\bluejay-infra-lint\BluejayInfraLint.Tests.csproj --filter "FullyQualifiedName~FcDeviceManagement"` passed: 10/10. - `dotnet.exe test tests\bluejay-infra-lint\BluejayInfraLint.Tests.csproj --filter "FullyQualifiedName~StepCaAgentIssuer"` passed: 3/3. - `kubectl apply --dry-run=server -f clusterissuer-step-ca-agent.yaml` is blocked live because `stepclusterissuers.certmanager.step.sm` CRD is not installed yet. - Live noc1 smoke minted a 1-year CN/SAN `fc-devicemgmt-runtime` leaf via `step-ca-agent`. ## Agent Report - **Files created:** `D:\git\FlowerCore\bluejay-infra-sprint41-cx-2\apps\fc-devicemgmt\clusterissuer-step-ca-agent.yaml` - **Files modified:** `D:\git\FlowerCore\bluejay-infra-sprint41-cx-2\tests\bluejay-infra-lint\FleetManifestLintTests.cs` - **Tests before:** 185 | **Tests after:** 193 | **Delta:** +8 - **Docs needing update:** `D:\git\FlowerCore\FlowerCore.Notes\docs\infrastructure\fc-devicemgmt-1p-provisioning-runbook.md` may need a follow-up note that the live provisioner/password Secret now exist, and a separate lane should add/install Smallstep step-issuer CRDs/controller. - **Decisions made (defaults):** Used Smallstep `StepClusterIssuer` (`certmanager.step.sm/v1beta1`) rather than cert-manager ACME because the required agent provisioner is JWK-based and must allow 8760h leaves. - **Build status:** Pass with blocker (focused lint passes; server dry-run blocked by missing step-issuer CRD).
bluejay added 1 commit 2026-05-19 22:54:29 +00:00
Add step-ca agent issuer manifest 46bbd00d09
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin sprint41/cx-2-step-ca-agent-provisioner:sprint41/cx-2-step-ca-agent-provisioner
git checkout sprint41/cx-2-step-ca-agent-provisioner
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
bluejay
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bluejay/bluejay-infra#21
Delete Branch "sprint41/cx-2-step-ca-agent-provisioner"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?