Enforce flip breaks ALL app TLS: disallow-unmanaged-secrets blocks cert-managers issuance temp secrets (wildcard-plat-tls-<rand>) #91

New issue

Open

opened 2026-07-06 19:10:32 +00:00 by plat · 0 comments

plat commented

2026-07-06 19:10:32 +00:00

Owner

Summary

The Kyverno Audit→Enforce flip (#42/#43, plat/gitops#14) silently breaks HTTPS for every app: disallow-unmanaged-secrets blocks cert-manager's TLS issuance temporaries (wildcard-plat-tls-<random>) because the allowlist only had the exact final name wildcard-plat-tls. cert-manager can't finish issuing → no cert → traefik 404s every app ingress.

Fixed in plat/gitops (fix/enforce-cert-manager-tls-temp-secrets, merged): allowlist glob wildcard-plat-tls*. Validated live on the product-garden.com granddaughter (app served 200 after the fix). This issue tracks the durable lesson + the gate gap.

Why nothing caught it

The F1 fix in PR #14 allowlisted the final secret but not cert-manager's per-issuance temp secrets.
It only manifests under Enforce (Audit just warns) AND only when a real app actually issues a TLS cert — the k3d coldstart gate germinates a platform but does not stand up a full crew-built app with a DB + public TLS, so it never exercises this path.

Follow-up

ENFORCE.md pre-flight: add "deploy a real app (DB + TLS) under Enforce and confirm it serves 200" to the checklist (today it tests rejections + the webhook-kill, not the app issuance path).
Audit the rest of the allowlist for other cert-manager-issued secrets that need glob coverage (e.g. is plat-local-ca-tls ever cert-manager-issued per app-ns?).
Related: the same "gate only runs on k3d" blind spot as #89.

## Summary The Kyverno Audit→**Enforce** flip (#42/#43, plat/gitops#14) silently **breaks HTTPS for every app**: `disallow-unmanaged-secrets` blocks cert-manager's TLS issuance temporaries (`wildcard-plat-tls-<random>`) because the allowlist only had the exact final name `wildcard-plat-tls`. cert-manager can't finish issuing → no cert → traefik 404s every app ingress. **Fixed** in plat/gitops (`fix/enforce-cert-manager-tls-temp-secrets`, merged): allowlist glob `wildcard-plat-tls*`. Validated live on the `product-garden.com` granddaughter (app served 200 after the fix). This issue tracks the durable lesson + the gate gap. ## Why nothing caught it - The F1 fix in PR #14 allowlisted the final secret but not cert-manager's per-issuance temp secrets. - It only manifests **under Enforce** (Audit just warns) AND only when a real app actually issues a TLS cert — the k3d coldstart gate germinates a platform but does not stand up a full crew-built app with a DB + public TLS, so it never exercises this path. ## Follow-up - [ ] ENFORCE.md pre-flight: add "deploy a real app (DB + TLS) under Enforce and confirm it serves 200" to the checklist (today it tests rejections + the webhook-kill, not the app issuance path). - [ ] Audit the rest of the allowlist for other cert-manager-issued secrets that need glob coverage (e.g. is `plat-local-ca-tls` ever cert-manager-issued per app-ns?). - [ ] Related: the same "gate only runs on k3d" blind spot as #89.

plat referenced this issue

2026-07-06 19:24:09 +00:00

/goal /ultracode-workflows [HYB-2] validate a granddaughter on a real VPS over the public internet (production TLS + edge) #35

plat referenced this issue

2026-07-06 19:24:09 +00:00

/goal /ultracode-workflows [POL-4] policy-govern the secrets + domains + network invariants #42

plat referenced this issue

2026-07-06 19:24:10 +00:00

/goal /ultracode-workflows [POL-5] policy-govern the RBAC/identity invariants #43

plat referenced this issue

2026-08-24 21:27:00 +00:00

release.yml tag builds failing platform-wide: isolated runner jobs die mid-run with no logs; workflows service also unreachable #201