From ab7c320991fea3f7ac8e923b313d62662435d983 Mon Sep 17 00:00:00 2001 From: jedarden Date: Thu, 2 Jul 2026 09:12:55 -0400 Subject: [PATCH] docs(bf-4ur): document secret templates and credential sources for ai-code-battle --- notes/bf-4ur.md | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/notes/bf-4ur.md b/notes/bf-4ur.md index f497c7b..07c3926 100644 --- a/notes/bf-4ur.md +++ b/notes/bf-4ur.md @@ -135,6 +135,46 @@ kubeseal --controller-name=sealed-secrets-apexalgo-iad \ | acb-armor-credentials | OpenBao (rs-manager cluster) | Already stored in OpenBao at path `rs-manager/iad-acb/armor` (ESO adds `secret/` prefix per ClusterSecretStore config) | | acb-cloudflare-api-token | Cloudflare Dashboard | Create at https://dash.cloudflare.com/profile/api-tokens with Pages+R2 Edit permissions | +## Full ARMOR OpenBao Secret Structure + +The OpenBao secret at `secret/rs-manager/iad-acb/armor` contains values for ARMOR's backend configuration that are NOT exposed to applications: + +| OpenBao Property | Description | Exposed to Apps? | +|------------------|-------------|------------------| +| `b2-region` | Backblaze B2 region (e.g., `us-west-002`) | No - ARMOR internal | +| `b2-access-key-id` | Backblaze B2 Application Key ID | No - ARMOR internal | +| `b2-secret-access-key` | Backblaze B2 Application Key (secret) | No - ARMOR internal | +| `bucket` | Bucket name | Yes - as `bucket` key | +| `cf-domain` | Cloudflare domain for zero-egress downloads | No - ARMOR internal | +| `master-encryption-key` | ARMOR MEK (32-byte hex) - CRITICAL | No - ARMOR internal (cannot be recovered if lost) | +| `auth-access-key` | Client S3 access key | Yes - as `auth-access-key` | +| `auth-secret-key` | Client S3 secret key | Yes - as `auth-secret-key` | + +Applications only see the three keys mapped via ExternalSecret: `bucket`, `auth-access-key`, `auth-secret-key`. The B2 credentials, Cloudflare domain, and master encryption key are used only by ARMOR internally. + +## ARMOR Architecture + +ARMOR is an S3-compatible proxy that: +1. **Encrypts data** before upload to Backblaze B2 (zero-knowledge encryption) +2. **Routes downloads** through Cloudflare for zero-egress (Bandwidth Alliance) +3. **Provides S3 API** to applications at `http://armor:9000` + +**Upload Path:** +``` +Application → ARMOR (encrypt) → B2 Storage +``` + +**Download Path:** +``` +Application → ARMOR (decrypt) → Cloudflare CDN → B2 Storage +``` + +## Additional Related Documentation + +- `/home/coding/ARMOR/README.md` - Full ARMOR architecture and configuration +- `/home/coding/scratch/armor-apexalgo-iad-setup.md` - ARMOR setup instructions for apexalgo-iad +- `/home/coding/ai-code-battle/notes/b2-cdn-setup.md` - B2 CDN configuration for b2.aicodebattle.com + ## Notes 1. **acb-r2-credentials** documented in R2_ACCESS_KEY_SOURCE.md is for iad-acb cluster, NOT apexalgo-iad @@ -142,3 +182,5 @@ kubeseal --controller-name=sealed-secrets-apexalgo-iad \ 3. The acb-cloudflare-api-token needs to be created and sealed before use - template exists but no sealed secret yet 4. The acb-armor-credentials ExternalSecret references OpenBao path `rs-manager/iad-acb/armor` - ESO's ClusterSecretStore has `path: secret` so the full path becomes `secret/rs-manager/iad-acb/armor` 5. The ExternalSecret for acb-armor-credentials exists but the corresponding OpenBao secret must exist at the correct path for ESO to sync it +6. ARMOR's Master Encryption Key (MEK) is the most critical secret - if lost, all encrypted data is unrecoverable (no recovery possible) +7. The ARMOR deployment on apexalgo-iad requires the OpenBao secret to be populated before pods can start