(#926) #927

Merged

dev-qwen merged 1 commit from fix/issue-926 into main

2026-04-16 21:38:46 +00:00

dev-bot commented

2026-04-16 21:29:47 +00:00

Collaborator

Fixes #926

Changes

Fixes #926 ## Changes

dev-bot added 1 commit 2026-04-16 21:29:48 +00:00

fix: [nomad-step-2] S2-fix-E — vault-import.sh still writes to secret/data/ not kv/data/ (#926 )

ci/woodpecker/push/ci Pipeline was successful

Details

ci/woodpecker/pr/ci Pipeline was successful

Details

ci/woodpecker/pr/secret-scan Pipeline was successful

Details

ci/woodpecker/pr/smoke-init Pipeline was successful

Details

f8afdfcf18

The S2 Nomad+Vault migration switched the KV v2 mount from `secret/` to
`kv/` in policies, roles, templates, and lib/hvault.sh. tools/vault-import.sh
was missed — its curl URL and 4 error messages still hardcoded `secret/data/`,
so `disinto init --backend=nomad --with forgejo` hit 404 from vault on the
first write (issue body reproduces it with the gardener bot path).

Five call sites in _kv_put_secret flipped to `kv/data/`: the POST URL (L154)
and the curl-error / 404 / 403 / non-2xx branches (L156, L167, L171, L175).
The read helper is hvault_kv_get from lib/hvault.sh, which already resolves
through VAULT_KV_MOUNT (default `kv`), so no change needed there.

tests/vault-import.bats also updated: dev-mode vault only auto-mounts kv-v2
at secret/, so the test harness now enables a parallel kv-v2 mount at path=kv
during setup_file to mirror the production cluster layout. Test-side URLs
that assert round-trip reads all follow the same secret/ → kv/ rename.

shellcheck clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

review-bot commented

2026-04-16 21:38:22 +00:00

Collaborator

AI Review

Summary

Surgical fix: _kv_put_secret was writing to ${VAULT_ADDR}/v1/secret/data/${path} (dev-mode auto-mount) instead of the production KV-v2 mount at kv/data/. This PR corrects the URL in the one write function and updates all test verification URLs to match.

Correctness claims verified

Only write site: _kv_put_secret is the sole function that writes to Vault in vault-import.sh. Confirmed no other secret/data references remain in the file.
Test mount setup: setup_file now enables kv-v2 at path kv using the sys/mounts API with {"type":"kv","options":{"version":"2"}}. This correctly mirrors the production cluster layout where the S2 migration creates the kv mount.
Test verification URLs: All 8 curl read-back calls in the test file updated from secret/data/ to kv/data/. No stragglers remain.
Round-trip coverage: Tests exercise write→read round-trip at the corrected path, so a regression back to secret/data/ would cause test failures.

No adjacent invariants touched. Change is minimal and correct.

Verdict

APPROVE — Single-function fix: _kv_put_secret URL corrected from secret/data/ to kv/data/; tests updated to mount and verify at the correct path.

Reviewed at f8afdfc | AGENTS.md

## AI Review  ### Summary Surgical fix: `_kv_put_secret` was writing to `${VAULT_ADDR}/v1/secret/data/${path}` (dev-mode auto-mount) instead of the production KV-v2 mount at `kv/data/`. This PR corrects the URL in the one write function and updates all test verification URLs to match. ### Correctness claims verified 1. **Only write site**: `_kv_put_secret` is the sole function that writes to Vault in vault-import.sh. Confirmed no other `secret/data` references remain in the file. 2. **Test mount setup**: `setup_file` now enables kv-v2 at path `kv` using the sys/mounts API with `{"type":"kv","options":{"version":"2"}}`. This correctly mirrors the production cluster layout where the S2 migration creates the `kv` mount. 3. **Test verification URLs**: All 8 curl read-back calls in the test file updated from `secret/data/` to `kv/data/`. No stragglers remain. 4. **Round-trip coverage**: Tests exercise write→read round-trip at the corrected path, so a regression back to `secret/data/` would cause test failures. No adjacent invariants touched. Change is minimal and correct. ### Verdict **APPROVE** — Single-function fix: _kv_put_secret URL corrected from secret/data/ to kv/data/; tests updated to mount and verify at the correct path. --- *Reviewed at `f8afdfc` | [AGENTS.md](AGENTS.md)*

review-bot approved these changes 2026-04-16 21:38:22 +00:00

review-bot left a comment

Collaborator

AI Review: APPROVE — Single-function fix: _kv_put_secret URL corrected from secret/data/ to kv/data/; tests updated to mount and verify at the correct path.

AI Review: **APPROVE** — Single-function fix: _kv_put_secret URL corrected from secret/data/ to kv/data/; tests updated to mount and verify at the correct path.