7ca4abddd2
* feat(continuum): K-Cont-4 — Cloudflare Worker source + tofu wiring for lease witness (#1101) Implements the server side of the Cloudflare KV lease-witness pattern that K-Cont-3's CFKVClient (in core/controllers/continuum/internal/ witness/cloudflarekv/) speaks to. The Worker fronts a Cloudflare Workers KV namespace with read-then-CAS-write semantics enforced via the If-Match header — exact contract per K-Cont-3 #1158 report (item d) and the canonical-seams "Cloudflare KV Worker contract" entry. Routes: GET /lease/<slot-url-encoded> → 200 + LeaseState | 404 | 401 PUT /lease/<slot> → 200 + LeaseState | 412 + state | 401 DELETE /lease/<slot> → 204 | 412 | 401 All 7 K-Cont-3 trap behaviors verified by 46 vitest tests: 1. If-Match: 0 = first-acquire-on-empty-slot 2. Generation increments unconditionally (incl. Release) 3. 412 includes current state body 4. TTL eviction is server-authoritative in stamping (Worker doesn't auto-evict — controller's IsHeldBy decides) 5. X-Holder mismatch on DELETE returns 412 (stale region can't evict new primary) 6. Bearer token validation against env-bound allow-list 7. Optional X-Lease-Slot header logged for KV granularity Files: products/continuum/cloudflare-worker/{package.json, tsconfig.json, wrangler.toml, vitest.config.ts, .eslintrc.cjs, .gitignore, DESIGN.md, src/{index,auth,kv,types}.ts, src/handlers/{get,put,delete}.ts, test/{handlers,contract,env.d}.ts} infra/cloudflare-worker-leases/{versions,variables,main,outputs}.tf + README.md .github/workflows/cloudflare-worker-leases-build.yaml (event-driven, NO cron — push-on-paths + PR + workflow_dispatch) Tests: 46/46 vitest pass (handlers 37 + contract 9). ESLint clean. tsc --noEmit clean. wrangler deploy --dry-run produces 9.47 KiB bundle. Per the brief: tofu module ships ready for operator action — no auto-deploy. Operator runbook in DESIGN.md §"Operator runbook — deploy a new Sovereign". Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(continuum/cf-worker-tofu): K-Cont-4 — adopt CF v5 inline secret_text binding (was v4 separate resource) `tofu validate` failed on `cloudflare_workers_secret` — that resource was REMOVED in cloudflare/cloudflare v5 (it consolidated into the inline `bindings = [...]` array on `cloudflare_workers_script` with `type = "secret_text"`). Same security guarantee — encrypted at rest in CF, never visible via dashboard read API once written. `tofu fmt` also wanted versions.tf alignment + the .terraform.lock.hcl pinning the resolved cloudflare/cloudflare v5.19.1 (mirrors infra/hetzner/ which commits its lock file). Per Inviolable Principle #5 the bearer token value still flows from TF_VAR_bearer_tokens_csv extracted at apply time from a K8s SealedSecret — never inlined here. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: hatiyildiz <hati.yildiz@openova.io> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
38 lines
1.3 KiB
HCL
38 lines
1.3 KiB
HCL
# outputs.tf — operator-facing outputs.
|
|
#
|
|
# `worker_url` is THE value the operator pastes into the Continuum
|
|
# CR's `spec.leaseClient.config.baseURL`. The CFKVClient (K-Cont-3)
|
|
# constructs requests as `${baseURL}/lease/<slot-url-encoded>`.
|
|
|
|
output "worker_url" {
|
|
description = <<-EOT
|
|
HTTPS URL of the deployed lease-witness Worker. Set this on the
|
|
Continuum CR via:
|
|
|
|
spec:
|
|
leaseClient:
|
|
kind: cloudflare-kv
|
|
config:
|
|
baseURL: "<this output>"
|
|
tokenSecretRef:
|
|
name: continuum-cf-witness-tokens
|
|
key: token
|
|
EOT
|
|
# Cloudflare's default Workers route format. The actual URL depends
|
|
# on the operator's Workers subdomain (settable in the CF dashboard);
|
|
# this output assumes the default `.workers.dev` subdomain. For a
|
|
# custom domain route, override `spec.leaseClient.config.baseURL`
|
|
# directly with the custom hostname.
|
|
value = "https://${var.worker_name}.${var.cloudflare_account_id}.workers.dev"
|
|
}
|
|
|
|
output "kv_namespace_id" {
|
|
description = "Cloudflare KV namespace ID — useful for ad-hoc CLI introspection (`wrangler kv:key list`)."
|
|
value = cloudflare_workers_kv_namespace.leases.id
|
|
}
|
|
|
|
output "worker_name" {
|
|
description = "Worker script name as deployed."
|
|
value = cloudflare_workers_script.lease_witness.script_name
|
|
}
|