fix: rotate Woodpecker API token in Salt pillar + all consumers

forgejo_admin commented

2026-03-16 00:55:50 +00:00

Owner

Copy link

Lineage

plan-pal-e-platform → Phase 17a → 17a-6 (token rotation)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want the Woodpecker API token updated in Salt pillar and all consumers
So that the DORA exporter can fetch deployment data and the MCP server authenticates

Type

Task

Context

The dora-exporter k8s secret had a stale token that returned 401 against the Woodpecker API. The valid token was obtained from the Woodpecker UI. This updates the canonical source (Salt pillar, GPG-encrypted) and all downstream consumers.

File Targets

Files to modify:

salt/pillar/secrets/platform.sls — replace woodpecker_api_token PGP block with new encrypted value
terraform/k3s.tfvars — update woodpecker_api_token value

Manual updates (not in PR):

~/.mcp.json — update WOODPECKER_TOKEN
dora-exporter k8s secret — kubectl patch
Woodpecker CI repo secret tf_var_woodpecker_api_token

Acceptance Criteria

Salt pillar decrypts to the correct token value
make tofu-secrets renders the token into secrets.auto.tfvars
DORA exporter returns Woodpecker deployment data (no 401)

Test Expectations

salt-call pillar.get secrets:platform:woodpecker_api_token returns the token
curl Woodpecker API with token returns 200

Constraints

GPG key: 81A03D1CF874DC90
Do not commit plaintext token anywhere

Checklist

Salt pillar updated
k3s.tfvars updated
~/.mcp.json updated
dora-exporter secret updated
Woodpecker CI secret updated
DORA exporter verified

phase-platform-17a-woodpecker-secrets — parent phase
sop-secrets-management — the SOP this follows

### Lineage `plan-pal-e-platform` → Phase 17a → 17a-6 (token rotation) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want the Woodpecker API token updated in Salt pillar and all consumers So that the DORA exporter can fetch deployment data and the MCP server authenticates ### Type Task ### Context The dora-exporter k8s secret had a stale token that returned 401 against the Woodpecker API. The valid token was obtained from the Woodpecker UI. This updates the canonical source (Salt pillar, GPG-encrypted) and all downstream consumers. ### File Targets Files to modify: - `salt/pillar/secrets/platform.sls` — replace `woodpecker_api_token` PGP block with new encrypted value - `terraform/k3s.tfvars` — update `woodpecker_api_token` value Manual updates (not in PR): - `~/.mcp.json` — update `WOODPECKER_TOKEN` - `dora-exporter` k8s secret — kubectl patch - Woodpecker CI repo secret `tf_var_woodpecker_api_token` ### Acceptance Criteria - [ ] Salt pillar decrypts to the correct token value - [ ] `make tofu-secrets` renders the token into secrets.auto.tfvars - [ ] DORA exporter returns Woodpecker deployment data (no 401) ### Test Expectations - [ ] `salt-call pillar.get secrets:platform:woodpecker_api_token` returns the token - [ ] curl Woodpecker API with token returns 200 ### Constraints - GPG key: `81A03D1CF874DC90` - Do not commit plaintext token anywhere ### Checklist - [ ] Salt pillar updated - [ ] k3s.tfvars updated - [ ] ~/.mcp.json updated - [ ] dora-exporter secret updated - [ ] Woodpecker CI secret updated - [ ] DORA exporter verified ### Related - `phase-platform-17a-woodpecker-secrets` — parent phase - `sop-secrets-management` — the SOP this follows

forgejo_admin referenced this issue

2026-03-24 20:21:50 +00:00

Bug: Woodpecker agent secret drift — 3 conflicting values across tfvars/k8s/statefulset #137

forgejo_admin commented

2026-03-27 21:32:27 +00:00

Author

Owner

Copy link

Scope Review: NEEDS_REFINEMENT

Review note: review-333-2026-03-27
Ticket is well-scoped with all file targets verified, all consumers identified, and no blocking dependencies. Two minor gaps before moving to next_up:

Missing ### Type header (should be Task)
Missing story:superuser-deploy label on board item for traceability consistency with related items (#137, #179)

## Scope Review: NEEDS_REFINEMENT Review note: `review-333-2026-03-27` Ticket is well-scoped with all file targets verified, all consumers identified, and no blocking dependencies. Two minor gaps before moving to `next_up`: - Missing `### Type` header (should be `Task`) - Missing `story:superuser-deploy` label on board item for traceability consistency with related items (#137, #179)

forgejo_admin commented

2026-03-27 22:04:28 +00:00

Author

Owner

Copy link

Issue body updated per scope review corrections.

forgejo_admin referenced this issue from a commit

2026-03-28 00:16:41 +00:00

fix: rotate woodpecker_api_token GPG block in Salt pillar

forgejo_admin referenced this issue from a pull request that will close it,

2026-03-28 00:17:29 +00:00

fix: rotate woodpecker_api_token GPG block in Salt pillar #210