RKE2 CySec Signal Relay Source Secrets¶

This lane registers four operator-owned adjunct Secrets for the Bloodbag CySec signal relay source. They remain outside the frozen 22-Secret activation lease:

bloodbag-signal-relay-source (Opaque): keys password, then source-url
bloodbag-signal-relay-source-tls (Opaque): key ca.crt
bloodbag-signal-relay-source-redis-tls (Opaque): keys tls.crt, tls.key, then ca.crt
bloodbag-signal-relay-source-redis-health (Opaque): key password

All four use context tirosh-home/rke2/gpu and namespace bloodbag-cysec.

Local material and plans¶

Use a local, uncommitted .env file with mode 0600. Values must never enter Git, issues, logs, or PRs. The required environment variables are:

BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_PASSWORD
BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_URL
BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_TLS_CA
BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_TLS_CERT
BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_TLS_KEY
BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_TLS_CA
BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_HEALTH_PASSWORD

Create the material exactly once in an operator-owned path outside the repository. The bootstrap generates an encrypted CA key, the exact-SAN server leaf, two distinct 256-bit ACL credentials, and a shell-compatible dotenv without printing any value:

SOURCE_REDIS_STATE=/ops/cysec/source-redis
make rke2/cysec-source-redis/material/bootstrap SITE=tirosh-home \
  RKE2_BLOODBAG_CYSEC_SOURCE_REDIS_OUTPUT_ENV_FILE="$SOURCE_REDIS_STATE/material.env" \
  RKE2_BLOODBAG_CYSEC_SOURCE_REDIS_ISSUER_DIR="$SOURCE_REDIS_STATE/issuer" \
  RKE2_BLOODBAG_CYSEC_SOURCE_REDIS_CA_PASSPHRASE_FILE="$SOURCE_REDIS_STATE/ca-passphrase"
make rke2/cysec-source-redis/material/verify SITE=tirosh-home \
  RKE2_BLOODBAG_CYSEC_SOURCE_REDIS_OUTPUT_ENV_FILE="$SOURCE_REDIS_STATE/material.env" \
  RKE2_BLOODBAG_CYSEC_SOURCE_REDIS_ISSUER_DIR="$SOURCE_REDIS_STATE/issuer" \
  RKE2_BLOODBAG_CYSEC_SOURCE_REDIS_CA_PASSPHRASE_FILE="$SOURCE_REDIS_STATE/ca-passphrase"

All targets are create-only. Existing output, issuer, or passphrase paths are never overwritten. The parent directory must be owned by the current operator and have mode 0700. The exact registry IDs and names are:

ID	Name	Keys and required environment source
`bloodbag-signal-relay-source`	`bloodbag-signal-relay-source`	`password` ← `BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_PASSWORD`; `source-url` ← `BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_URL`
`bloodbag-signal-relay-source-tls`	`bloodbag-signal-relay-source-tls`	`ca.crt` ← `BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_TLS_CA`
`bloodbag-signal-relay-source-redis-tls`	`bloodbag-signal-relay-source-redis-tls`	`tls.crt` ← `BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_TLS_CERT`; `tls.key` ← `BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_TLS_KEY`; `ca.crt` ← `BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_TLS_CA`
`bloodbag-signal-relay-source-redis-health`	`bloodbag-signal-relay-source-redis-health`	`password` ← `BLOODBAG_CYSEC_SIGNAL_RELAY_SOURCE_REDIS_HEALTH_PASSWORD`

Plan each Secret with redacted output:

export ENV_FILE="$SOURCE_REDIS_STATE/material.env"
make kubernetes/secret/plan SITE=tirosh-home \
  KUBERNETES_SECRET=bloodbag-signal-relay-source
make kubernetes/secret/plan SITE=tirosh-home \
  KUBERNETES_SECRET=bloodbag-signal-relay-source-tls
make kubernetes/secret/plan SITE=tirosh-home \
  KUBERNETES_SECRET=bloodbag-signal-relay-source-redis-tls
make kubernetes/secret/plan SITE=tirosh-home \
  KUBERNETES_SECRET=bloodbag-signal-relay-source-redis-health

If a required environment variable is missing, the plan fails closed. That is expected. After all four plans pass, apply one registry ID at a time:

make kubernetes/secret/apply SITE=tirosh-home KUBERNETES_SECRET=bloodbag-signal-relay-source
make kubernetes/secret/apply SITE=tirosh-home KUBERNETES_SECRET=bloodbag-signal-relay-source-tls
make kubernetes/secret/apply SITE=tirosh-home KUBERNETES_SECRET=bloodbag-signal-relay-source-redis-tls
make kubernetes/secret/apply SITE=tirosh-home KUBERNETES_SECRET=bloodbag-signal-relay-source-redis-health

The registry pins context tirosh-home/rke2/gpu and namespace bloodbag-cysec. Do not use rke2/cysec-secret-pki/apply; that target owns the separate frozen 22-Secret set.

Workload and network lane¶

The GitOps lane sets BLOODBAG_SIGNAL_RELAY_SOURCE_URL only through valueFrom.secretKeyRef:

valueFrom:
  secretKeyRef:
    name: bloodbag-signal-relay-source
    key: source-url
    optional: false

It must not contain a literal URL. The operator-owned source-url value is exactly rediss://bloodbag-signal-relay-source-redis.bloodbag-cysec.svc:6380/0 with no userinfo, query, or fragment.

The URL must be rediss, use a DNS hostname, and contain no userinfo, query, fragment, IP address, or localhost. The username remains the literal signal-relay-source; the password and CA remain file-only.

The Redis server certificate must have serverAuth, use the exact DNS SAN bloodbag-signal-relay-source-redis.bloodbag-cysec.svc, and match tls.key. Its certificate chain must terminate at the ca.crt in this Secret. The client trust Secret bloodbag-signal-relay-source-tls/ca.crt must use the same certificate authority byte-for-byte.

The health Secret is for the Redis ACL principal health, intended to run PING only with no key access. The ACL principal, Kubernetes Secret, and environment source are separate from the relay principal, Secret, and source in bloodbag-signal-relay-source. The generated passwords must differ; the Redis startup script also rejects equal digests before starting.