The cluster-count guard I added used `grep -c '"name"'`, which counts
LINES. The jsonpath output is a single line, so the count was 1 for a
kubeconfig with clusters and 1 for one without - which made the guard
reject every kubeconfig:
ERROR: the kubeconfig has no cluster entries.
The count is now done with `grep -o . | wc -l`, which counts occurrences
rather than lines. Tested against both cases:
- a real kubeconfig with a stale CA -> the CA is refreshed and kubectl works
- a kubeconfig with no clusters -> refuses with a clear message
Adds the pages that were missing: an "Active Beers" view of what is in the
fermenter right now, and the per-run metadata (canonical name, tap number,
original gravity, brew notes) that could not be derived from the readings.
Why the metadata is needed
--------------------------
The `beer_data` collection stores a beer name on *each reading*, and that
name drifts within a run - run 4 was entered as "Necatron-Christmas Beer",
then "Nocturna the Christmas beer", then "Nocturna Christmas beer". There was
nowhere to record a tap number, a confirmed original gravity, or a note about
the brew.
The new `beer_runs` collection holds one document per run with exactly those
details. It starts empty; `scripts/backfill_run_metadata.py` populates it
from the existing readings. The script is idempotent, only ever inserts into
`beer_runs`, never touches `beer_data`, and never overwrites a name you have
already set by hand.
The active beers page
---------------------
A card per brew that is still in the fermenter, showing the tap number, the
current gravity, the projected alcohol, how many days it has been brewing, a
sparkline of the gravity so far, and the latest comment on a reading.
A run with only one reading and no recorded original gravity has no reliable
estimate, so the alcohol figure shows a dash rather than a misleading number
- record the OG or take a second reading and it appears. The same applies to
the existing reads, where the legacy app's assumed OG of 1012 produced
*negative* alcohol for a perfectly normal OG.
Also adds the history page: alcohol by brew, brews per month, every run in a
table, a comparison of the standard ABV formula against the legacy one, and
a list of readings that fall outside the plausible hydrometer range.
Changes to the existing pages
-----------------------------
- The brew-process page and the run detail page now show the canonical run
name and the latest comment, and the run detail page lets you edit the
metadata inline.
- Gravity is displayed as a decimal reading (1.039) with the point scale
beneath it (39 points), which is the way a brewer reads it. Labelling the
stored `1039` as "1039 points" would have been wrong.
- A run's display name now prefers the name on its *final* reading - the one
written when the brew was finished, so the name the operator settled on -
falling back to the most-used name.
- `upsert_run_metadata` now clears a field when it is passed as `None`, so a
name or tap number can be deleted. `upsert_run_metadata_partial` is the
non-clearing variant, used by the backfill.
Bugs found and fixed along the way
----------------------------------
- The chart script was included both in the base template and again by each
page, so every chart was drawn twice. A test now asserts it is loaded
exactly once per page.
- The chart library was never referenced by the base template, so all charts
were silently dead. That was fixed in the previous PR.
Tests
-----
91 (up from 74). New coverage: the active page contents, the tap number, the
projected alcohol, the "needs 2nd reading" case, metadata saving and
clearing, the stored name overriding the drifting reading name, the next free
tap number, the partial-update semantics, the history page, the outlier
list, and the point-scale formatting.
Data safety
-----------
`beer_data` is untouched by this change. The backfill script only inserts into
`beer_runs` and skips any run whose name has already been set by hand.
Round-2 review findings, all low severity.
- `curl` now has `--connect-timeout` and `--max-time`, so an unreachable API
server fails the job instead of hanging the runner indefinitely.
- A guard for a kubeconfig with no cluster entries, or an empty one, with a
clear message rather than an opaque kubectl error.
- The fingerprint mismatch message now prints both the expected and the
actual value, which cuts the time to diagnose the next CA rotation.
- `set -euo pipefail` was already there; the script now passes shellcheck
clean, and a shellcheck step was added to the CI test job so the
operational scripts get the same treatment as the Python code.
The CA fingerprint is not a secret. It is a public value that anyone can
read straight off the certificate, so pinning it in a Gitea secret was the
wrong shape:
- A change to it would be invisible - no commit, no review.
- Nobody with secret-write access could silently repoint the CI runner at a
different CA.
It now lives in `scripts/cluster-ca.sha256`, so changing it is a reviewable
commit. The script reads it from there, and still accepts an override as
its first argument.
This also removes the need for a `KUBE_SERVER_CA_FINGERPRINT` secret, which
the bot token cannot create anyway - the Actions secrets API is owner-only.
The behaviour is unchanged: the CA is fetched over an unverified connection
but only USED if it matches the pinned fingerprint, so an intercepted CA is
refused. Re-tested against the live API server - the matching fingerprint
refreshes the CA and kubectl then works; a wrong one is refused and the
stale CA is left in place.
The review was right on both counts, and both are fixed.
1. MITM. Fetching the CA over an unverified connection (`curl -sk`) and then
trusting it is a privilege-escalation hole: the runner holds cluster-admin
credentials, so an attacker able to intercept the fetch could hand us a CA
of their choosing and then read everything sent over the connection.
The CA is now PINNED. It is still fetched over an insecure connection, but
it is only USED if its SHA-256 fingerprint matches
`KUBE_SERVER_CA_FINGERPRINT`. An intercepted CA will not hash to the
pinned value, so it is refused. If the secret is not set, the job fails
rather than trusting an unverified CA.
2. The hardcoded cluster name. `kubectl config set-cluster default` creates a
NEW cluster entry when the kubeconfig's entry is called something else,
leaving the original (and its stale CA) in use. The name is now read from
the kubeconfig: `{.clusters[0].name}`.
The bash is also moved out of the YAML into `scripts/kube-ca-refresh.sh`, so
it can be read, reviewed and tested on its own rather than as a wall of
shell inside a workflow file.
All three paths are tested against the live API server:
- no fingerprint supplied -> refuses, exit 1
- wrong fingerprint -> refuses, exit 1
- correct fingerprint -> refreshes the CA, exit 0, kubectl then works
hermes