21 lines
2.0 KiB
Markdown
21 lines
2.0 KiB
Markdown
# Content Ingestion Agent operator runbook
|
|
|
|
## Deploying
|
|
|
|
Apply `k8s/configmap.yaml`, `k8s/deployment.yaml`, and `k8s/service.yaml` in that order. The deployment intentionally does **not** contain credentials. Before applying it, provision a Kubernetes Secret named `content-ingestion-agent-secrets` through the cluster's approved secret manager or External Secrets controller. The Secret must provide `github-token` and `sharepoint-client-secret`; do not commit a Secret manifest, token, certificate, or client secret to this repository.
|
|
|
|
Verify the resulting pod with `kubectl -n <namespace> get pods -l app.kubernetes.io/name=content-ingestion-agent` and inspect only non-sensitive status and logs. Rotate credentials in the external secret manager, then restart the deployment to pick up the rotated values.
|
|
|
|
## Capability and approval boundary
|
|
|
|
The agent can read configured GitHub repositories and SharePoint content. Its publication connector can perform the world-changing action of writing/publishing content to the configured CMS. Publication is disabled by default by `PUBLICATION_ENABLED=false` and remains approval-gated by `REQUIRE_PUBLICATION_APPROVAL=true`. Operators must review the proposed changes and explicitly approve a publication request; never grant the runtime identity broader repository or CMS permissions than required.
|
|
|
|
If publication is enabled for an environment, record the approver, target, change summary, and rollback procedure before deployment. Test ingestion against a non-production source first. To stop publication immediately, set `PUBLICATION_ENABLED=false` in the ConfigMap and roll out the deployment.
|
|
|
|
## Secret-handling checks
|
|
|
|
- Credentials are consumed only through `secretRef`/`secretKeyRef` environment bindings.
|
|
- ConfigMap data is limited to non-sensitive runtime flags and provider names.
|
|
- Do not use `kubectl get secret ... -o yaml` in support output, and do not place secret values in issue reports or logs.
|
|
- The workflow and manifests contain no literal credential values.
|