Extractor admin UI¶

Read-only pages over the shot bridge's diagnostics: the shots recorded with the app's diagnostics switch on, their curves, merged timelines and stop legs, the uploaded logs, and the calibration runs. It has no login of its own and reads the bridge server side with the bridge's read-only token, which never reaches a browser. The source, the image and the chart live in somuch-cloud/extractor.cafe; the chart is published to ghcr.io/somuch-cloud/charts, per Conventions → Official upstream sources only.

At a glance¶


URL	extractor-admin.k8s.wlkr.ch
Authentication	The Authentik outpost in front, per Conventions → Authentication is Authentik's
Storage	None; everything is read from the bridge on each request
Dials	The bridge's pods in `shot-bridge`, nothing outside the cluster
Files	`extractor-admin/`

Configuration¶

Setting	Why
Own chart, values in `application.yaml`	The chart ships the Deployment, Service, `HTTPRoute` and `CiliumNetworkPolicy`; this directory adds the namespace and the secret
`HTTPRoute` targets `authentik-server`	The admin UI has no login; the chart refuses a route to its own Service. The platform repository's provider forwards to `extractor-admin.extractor-admin.svc` after the login
Policy admits the Authentik server pods only	No request can skip the outpost. Egress is the bridge's pods on `bridge.port`, plus a DNS rule the chart renders itself, which repeats the platform's cluster-wide one (Conventions → rule 5) and cannot be switched off
The bridge's `admin.enabled: true`	Passes `BRIDGE_ADMIN_READ_KEY` to the bridge and lets this namespace's pods in on 8080

Secrets¶

Path	Keys	Written by
`kv/extractor-admin/config`	`admin-read-key`	By hand, as a copy of the bridge's property in `kv/shot-bridge/config`, which the `PushSecret` in `shot-bridge/secrets.yaml` generates — see Copying the read key

A copy, because the openbao-apps store confines each namespace to its own kv/<namespace>/ (Conventions → Real secrets come from OpenBao). The token may only read the bridge's debug routes and the logs; every other bridge route answers 403.

Usage¶

Copying the read key¶

Once before the first sync, and again whenever kv/shot-bridge/config is rotated. Run from the platform repository's checkout.

Log in as the operator user, whose policy covers kv/; the root token no longer exists after make bao-init. The port-forward and the login are Authenticating locally.

Copy the property; it is alphanumeric, so it needs no JSON escaping:

key="$(bao kv get -mount=kv -field=admin-read-key shot-bridge/config)"
printf '{"admin-read-key":"%s"}' "$key" | bao kv put -mount=kv extractor-admin/config -
unset key

Drop the login's token, which the short TTL would otherwise leave in ~/.bao-token until it expires:
```
bao token revoke -self && rm -f ~/.bao-token
```

After a rotation, push the value through and restart the UI, which reads it into an environment variable:

kubectl -n extractor-admin annotate externalsecret extractor-admin force-sync="$(date +%s)" --overwrite
kubectl -n extractor-admin rollout restart deploy/extractor-admin

Health check¶

kubectl -n extractor-admin get pods,externalsecret,httproute
kubectl -n extractor-admin logs deploy/extractor-admin    # view GET /shots user=<you> status=200

The hostname answers with Authentik's login first, then the shot list.

Pitfalls¶

The image and chart have to be public on GHCR, as for the bridge: the cluster has no pull secret for ghcr.io/somuch-cloud.
A rotated bridge key is not copied for you. admin-read-key in kv/extractor-admin/config is a hand copy of the bridge's, and nothing writes it: the openbao-apps store confines a PushSecret to its own kv/<namespace>/, so the bridge's namespace cannot push it here. After a rotation of kv/shot-bridge/config the UI answers 401 or 403 until the key is copied again; the same two codes with no rotation mean the bridge's admin.enabled is off.
Only shots recorded with diagnostics on appear. The token cannot list the other shots, by design.