Skip to content

Resume interrupted KMS-backed Vault bootstrap - #31

Merged
libops-agent merged 1 commit into
mainfrom
resume-incomplete-bootstrap
Aug 29, 2026
Merged

Resume interrupted KMS-backed Vault bootstrap#31
libops-agent merged 1 commit into
mainfrom
resume-incomplete-bootstrap

Conversation

@libops-agent

Copy link
Copy Markdown
Contributor

Summary

  • retry transient audit-device setup while the initial root remains in memory
  • resume the exact KMS/GCS state where recovery material exists but the completion marker does not
  • generate a temporary recovery root through Vault, preserve non-root tokens, revoke orphan root-policy tokens, and write the completion marker last
  • refuse automated recovery for PGP custody, legacy root-token objects, or ambiguous storage states

Validation

  • go test ./...
  • go vet ./...
  • go mod tidy -diff
  • git diff --check
  • docker build --pull=false -t vault-init:resume-ci .

Hosted CI provides the race and lint gates because this host does not include a C compiler.

@libops-agent
libops-agent force-pushed the resume-incomplete-bootstrap branch from be75c6d to 77ba769 Compare August 29, 2026 05:48
@libops-agent
libops-agent merged commit 429c80d into main Aug 29, 2026
5 checks passed
@libops-agent
libops-agent deleted the resume-incomplete-bootstrap branch August 29, 2026 05:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant