Upgrade Liquor Cabinet to 2.0.0-rc.2 (hashed tokens), deploy new Akkounts #695

2026-11-04T12:59:38Z

raucao commented

2026-11-04 12:59:38 +00:00

Companion to the akkounts 0.12 deploy: Liquor Cabinet is pinned to the 2.0.0-rc.2 release and hashed_access_tokens is enabled, so it looks up remoteStorage authorizations by the SHA256 digest of the bearer token (keeping the plaintext key as a fallback). This is the Liquor Cabinet half of the expand/contract rollout described in akkounts#262, and it must be live before akkounts' rs:rekey_tokens sweeps the plaintext Redis keys — after which the plaintext fallback is only relevant for pre-0.12 authorizations.

The liquor-cabinet Garage S3 key for the rs-kosmos bucket was rotated after the old value was inadvertently exposed; the encrypted data bag now holds the new key and the old key has been deleted. Verified with a signed ListObjectsV2 request against rs-kosmos from both lq nodes.

Both lq nodes and akkounts-2 were migrated to Cinc Client and converged, and the nodes submodule tracks the resulting akkounts-2 state. akkounts itself still deploys from its live branch, so no change to the akkounts cookbook is included here.

Follow-ups (not in this PR): rotate the shared Redis password, then ship the contract migration that drops the plaintext token column and retires Liquor Cabinet's plaintext fallback.

Companion to the akkounts 0.12 deploy: Liquor Cabinet is pinned to the 2.0.0-rc.2 release and `hashed_access_tokens` is enabled, so it looks up remoteStorage authorizations by the SHA256 digest of the bearer token (keeping the plaintext key as a fallback). This is the Liquor Cabinet half of the expand/contract rollout described in akkounts#262, and it must be live before akkounts' `rs:rekey_tokens` sweeps the plaintext Redis keys — after which the plaintext fallback is only relevant for pre-0.12 authorizations. The `liquor-cabinet` Garage S3 key for the `rs-kosmos` bucket was rotated after the old value was inadvertently exposed; the encrypted data bag now holds the new key and the old key has been deleted. Verified with a signed ListObjectsV2 request against `rs-kosmos` from both lq nodes. Both lq nodes and akkounts-2 were migrated to Cinc Client and converged, and the `nodes` submodule tracks the resulting akkounts-2 state. akkounts itself still deploys from its `live` branch, so no change to the akkounts cookbook is included here. Follow-ups (not in this PR): rotate the shared Redis password, then ship the contract migration that drops the plaintext token column and retires Liquor Cabinet's plaintext fallback.

raucao added 3 commits 2026-11-04 12:59:38 +00:00

Rotate the Liquor Cabinet Garage S3 key for the rs-kosmos bucket b00e766ee7

Upgrade Liquor Cabinet to 2.0.0-rc.2 and enable hashed access tokens 79a3b47f1d

Update nodes 10c95886a1

raucao changed title from ~~Upgrade Liquor Cabinet to 2.0.0-rc.2 (hashed tokens) and track Cinc-migrated nodes~~ to Upgrade Liquor Cabinet to 2.0.0-rc.2 (hashed tokens), deploy new Akkounts

2026-11-04 13:02:15 +00:00

raucao added the kredits-1

service

remotestorage

ops labels 2026-11-04 13:02:44 +00:00

raucao merged commit c1ab9a2ac5 into master

2026-11-04 13:02:56 +00:00

raucao deleted branch chore/upgrade_akkounts-and-lq

2026-11-04 13:02:56 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#695