Issues

• Pin platform images by digest and stop using :latest

  component:dmf-infraplatform-debtworkstream:hardening
  dmfdeploy/dmfdeploy#903 · Filter by author znerol2 opened on Nov 12, 2026

• Upgrade OpenBao to 2.7.x and reload the listener certificate automatically

  component:dmf-infraplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#902 · Filter by author znerol2 opened on Nov 12, 2026
  2

• 106: an UNREACHABLE run leaves the temporary root token active

  component:dmf-infraplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#897 · Filter by author znerol2 opened on Nov 9, 2026

• Keep secrets sent on stdin out of Ansible's staged module files

  component:dmf-infraplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#896 · Filter by author znerol2 opened on Nov 9, 2026

• AppRole rotation adapter trusts ESO refreshTime against its own clock

  component:dmf-infraplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#893 · Filter by author znerol2 opened on Nov 9, 2026

• dmf-init: docs/ARCHITECTURE.md still describes two rclone backup remotes

  component:dmf-initplatform-debtworkstream:hygiene
  dmfdeploy/dmfdeploy#890 · Filter by author znerol2 opened on Nov 8, 2026

• dmf-infra: record the provenance of the tracked netbox-7.3.0.tgz chart, or fetch it at run time

  component:dmf-infraplatform-debtworkstream:release
  dmfdeploy/dmfdeploy#889 · Filter by author znerol2 opened on Nov 8, 2026

• dmf-cms: replace or remove the placeholder Forgejo CI workflow

  component:dmf-cmsplatform-debtworkstream:hygiene
  dmfdeploy/dmfdeploy#888 · Filter by author znerol2 opened on Nov 8, 2026

• Stop reading AppRole SecretIDs from the break-glass file and passing them on the command line

  component:dmf-infraplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#885 · Filter by author znerol2 opened on Nov 8, 2026

• Drop Zot's Docker v2 compatibility once no Docker-typed dmf-cms image remains

  component:cross-repoplatform-debtworkstream:release
  dmfdeploy/dmfdeploy#883 · Filter by author znerol2 opened on Nov 8, 2026

• Turn dmf-init's setup-request gate on once the receipt path is enabled

  component:cross-repoplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#882 · Filter by author znerol2 opened on Nov 8, 2026

• Scheduled node reboots don't run the OpenBao rolling-restart guard

  component:dmf-infraplatform-debtworkstream:infra-debt
  dmfdeploy/dmfdeploy#875 · Filter by author znerol2 opened on Nov 7, 2026

• OpenBao consumers exec into the first or a pinned pod, which can be sealed in a Raft cluster

  component:dmf-infraplatform-debtworkstream:infra-debt
  dmfdeploy/dmfdeploy#874 · Filter by author znerol2 opened on Nov 7, 2026
  1

• OpenBao snapshot job logs its token, uses plain HTTP, and hides failed setup

  component:dmf-infraplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#873 · Filter by author znerol2 opened on Nov 7, 2026
  4

• openbao role passes unseal shares in command arguments

  component:dmf-infraplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#872 · Filter by author znerol2 opened on Nov 7, 2026
  3

• Zot backup restore recipe runs the AWS CLI in an image that lacks it

  component:dmf-infraplatform-debtworkstream:infra-debt
  dmfdeploy/dmfdeploy#870 · Filter by author znerol2 opened on Nov 7, 2026
  1

• Console: bound the post-deploy settling notice by a deploy time

  component:dmf-cmsplatform-debtworkstream:hygiene
  dmfdeploy/dmfdeploy#869 · Filter by author znerol2 opened on Nov 7, 2026
  1

• Align the dmf-init Manage lane with the credential, ESO and unlock plans

  component:dmf-initplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#868 · Filter by author znerol2 opened on Nov 7, 2026
  1

• Move ESO's main store to OpenBao Kubernetes auth

  component:cross-repoplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#866 · Filter by author znerol2 opened on Nov 7, 2026
  4

• Implement ADR-0029 Tier 2 operator unlock with a phone passkey

  component:cross-repoplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#864 · Filter by author znerol2 opened on Nov 7, 2026
  7

• Attest dmf-init launcher releases and verify the attestation at install

  component:dmf-initplatform-debtworkstream:release
  dmfdeploy/dmfdeploy#843 · Filter by author znerol2 opened on Nov 6, 2026

• Finish the identity audits left pending by the Forgejo contributor policy

  component:cross-repoplatform-debtworkstream:identity-secrets
  dmfdeploy/dmfdeploy#837 · Filter by author znerol2 opened on Nov 6, 2026

• Use NetBox If-Match for launcher service-tag updates after the NetBox 4.6 upgrade

  component:dmf-runbooksplatform-debtworkstream:hardening
  dmfdeploy/dmfdeploy#835 · Filter by author znerol2 opened on Nov 5, 2026

• Allow pull_request_target for the automerge and issue-link workflows before GitHub's 2026-12-02 default block

  component:cross-repoplatform-debtworkstream:hardening
  dmfdeploy/dmfdeploy#833 · Filter by author znerol2 opened on Nov 5, 2026
  4

• dmf-cms release rollout: finish the unverified checks

  component:dmf-cmsplatform-debtworkstream:release
  dmfdeploy/dmfdeploy#831 · Filter by author znerol2 opened on Nov 4, 2026
  3