orchestration.md: fix the Kestra identity claim, add live evidence

Browse Source

The old claim described two flows sharing one keypair under different
usernames as a deliberate scoping decision. That was actually a stale,
half-migrated credential mismatch, not a design choice - the real fix was
giving Kestra a dedicated keypair with zero relation to the ansible
automation identity's own key, so a leak of one can never expose the other.
Kestra's SSH plugin has no certificate support at all (a plain Java client,
confirmed via its own plugin schema), which is the actual reason it needs
its own static key regardless of what the fleet's ansible identity does.

Added the real current flow config (kestra_local_user/kestra_local_key) and
a screenshot of the live KV Store showing exactly those two entries. Also
refreshed the automation-self-update.timer example, which had gone stale.

...

This commit is contained in:

automation-bot committed 2026-09-05 08:31:54 +03:00

1 parent d4f538f5e0

commit 9fd60f3f3b

2 files changed

+18 -4

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

assets/orchestration-kestra-kv-store.png

BIN

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 123 KiB