@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

@swamp/kubernetes models fail with self-signed certificate in certificate chain when targeting a k3s cluster whose API server uses a self-signed CA, even though the kubeconfig has the correct CA embedded in certificate-authority-data.

Steps to reproduce

Have a kubeconfig with a k3s-dev context that uses a self-signed CA (certificate-authority-data is populated)
Create a model: swamp model create @swamp/kubernetes/node my-nodes --global-arg namespace=default --global-arg context=k3s-dev
Run: swamp model method run my-nodes list --json

Observed

{
  "error": "request to https://10.155.48.10:6443/api/v1/nodes failed, reason: self-signed certificate in certificate chain",
  "code": "method_execution_failed"
}

Expected

The @kubernetes/client-node library's KubeConfig.loadFromDefault() parses certificate-authority-data and should configure the HTTPS agent with that CA. The request should succeed, as it does with kubectl --context k3s-dev get nodes.

Environment

swamp version: 20260604.165624.0-sha.9bed22cc
@swamp/kubernetes version: 2026.06.04.1 (also reproduced on 2026.05.27.2)
macOS Darwin 25.4.0

Workarounds attempted (none worked)

NODE_EXTRA_CA_CERTS=~/.kube/k3s-dev-ca.pem — ignored by Deno runtime
DENO_CERT=~/.kube/k3s-dev-ca.pem — ignored
DENO_TLS_CA_STORE=system — ignored
NODE_TLS_REJECT_UNAUTHORIZED=0 — ignored

The env vars don't reach the extension subprocess. The extension's buildClient() in _lib/helpers.ts calls kc.loadFromDefault() and kc.makeApiClient() which should propagate the CA — suspect the Deno bundler or runtime strips the CA from the HTTPS agent.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

Extension: @swamp/kubernetes@2026.06.04.1
swamp: 20260604.165624.0-sha.9bed22cc
OS: darwin (aarch64)
Deno: 2.8.2
Shell: /bin/zsh

02Bog Flow

Shipped

6/4/2026, 11:49:29 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack726/4/2026, 7:30:00 PM

bixu commented 6/4/2026, 6:42:29 PM(edited)

Update: root cause identified — stale kubeconfig, not a swamp/extension bug

The self-signed certificate in certificate chain error was caused by a reprovisioned k3s cluster. The cluster's CA rotated (serial 1780136757 → 1780587212) but our local kubeconfig still had the old CA and client credentials.

We resolved it by adding a refresh method to our @<org>/k3s/kubeconfig extension that SSHes to the control plane, fetches /etc/rancher/k3s/k3s.yaml, and merges fresh credentials into ~/.kube/config.

The real feature gap this exposed

@swamp/kubernetes models have no way to detect or recover from stale kubeconfig credentials at runtime. When a cluster is reprovisioned, every kubernetes model silently fails with a TLS error until the operator manually refreshes the kubeconfig. Ideally the extension would:

Surface a clearer error when the CA doesn't match (distinguish "CA rotated" from "self-signed not trusted")
Support a pre-flight check or hook that validates cluster reachability before method execution

Blocked by #554

We cannot verify whether the refreshed kubeconfig fixes @swamp/kubernetes models because all existing model definitions are stuck on typeVersion: 2026.05.27.2 with no upgrade path to 2026.06.04.1. kubectl --context k3s-dev works fine after the refresh — only swamp is blocked.

stack72 commented 6/4/2026, 8:24:24 PM

Related: #487 (dynamic host/data discovery from external sources). The stale kubeconfig problem here is another instance of the same pattern — static inputs going stale at runtime. The datasource/dynamic-input feature is tracked there. This issue is scoped to the immediate UX gap: better TLS error messaging in @swamp/kubernetes.

@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

workflow resume fails to register all extension model types (local and pulled) — "Unknown model type"

model method run: cannot pass arrays, numbers, or booleans via --input

extension push --dry-run --json reports local helper imports as bogus model entries

Extension source: direct-content export scan only reads first 64 KiB, silently drops exports beyond it

Homepage install command: wrong domain and missing https:// protocol

Homepage install command: wrong domain and missing https:// protocol

first-class refresh hook for short-lived vault values (gcloud / aws-sso / kubectl-oidc token UX)

swamp issue ripple logged "Posted ripple on issue #514" but the ripple is not visible on the Lab

vault guide promotes inline secret values (KEY=VALUE) as a primary "swamp vault put" example

swamp-getting-started SKILL.md still references removed swamp-model / swamp-workflow / swamp-vault / swamp-extension / swamp-repo skills

extension rm blocked by stale /workspace bundle_types rows from prior container sessions with host repo bind-mounted

extension search returns null repository fields that extension info populates

Quality rubric: scope "No slow types" for model extensions (consumed via model+CEL, not type imports)

data get/list --workflow and workflow history get/logs cannot resolve extension-delivered workflows (Workflow not found)

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

UAT: sensitive resource output without vault produces clear pre-flight error

Docs: add doctor vaults subcommand and pre-flight vault validation

gcs-datastore: registerNamespace does not detect conflicts with existing registrations

Validate vault availability when model has sensitive output fields

Managed skills ship with dangling reference-doc links

swamp-club: update skill references and CLAUDE.md after superskill consolidation

swamp-uat: init_test.ts asserts old skill directory names after superskill consolidation

Codegen: auto-merge resources across GCP API versions instead of manual ADDITIONAL_VERSION_RESOURCE_FILTER

fix: giga-swamp UAT failures — 9 bugs found during comprehensive testing

fix: datastore setup extension with namespace config doesn't scope sync or register manifest

fix: namespace set on default repo writes incomplete filesystem config (missing path)

@swamp/1password put double-escapes JSON values

feat: giga-swamp comprehensive UAT coverage

@swamp/kubernetes 2026.06.04.1 missing upgrade path from 2026.05.27.2

@swamp/kubernetes ignores certificate-authority-data from kubeconfig for self-signed CAs

Inconsistent failures in swamp doctor extensions (database is locked, bundle build failed)

docs: giga-swamp user documentation — reference, how-to, and conceptual guide

@swamp/gcp/iam missing serviceAccounts model type

@swamp/ssh@2026.06.04.1 fails to load: bare zod import + missing 2026.06.04.1 upgrade entry

feat: giga-swamp phase 7 — Data migration commands

feat: S3/GCS extension namespace manifest support (registerNamespace/listNamespaces)

Relocate Docker image from systeminit org to swamp-club

Move JSR packages from @systeminit to @swamp-club scope

Should be able to see all the issues I created by a filter "submitted by me"

Ability to change the email address associated with my Swamp Club Account

feat: giga-swamp phase 5 — CLI output + namespace management commands

CI review jobs use two-dot diff that includes files the PR never touched

paths.base: manifest is not honored for workflows: — bundled workflows only resolve from repo root, blocking self-contained subdir layouts (sibling to #459)

Lab profanity filter rejects legitimate CLI flag tokens via substring match

Sign and notarize the swamp macOS binary

Add platform type to issue-lifecycle extension model Zod schema

fix: datastoreSetupExtension() ignores namespace config on initial migration push/pull

Remote execution: orchestrator/worker fan-out (replaces execution drivers)

swamp datastore sync --push creates global .datastore-index.json ignoring namespace config

feat: S3/GCS extension namespace-scoped sync support

Copy explicitGlobalArgs before mutation in resolveOrCreateDefinition

vault.get() expressions in extension model globalArguments are not resolved at runtime

swamp-issue skill should scrub secrets and org-specific data before submission

workflow validate: trim stale 'skipped' label from model_not_found warning

Add pi coding agent support

hashicorp-vault should read token from env

swamp-extension adversarial review skill needs mandatory mechanical verification checklist

feat: giga-swamp phase 6 — Namespace-scoped sync

swamp workflow validate emits misleading "Extension failed to load" warning when type resolves locally

Add issue search/list command to discover existing issues

Support vault-resolved private key content in transport auth (not just file paths)

Workflow engine resolves extension methods against base type, ignoring extension-registered methods

Per-model LockTimeoutError at 60s causes cascading failures under concurrent access

Persistent, queryable workflow runs (status / cancel from any shell)

swamp repo upgrade: ERR_SQLITE_ERROR 'attempt to write a readonly database' during extension catalog schema migration

workflow validate: fail on references to unknown model instances (typo'd modelIdOrName)

feat: giga-swamp phase 4 — CEL cross-namespace queries

Docs: document the extension push adversarial-review gate

vault://local_encryption token does not round-trip correctly for GCP OAuth2 access tokens

swamp issue: add ability to edit issue title and body after submission

@swamp/gcp/iam: add WIF pool, provider, service account, and binding support

Support vault-sourced identity keys

copy method reports success when scp exits non-zero (e.g. 255)

Docs: TLS behind inspecting proxies / private CAs (system trust store, DENO_CERT, SSL_CERT_FILE)

Extension quality/adversarial-review: add a 'published-surface hygiene' check for real infra identifiers

Feed-post scoring is a direct domain write, not a consumer of feed_post_approved telemetry

workflow validate silently PASSES steps whose model type is a pulled extension (step-inputs skipped = false pass)

extension quality fails to resolve bare specifiers — contradicts fmt no-import-prefix rule

Allow global arguments in direct type execution (workflow fan-out)