---
id: w4/m6/t006
title: "E2E on mock cluster: key → PUT env-vars → app serves new value; no-tuple key 403; env unset ⇒ 503"
worker: worker4
status: done
estimate: 35m
depends_on: [w4/m6/t005]
---

## Objective

Prove the DoD end-to-end on the local mock cluster: mint an API key (m3 path), `PUT /v1/services/{id}/env-vars`, verify the value lands in OpenBao (`bao kv get` via port-forward), the app's Deployment rolls, and the running app serves the new value at its URL; a key without tuples gets 403; with `BEX_OPENBAO_URL` unset the secrets endpoints 503 and the rest of the API is unchanged.

## Context

- Stack bring-up: `scripts/mock-cluster.sh` → GitOps sync (incl. m5's OpenBao + `bao-init.sh`) → operator + bex-api; hello-go or whoami sample echoes env (deploy a sample that reflects an env var in its response — extend `examples/hello-go` if needed).
- Script this as `scripts/secrets-verify.sh` (exit 0 = pass) in the mold of `auth-verify.sh`/`bao-verify.sh` so it is repeatable, not a one-off manual run.

## Steps

1. Extend the sample app (or use whoami's env dump) so an env value is observable over HTTP.
2. Write `scripts/secrets-verify.sh`: positive flow, 403 flow, unset-env 503 flow.
3. Run green on the mock cluster; capture the run in the milestone notes.

## Files

- `scripts/secrets-verify.sh` (new)
- `examples/hello-go/` or `examples/whoami-app.yaml` (if the sample needs an env echo)

## Acceptance criteria

- [ ] `secrets-verify.sh` exits 0 on the mock cluster covering all three flows.
- [ ] The stored value is confirmed present in OpenBao, not only in the k8s Secret.

## Out of scope

- Prod (Hetzner) run — covered by the standard deploy pipeline once merged.
