Skip to content

Work Log - 2026-08-17

🎯 Focus for Today

Module maintenance and refactoring. Preparing for Python NZ presentations this week.

We are going to setup some of our docs sites in the Python modules using GitHub pages, and exercise our DNS management workflow in the process. Have to add some CNAME records for the GitHub pages site, so gives us an opportunity to add some records and look at our workflow.

✅ What Got Done

Updated some modules:

  • octodns-metaname 0.3.0
  • op-opsdevnz 0.2.1

🧠 Notes & Reflections

octodns-metaname: Secret resolver refactoring

Moved the OctoDNS secret-resolution hook from op-opsdevnz into octodns_metaname.op_opsdevnz_hooks. The old setup had a Metaname-specific hook living in the 1Password helper module — the wrong layer. The provider now owns its own adapter and delegates generic 1Password resolution back to op-opsdevnz.

This means:

  • octodns_metaname owns the OCTODNS_METANAME_SECRET_RESOLVER hook
  • op-opsdevnz owns op:// resolution (SDK + CLI fallback)
  • Cleaner separation of concerns

CI: Python 3.14 + SDK-only resolution

Replaced the custom python-opcli Docker image with standard python:3.14-slim. The custom image bundled the 1Password CLI, but we now use the SDK directly via OP_SERVICE_ACCOUNT_TOKEN — same authentication mechanism, fewer moving parts.

Changes:

  • All CI jobs use python:3.14-slim
  • Removed build_python_opcli job and docker/ directory
  • Secret resolution uses the SDK exclusively in CI

Documentation

Rewrote the secret-resolution runbook with a clearer diagram showing module boundaries (octodns_metaname → op_opsdevnz → 1Password).

Originally we thought we needed to use the CLI to resolve secrets in CI, and built a docker container to use it, but then we realised the SDK can do the same thing without the additional binary. Both paths use the same 1Password service account token. The difference is whether the op binary or the SDK library makes the HTTP request.

Watching for 1Password's upcoming OIDC features — may simplify this further by removing the need for a persistent service account token.

⏳ Next

  • Update opsdev.nz parent repo submodule pointers
  • Test end-to-end in staging pipeline