Release v0.1.16

tools/deployment/govoplan_deploy/cli.py

@@ -219,6 +219,13 @@ def build_parser() -> argparse.ArgumentParser:
     kubernetes.add_argument("--namespace", default="govoplan")
     kubernetes.add_argument("--secret-name", default="govoplan-runtime")
     kubernetes.add_argument("--tls-secret-name", default="govoplan-tls")
+    kubernetes.add_argument(
+        "--s3-ca-secret-name",
+        help=(
+            "Optional Secret containing ca.crt for the external S3 endpoint; "
+            "mounted read-only into backend runtime roles."
+        ),
+    )
     kubernetes.add_argument("--ingress-class-name")
     kubernetes.add_argument(
         "--output",
@@ -239,7 +246,10 @@ def build_parser() -> argparse.ArgumentParser:
     verify_kubernetes.add_argument(
         "--api-key-env",
         default="GOVOPLAN_OPS_API_KEY",
-        help="Environment variable containing an API key with Ops read scope.",
+        help=(
+            "Environment variable containing an API key authorized to read "
+            "Ops status."
+        ),
     )
     verify_kubernetes.add_argument(
         "--exercise-api-pod-loss",
@@ -1146,6 +1156,7 @@ def _render_kubernetes(args: argparse.Namespace) -> int:
         namespace=args.namespace,
         secret_name=args.secret_name,
         tls_secret_name=args.tls_secret_name,
+        s3_ca_secret_name=args.s3_ca_secret_name,
         ingress_class_name=args.ingress_class_name,
         backup_required=backup_required,
         backup_evidence=backup_summary,
@@ -1170,7 +1181,8 @@ def _verify_kubernetes(args: argparse.Namespace) -> int:
     api_key = str(os.environ.get(args.api_key_env) or "").strip()
     if not api_key:
         raise ValueError(
-            f"{args.api_key_env} must contain an API key with Ops read scope"
+            f"{args.api_key_env} must contain an API key authorized to read "
+            "Ops status"
         )
     ops_url = args.ops_url or (spec.public_url.rstrip("/") + "/api/v1/ops/status")
     evidence = collect_kubernetes_evidence(