coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire static OpenBao ESO token bootstrap (RPF-WP-0045-T06)

Browse source 
The openbao-activity-core store has used OpenBao Kubernetes auth since
2026-09-21 and synced cleanly for more than 24 hours. Remove the
openbao-eso-token-apply script and Makefile target, point the manifest
comments and runbooks at the Kubernetes-auth store, and guard against
reintroducing the script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-23 17:47:11 +02:00
parent 94b5c45f22
commit b690ce03fa
8 changed files with 26 additions and 114 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/test_openbao_eso_token_contract.py
View file

@ -4,20 +4,12 @@ from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
def test_activity_core_eso_token_covers_every_declared_runtime_lane():
script = (ROOT / "scripts" / "openbao-eso-token-apply.sh").read_text(encoding="utf-8")
required_policies = {
"workload-kv-read-issue-core-runtime",
"workload-kv-read-forgejo-admin",
"workload-kv-read-railiance-backup-offsite-lane",
"workload-kv-read-llm-connect-provider-secrets",
}
default_line = next(
line for line in script.splitlines() if line.startswith("DEFAULT_POLICIES=")
)
for policy in required_policies:
assert policy in default_line
def test_static_eso_token_bootstrap_stays_retired():
# RPF-WP-0045 moved the store to OpenBao Kubernetes auth; a static token
# would expire again and must not be reintroduced.
assert not (ROOT / "scripts" / "openbao-eso-token-apply.sh").exists()
makefile = (ROOT / "Makefile").read_text(encoding="utf-8")
assert "openbao-eso-token-apply" not in makefile
def test_railiance_runbook_applies_and_waits_for_llm_connect_external_secret():