coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record audit sender OpenBao authority
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-08-14 20:12:33 +02:00
parent 68c5f0b177
commit c2af842c55
2 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/operator-runbook.md
View file

@ -84,10 +84,10 @@ custody defect: stop and investigate.
## Sender credential rotation ## Sender credential rotation
First deploy mints the registry in-cluster as Secret `audit-core-senders` OpenBao path `platform/workloads/audit-core/senders` is the authority for
(ops-mason plan `audit-core-openbao-runtime-custody`). The OpenBao path ExternalSecret `audit-core-senders`. The initial in-cluster registry was
`platform/workloads/audit-core/senders` is the later authority after a wrap-migrated on 2026-08-14 without printing or staging its values; do not
wrap-migrate; do not `bao kv put` it by hand. Rotation is overlap-first: replace that path with a founder paste. Rotation is overlap-first:
1. Add the replacement token to the sender's `tokens` list. Both work. 1. Add the replacement token to the sender's `tokens` list. Both work.
2. Move the sender to the new token. 2. Move the sender to the new token.

7
workplans/AUDIT-WP-0005-postgres-store-and-production-deployment.md
View file

@ -236,6 +236,13 @@ Findings fixed on the way:
T02 done for the provisioned-lane + no-delivery-gap claim. Empty senders T02 done for the provisioned-lane + no-delivery-gap claim. Empty senders
KV wrap-migrate is follow-on, not a founder paste. KV wrap-migrate is follow-on, not a founder paste.
Follow-on completed 2026-08-14: the live registry was streamed directly from
Kubernetes into `platform/workloads/audit-core/senders` under an attended
KeyCape/MFA platform-admin session. ExternalSecret `audit-core-senders` is
`SecretSynced`, owns the derived Secret, and preserved its pre-migration
checksum. The receiver rolled successfully and `/readyz` remained durable
`archive`; no sender token was printed or staged.
## T03 - Deploy the receiver ## T03 - Deploy the receiver
```task ```task