45 lines
1.5 KiB
Markdown
45 lines
1.5 KiB
Markdown
|
---
|
||
|
|
id: surface.infotech.ops-warden.routing-catalog
|
||
|
|
name: ops-warden credential routing catalog
|
||
|
|
kind: policy
|
||
|
|
summary: Catalog mapping credential/access needs to their owning subsystem (who issues what), consumed via `warden route`.
|
||
|
|
owner: ops-warden
|
||
|
|
status: active
|
||
|
|
scope:
|
||
|
|
allowed_layers: [company, platform]
|
||
|
|
default_layer: company
|
||
|
|
mutability: deploy-time
|
||
|
|
security_class: policy
|
||
|
|
schema:
|
||
|
|
type: object
|
||
|
|
validator: ~/ops-warden/registry/routing/catalog.schema.yaml
|
||
|
|
sources:
|
||
|
|
- repo: ops-warden
|
||
|
|
path: registry/routing/catalog.yaml
|
||
|
|
role: company-baseline
|
||
|
|
relations:
|
||
|
|
consumed_by:
|
||
|
|
- service.warden-cli
|
||
|
|
overrides: []
|
||
|
|
depends_on_secret: []
|
||
|
|
related_to:
|
||
|
|
- surface.infotech.state-hub.api-config
|
||
|
|
evidence:
|
||
|
|
last_seen: '2026-06-26'
|
||
|
|
discovery_method: manual
|
||
|
|
change_log_ref: ATLAS-WP-0002-T03
|
||
|
|
---
|
||
|
|
|
||
|
|
# ops-warden credential routing catalog
|
||
|
|
|
||
|
|
The credential routing catalog answers "who owns this credential need?" — SSH certs
|
||
|
|
(ops-warden), API keys/DB passwords (OpenBao), login/OIDC (key-cape), etc. It is a
|
||
|
|
**routing policy** surface: it carries pointers, never secret values.
|
||
|
|
|
||
|
|
- **Source of truth:** `ops-warden/registry/routing/catalog.yaml`; consumed via
|
||
|
|
`warden route find/show`.
|
||
|
|
- **Boundary:** this surface maps the catalog's existence, owner, and scope; secret
|
||
|
|
values are never stored here (`security_class: policy`, no `depends_on_secret`).
|
||
|
|
- **Why indexed:** credential routing is high-frequency and high-risk; the atlas
|
||
|
|
records where the routing policy lives and who owns it.
|