coulomb/fluid-telegram
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Adopt the confirmed secret layout

Browse source 
platform/workloads/infotech/fluid-telegram/<campaign>/<key>, confirmed with
the owner. The campaign sits between workload and bundle so two campaigns on
one interface cannot read each other's credentials, and both halves stay
overridable because the layout belongs to railiance-platform.

Records what ops-warden is for while it is fresh: it issues SSH certificates
and routes every other credential need to its owner, so it answers how to
authenticate to OpenBao and never holds what is stored there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1361245@bnt-lap001
Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a
This commit is contained in:
tegwick 2026-09-04 23:03:52 +02:00
parent ff2b19456f
commit c2ba960aee
3 changed files with 40 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

26
docs/provisioning.md
View file

@ -118,17 +118,23 @@ Reconciliation is **converging, never destructive**:
Nothing sensitive enters the spec or the resolved state. Both are committed.
Paths are `<mount>/<prefix>/<key>`, set by `BAO_MOUNT` and `FLUID_BAO_PREFIX`.
The default (`secret/fluid-telegram/<campaign>/telegram`) is a development
fallback, and the campaign is part of it so that two campaigns on one interface
cannot read each other's credentials.
Paths follow the fleet convention
`platform/workloads/<domain>/<workload>/<bundle>`, owned by railiance-platform
and routed to by ops-warden (`ops-warden/wiki/CredentialRouting.md`):
**This repository does not get to invent the fleet's secret layout.** ops-warden
routes API-key needs to railiance-platform, whose convention is
`platform/workloads/<domain>/<workload>/<bundle>` — see
`ops-warden/wiki/CredentialRouting.md`. The final names are owner-confirmed, so
they are configuration here rather than a constant, and the production values
are settled with railiance-platform before the first apply.
```
platform/workloads/infotech/fluid-telegram/<campaign>/<key>
```
The campaign sits between the workload and the bundle so that two campaigns on
one interface cannot read each other's credentials; the bundle then names the
secret itself. `BAO_MOUNT` and `FLUID_BAO_PREFIX` override both halves, because
the layout belongs to its owner and not to this repository.
ops-warden does not hold any of these. It **issues** SSH certificates and
**routes** every other credential need to the subsystem that owns it, so it is
where to ask *how* to authenticate to OpenBao — `warden access 'openbao token
for reading a kv secret'` — and never where the secret lives.
| Secret | Key | Rule |
|---|---|---|