From ff2b19456f6f1d89f05d7cfec9157841d0948cdf Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 4 Sep 2026 22:32:09 +0200 Subject: [PATCH] Make the secret layout configuration, not a constant ops-warden routes API-key needs to railiance-platform, whose convention is platform/workloads///. This repository invented secret/fluid-telegram//telegram instead, which is not its call to make -- a service that picks its own paths in someone else's store is how a policy ends up written around a mistake. Mount and prefix are now BAO_MOUNT and FLUID_BAO_PREFIX, with the old scheme kept as a development fallback. The runbook points at `warden access` for the current shape and at OIDC login rather than a plain token, and names the check that tells whether a login actually took. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa Assistant: claude-code Assistant-Model: opus Assistant-Process: 1361245@bnt-lap001 Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a --- docs/provisioning.md | 13 +++++++++++-- docs/seeding-runbook.md | 19 ++++++++++++++++++- internal/secrets/secrets.go | 9 ++++++++- 3 files changed, 37 insertions(+), 4 deletions(-) diff --git a/docs/provisioning.md b/docs/provisioning.md index ac430e8..4bd1af8 100644 --- a/docs/provisioning.md +++ b/docs/provisioning.md @@ -118,8 +118,17 @@ Reconciliation is **converging, never destructive**: Nothing sensitive enters the spec or the resolved state. Both are committed. -Paths are computed as `/fluid-telegram//telegram/`, so two -campaigns on one interface cannot read each other's credentials. +Paths are `//`, set by `BAO_MOUNT` and `FLUID_BAO_PREFIX`. +The default (`secret/fluid-telegram//telegram`) is a development +fallback, and the campaign is part of it so that two campaigns on one interface +cannot read each other's credentials. + +**This repository does not get to invent the fleet's secret layout.** ops-warden +routes API-key needs to railiance-platform, whose convention is +`platform/workloads///` — see +`ops-warden/wiki/CredentialRouting.md`. The final names are owner-confirmed, so +they are configuration here rather than a constant, and the production values +are settled with railiance-platform before the first apply. | Secret | Key | Rule | |---|---|---| diff --git a/docs/seeding-runbook.md b/docs/seeding-runbook.md index 5343c3d..20759ec 100644 --- a/docs/seeding-runbook.md +++ b/docs/seeding-runbook.md @@ -73,7 +73,24 @@ secret/fluid-telegram/hall-of-helix/telegram/bot-token written by the t secret/fluid-telegram/hall-of-helix/telegram/redaction-salt written by the tool, once ``` -Set these before any command below. `BAO_MOUNT` defaults to `secret`. +Those are the **development defaults**. The fleet convention for an API-key +bundle is `platform/workloads///`, owned by +railiance-platform; ask ops-warden for the current shape and override it: + +```bash +export BAO_MOUNT=platform +export FLUID_BAO_PREFIX=workloads/infotech/fluid-telegram +``` + +Authenticate the way ops-warden routes you, which is OIDC through key-cape +rather than a plain token login: + +```bash +warden access 'openbao token for reading a kv secret' # shows auth, path, policy +bao login -method=oidc role= +``` + +`bao token lookup` succeeding is the check that the login actually took. ```bash export BAO_ADDR=https://bao.coulomb.social diff --git a/internal/secrets/secrets.go b/internal/secrets/secrets.go index d8414e3..f66cba8 100644 --- a/internal/secrets/secrets.go +++ b/internal/secrets/secrets.go @@ -54,12 +54,19 @@ func NewFromEnv(campaign string) (*Store, error) { return nil, fmt.Errorf("no OpenBao token: set BAO_TOKEN, or run `bao login` "+ "to write ~/.vault-token (BAO_ADDR is %s)", addr) } + // Mount and prefix are configurable because this repo does not get to invent + // the fleet's secret layout. ops-warden routes API-key needs to + // railiance-platform, whose convention is + // platform/workloads/// -- see + // ops-warden/wiki/CredentialRouting.md. The defaults below are a local + // fallback for development, not the intended production location. mount := firstNonEmpty(os.Getenv("BAO_MOUNT"), "secret") + prefix := firstNonEmpty(os.Getenv("FLUID_BAO_PREFIX"), "fluid-telegram/"+campaign+"/telegram") return &Store{ addr: strings.TrimSuffix(addr, "/"), token: token, mount: mount, - prefix: "fluid-telegram/" + campaign + "/telegram", + prefix: strings.Trim(prefix, "/"), hc: &http.Client{Timeout: 20 * time.Second}, }, nil }