From 37b4d708232f0a5dc79dce43a70553bf48fc771d Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sun, 13 Sep 2026 16:25:33 +0200
Subject: [PATCH] Establish scoped KeyCape factor custody and verified
 automatic renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
---
 sso-mfa/k8s/keycape/deployment.yaml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml
index 90d2021..1a51b70 100644
--- a/sso-mfa/k8s/keycape/deployment.yaml
+++ b/sso-mfa/k8s/keycape/deployment.yaml
@@ -10,7 +10,7 @@
 #
 # Prerequisites (apply in order):
 #   1. keycape-config Secret     — run keycape/create-secrets.sh
-#   2. keycape-pi-token Secret   — run keycape/create-pi-token.sh (after T04 bootstrap)
+#   2. keycape-factor-read Secret — ESO delivery owned by railiance-platform RPF-WP-0040
 #   3. This file
 #   4. middleware.yaml + ingress.yaml
 #
@@ -83,6 +83,9 @@ spec:
                   key: client-secret
 
           volumeMounts:
+            - name: factor-token
+              mountPath: /etc/keycape-factor
+              readOnly: true
             # keycape-config Secret provides config.yaml and key.pem
             - name: config-secret
               mountPath: /etc/keycape
@@ -119,6 +122,13 @@ spec:
               memory: "128Mi"
 
       volumes:
+        - name: factor-token
+          secret:
+            secretName: keycape-factor-read
+            defaultMode: 0440
+            items:
+              - key: admin-token
+                path: admin-token
         - name: config-secret
           secret:
             secretName: keycape-config