coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0014: move TEM credential to platform/suppliers/scaleway/mas-tem-relay

Browse source 
Follows the 2026-10-08 supplier-account path convention
(ops-warden platform-supplier-credentials).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f
This commit is contained in:
tegwick 2026-10-18 11:33:24 +02:00
parent 8b38d3b9db
commit 22dfb810fb
1 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

17
plans/mas-tem-relay-smtp.md
View file

@ -25,7 +25,8 @@ mounts optionally at `/etc/mas-relay`. The lane is temporary: it is removed
with the `mas` namespace when MAS-WP-0003 closes.
Requested by hub message `14bdd217` (2026-10-18). The request suggested
`kv/mas/tem-relay`, a ClusterSecretStore `openbao-mas` and an ESO token.
`kv/mas/tem-relay`; it is placed at `platform/suppliers/scaleway/mas-tem-relay`
instead (supplier convention). It also asked for a ClusterSecretStore `openbao-mas` and an ESO token.
This plan keeps the shape but adapts it to the current conventions (§3).
## 2. Existing-structure survey
@ -35,14 +36,16 @@ Checked 2026-10-18 from repo sources only. **Live survey pending:** no
before review:
```bash
./scripts/plan-survey.py --kv-path platform/workloads/mas/tem-relay \
./scripts/plan-survey.py --kv-path platform/suppliers/scaleway/mas-tem-relay \
--policy workload-kv-read-mas-tem-relay \
--k8s-role external-secrets-mas-tem-relay \
--consumer mail-address-semantics --keyword tem --keyword smtp
```
- **Catalog** (`ops-warden/registry/routing/catalog.yaml`): no entry for
`mas`, TEM or SMTP relay.
`mas`, TEM or SMTP relay. Entry `platform-supplier-credentials` fixes
the path shape: a Scaleway API key is a supplier account credential, so it
lives at `platform/suppliers/scaleway/<account>`, not under `workloads/`.
- **railiance-platform:** no CCR, policy or store mentions `mas` or
`tem.scaleway`. The latest CCR is `CCR-2026-0050`.
- **Nearest lane:** `openbao-email-connect` (CCR-2026-0010) is a TEM-adjacent
@ -89,8 +92,8 @@ SEC-DSM §37:
| # | Action | Object | Reuse-vs-new rationale |
|---|---|---|---|
| 1 | create | KV v2 `platform/workloads/mas/tem-relay`, fields `username`, `password` (placeholder `xxx`) | No existing home (§2). This follows the `platform/workloads/<consumer>/<name>` convention, not `kv/` |
| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/workloads/mas/tem-relay` only | Single-path ESO reader; no metadata read needed |
| 1 | create | KV v2 `platform/suppliers/scaleway/mas-tem-relay`, fields `username`, `password` (placeholder `xxx`) | No existing home (§2). Supplier account path `platform/suppliers/<supplier>/<account>` (founder decision 2026-10-08, ops-warden `platform-supplier-credentials`); `credential-change.py` accepts it |
| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/suppliers/scaleway/mas-tem-relay` only | Single-path ESO reader; no metadata read needed |
| 3 | create | Kubernetes auth role `external-secrets-mas-tem-relay`: SA `mas-tem-relay-eso`, ns `mas`, audience `openbao`, ttl/max 15m, `token_no_default_policy` | Current pattern (CCR-2026-0050), with no static ESO token to deliver or expire |
| 4 | create (consumer repo) | ServiceAccount `mas-tem-relay-eso`, **namespaced** SecretStore `openbao-mas-tem-relay`, ExternalSecret `mas-relay` (keys `username`, `password`), all in ns `mas` | Namespaced instead of a ClusterSecretStore, so the store is deleted with the namespace |
| 5 | create (railiance-platform) | CCR-2026-00NN `workload-kv-read` for rows 1–3 | Platform allocates the CCR and applies it through the delegated applier |
@ -101,8 +104,8 @@ No catalog entry: the lane is temporary and has a single consumer.
## 4. Review notes
- **Naming:** `mas-tem-relay` is used for the path, policy, role, SA and
store, so one grep finds every object to retire. Secret `mas-relay` keeps
- **Naming:** `mas-tem-relay` is used for the supplier account segment,
policy, role, SA and store, so one grep finds every object to retire. Secret `mas-relay` keeps
the name the consumer asked for.
- **TTL/scoping:** 15m role TTL matches CCR-2026-0050. The policy covers one
data path and no metadata. Binding is to exact SA and namespace claims.