From 22dfb810fbc155f4dd361ff9abf0bcd684f1478a Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 18 Oct 2026 11:33:24 +0200 Subject: [PATCH] MASON-WP-0014: move TEM credential to platform/suppliers/scaleway/mas-tem-relay Follows the 2026-10-08 supplier-account path convention (ops-warden platform-supplier-credentials). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 278674@bnt-lap001 Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f --- plans/mas-tem-relay-smtp.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/plans/mas-tem-relay-smtp.md b/plans/mas-tem-relay-smtp.md index 47f1550..1cde581 100644 --- a/plans/mas-tem-relay-smtp.md +++ b/plans/mas-tem-relay-smtp.md @@ -25,7 +25,8 @@ mounts optionally at `/etc/mas-relay`. The lane is temporary: it is removed with the `mas` namespace when MAS-WP-0003 closes. Requested by hub message `14bdd217` (2026-10-18). The request suggested -`kv/mas/tem-relay`, a ClusterSecretStore `openbao-mas` and an ESO token. +`kv/mas/tem-relay`; it is placed at `platform/suppliers/scaleway/mas-tem-relay` +instead (supplier convention). It also asked for a ClusterSecretStore `openbao-mas` and an ESO token. This plan keeps the shape but adapts it to the current conventions (§3). ## 2. Existing-structure survey @@ -35,14 +36,16 @@ Checked 2026-10-18 from repo sources only. **Live survey pending:** no before review: ```bash -./scripts/plan-survey.py --kv-path platform/workloads/mas/tem-relay \ +./scripts/plan-survey.py --kv-path platform/suppliers/scaleway/mas-tem-relay \ --policy workload-kv-read-mas-tem-relay \ --k8s-role external-secrets-mas-tem-relay \ --consumer mail-address-semantics --keyword tem --keyword smtp ``` - **Catalog** (`ops-warden/registry/routing/catalog.yaml`): no entry for - `mas`, TEM or SMTP relay. + `mas`, TEM or SMTP relay. Entry `platform-supplier-credentials` fixes + the path shape: a Scaleway API key is a supplier account credential, so it + lives at `platform/suppliers/scaleway/`, not under `workloads/`. - **railiance-platform:** no CCR, policy or store mentions `mas` or `tem.scaleway`. The latest CCR is `CCR-2026-0050`. - **Nearest lane:** `openbao-email-connect` (CCR-2026-0010) is a TEM-adjacent @@ -89,8 +92,8 @@ SEC-DSM §37: | # | Action | Object | Reuse-vs-new rationale | |---|---|---|---| -| 1 | create | KV v2 `platform/workloads/mas/tem-relay`, fields `username`, `password` (placeholder `xxx`) | No existing home (§2). This follows the `platform/workloads//` convention, not `kv/` | -| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/workloads/mas/tem-relay` only | Single-path ESO reader; no metadata read needed | +| 1 | create | KV v2 `platform/suppliers/scaleway/mas-tem-relay`, fields `username`, `password` (placeholder `xxx`) | No existing home (§2). Supplier account path `platform/suppliers//` (founder decision 2026-10-08, ops-warden `platform-supplier-credentials`); `credential-change.py` accepts it | +| 2 | create | policy `workload-kv-read-mas-tem-relay`: `read` on `platform/data/suppliers/scaleway/mas-tem-relay` only | Single-path ESO reader; no metadata read needed | | 3 | create | Kubernetes auth role `external-secrets-mas-tem-relay`: SA `mas-tem-relay-eso`, ns `mas`, audience `openbao`, ttl/max 15m, `token_no_default_policy` | Current pattern (CCR-2026-0050), with no static ESO token to deliver or expire | | 4 | create (consumer repo) | ServiceAccount `mas-tem-relay-eso`, **namespaced** SecretStore `openbao-mas-tem-relay`, ExternalSecret `mas-relay` (keys `username`, `password`), all in ns `mas` | Namespaced instead of a ClusterSecretStore, so the store is deleted with the namespace | | 5 | create (railiance-platform) | CCR-2026-00NN `workload-kv-read` for rows 1–3 | Platform allocates the CCR and applies it through the delegated applier | @@ -101,8 +104,8 @@ No catalog entry: the lane is temporary and has a single consumer. ## 4. Review notes -- **Naming:** `mas-tem-relay` is used for the path, policy, role, SA and - store, so one grep finds every object to retire. Secret `mas-relay` keeps +- **Naming:** `mas-tem-relay` is used for the supplier account segment, + policy, role, SA and store, so one grep finds every object to retire. Secret `mas-relay` keeps the name the consumer asked for. - **TTL/scoping:** 15m role TTL matches CCR-2026-0050. The policy covers one data path and no metadata. Binding is to exact SA and namespace claims.