tegwick
772e906fad
railiance-platform filed the hub-writer caller as proposed and did not apply it. key-cape has no reuse-surface-hub-writers group; the founder creates it in the LLDAP admin UI before the role can be bound. Assistant: grok Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
584 lines
37 KiB
YAML
584 lines
37 KiB
YAML
operators/nextcloud/backup:
|
|
description: Operator login (BACKUP_USERNAME, BACKUP_PASSWORD) for the dedicated Nextcloud Storage Share
|
|
account Backup on nx4069.your-storageshare.de, the independent secondary backup copy lane.
|
|
missing: []
|
|
on_loss: Resettable by the founder in the Storage Share provider admin (attended). If the share is recreated,
|
|
update the workload lane's NC_WEBDAV_TOKEN. Stored backups are unaffected.
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/docs/backup-credential-recovery.md; railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml
|
|
sources:
|
|
- railiance-platform reply 3e490cd4 (2026-10-09)
|
|
used_by: Attended operator only, to manage the account and its create-only /railiance-backups share.
|
|
Never delivered to production; workloads get only the derived NC_WEBDAV_TOKEN/NC_WEBDAV_URL via the
|
|
workload lane.
|
|
platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets:
|
|
description: llm-connect provider access through OpenBao workload KV and External Secrets
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Replace OPENROUTER_API_KEY directly in OpenBao and record non-secret
|
|
rotation evidence.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0003-llm-connect-openrouter-api-key.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0003-llm-connect-openrouter-api-key.yaml
|
|
- ops-warden catalog openrouter-llm-connect
|
|
used_by: ExternalSecret to Secret llm-connect-provider-secrets in the activity-core namespace
|
|
platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01:
|
|
description: Deliver the bearer token of ops_run queue worker rein-aharness-metered@railiance01 to the
|
|
activity-core runtime Secret through External Secrets.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
|
|
1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0030-activity-core-ops-run-worker-rein-aharness-metered-railiance01.yaml
|
|
used_by: ExternalSecret actcore-ops-run-worker-tokens merges ACTIVITY_CORE_WORKER_TOKEN_METERED into
|
|
Secret actcore-runtime-secret in namespace activity-core.
|
|
platform/workloads/activity-core/ops-run-workers/rein-aharness-railiance01:
|
|
description: Deliver the bearer token of ops_run queue worker rein-aharness@railiance01 to the activity-core
|
|
runtime Secret through External Secrets.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: activity-core re-mints the worker token at its path. ESO syncs it within
|
|
1h, and the queue accepts the new token per ACTIVITY_CORE_WORKERS.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0029-activity-core-ops-run-worker-rein-aharness-railiance01.yaml
|
|
used_by: ExternalSecret actcore-ops-run-worker-tokens merges ACTIVITY_CORE_WORKER_TOKEN into Secret
|
|
actcore-runtime-secret in namespace activity-core.
|
|
platform/workloads/agent-harness/forgejo-deploy-key:
|
|
description: agent-harness Forgejo deploy key (write sandbox; binky-control at cutover)
|
|
missing: []
|
|
on_loss: 're-establish by railiance-platform: On railiance01 generate a new ed25519 keypair under ~/.local/agent-harness/ssh/
|
|
(mode 600); do not paste the private key into chat or Git.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: ops-warden/wiki/playbooks/agent-harness-secrets.md#lane-2-forgejo-deploy-key
|
|
sources:
|
|
- ops-warden catalog agent-harness-forgejo-deploy
|
|
- railiance-platform reply 3e490cd4 (2026-10-09)
|
|
used_by: agent-harness worker on railiance01 (private key at ~/.local/agent-harness/ssh/forgejo-deploy);
|
|
this OpenBao copy is the recovery copy, via ops-warden agent-harness-forgejo-deploy (policy workload-kv-read-agent-harness-forgejo).
|
|
Deploy key on coulomb/executor-sandbox (write).
|
|
platform/workloads/approval-engine/audit-sender:
|
|
description: Provide only the approval-engine sender with source=approval-engine, tenants=[tenant:platform],
|
|
may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Reviewed overlap-first rotation: append a replacement to this sender
|
|
only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
|
|
helper refuses rotation and unexpected existing values.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0021-approval-engine-audit.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0021-approval-engine-audit.yaml
|
|
used_by: 'ClusterSecretStore openbao-approval-engine-audit restricted to namespace approval-engine;
|
|
ExternalSecret and Secret approval-engine/approval-engine-audit, key audit-token. Source: manifests/factory-audit-senders.yaml.
|
|
A missing namespace stays a workload-owner prerequisite; this packet creates none.'
|
|
platform/workloads/approval-engine/operator-client:
|
|
description: Hold the approval-engine-operator confidential client secret in platform custody and project
|
|
it into the KeyCape runtime so KeyCape can verify presented client_credentials for the operator client.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: KeyCape mints a replacement client secret; platform writes the new
|
|
KV version under the same attended authority. Rotation is independent of CCR-2026-0017.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0018-keycape-approval-engine-operator-client.yaml#lifecycle.rotate;
|
|
railiance-platform/credential-change-requests/CCR-2026-0020-approval-engine-operator-client-read.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0018-keycape-approval-engine-operator-client.yaml
|
|
- CCR-2026-0020-approval-engine-operator-client-read.yaml
|
|
used_by: 'ClusterSecretStore openbao-keycape-approval-engine-operator, limited to namespace sso, to
|
|
ExternalSecret sso/keycape-approval-engine-operator-client and Secret sso/keycape-approval-engine-operator-client
|
|
with key client-secret. KeyCape resolves it as KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET through
|
|
a secretKeyRef. Manifests: argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml
|
|
and keycape-approval-clients.externalsecrets.yaml.'
|
|
platform/workloads/audit-core/senders:
|
|
description: audit-core sender registry (write and operator-read tokens)
|
|
missing: []
|
|
on_loss: audit-core re-mints sender tokens and every projected copy is reseeded; senders queue to their
|
|
local outboxes meanwhile. See ops-mason/plans/audit-core-openbao-runtime-custody.md.
|
|
owner: ops-mason
|
|
review: accepted
|
|
rotation: ops-warden/wiki/playbooks/audit-core-senders.md#worker-checklist
|
|
sources:
|
|
- ops-warden catalog audit-core-senders
|
|
- ops-mason plan (hand-filled 2026-10-09)
|
|
used_by: audit-core on railiance01 (sender registry authority); seed source for per-sender projections
|
|
such as tenant-engine/audit-core-sender
|
|
platform/workloads/core-hub/forgejo-source-read:
|
|
description: Hold a dedicated Forgejo PAT scoped exactly read:repository and project it through External
|
|
Secrets into namespace core-hub as the Secret that the rapp-core-hub publisher mounts read-only at
|
|
/var/run/secrets/repo-manager/forgejo/token.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Every 180 days or on owner change. Mint a replacement read:repository
|
|
PAT for core-hub-source, write it to OpenBao from stdin, let ESO refresh (5m), pass make verify-publisher,
|
|
then revoke the predecessor PAT and record evidence.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0031-core-hub-forgejo-source-read.yaml
|
|
- ops-warden catalog core-hub-forgejo-source-read
|
|
used_by: ClusterSecretStore openbao-core-hub-forgejo-source (conditions limited to namespace core-hub)
|
|
feeding ExternalSecret core-hub/repo-manager-forgejo-source, which materializes Secret repo-manager-forgejo-source
|
|
with the single key token (remoteRef workloads/core-hub/forgejo-source-read property FORGEJO_SOURCE_TOKEN),
|
|
explicit empty target metadata template, creationPolicy Owner, deletionPolicy Retain. rapp-core-hub
|
|
then sets publisher.existingSecret to repo-manager-forgejo-source with tokenKey token. Both ma
|
|
platform/workloads/core-hub/runtime:
|
|
description: Project the existing Core Hub protected-API token into the private railiance01 runtime
|
|
through a namespace-limited ExternalSecret while preserving the token across the relocation window.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Coordinate a new random token with all protected API consumers, update
|
|
the OpenBao field through attended custody, wait for ESO sync, roll Core Hub and consumers, verify
|
|
protected calls, then invalidate the old token.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0013-core-hub-runtime-api-token.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0013-core-hub-runtime-api-token.yaml
|
|
used_by: ClusterSecretStore openbao-core-hub-runtime, limited to namespace core-hub, to ExternalSecret
|
|
core-hub/core-hub-api-token and Secret core-hub-api-token. The rapp package consumes this Secret separately
|
|
from runtime and migration PostgreSQL lease Secrets.
|
|
platform/workloads/coulomb-social/backup-primary:
|
|
description: Read this application backup publisher key pair into the admitted node delivery process;
|
|
no other workload credential or escrow.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Separate owner-approved CAS rotation and atomic host replacement contract
|
|
required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
|
|
acceptance, then revoke predecessor at provider.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0036-coulomb-social-backup-primary.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0036-coulomb-social-backup-primary.yaml
|
|
used_by: /etc/coulomb-social-backup/primary.env
|
|
platform/workloads/coulomb/fluid-telegram/hall-of-helix/bot-token:
|
|
description: Telegram bot token for the hall-of-helix campaign bot, created by the provisioner. Not
|
|
the operator session.
|
|
missing: []
|
|
on_loss: Regenerate with BotFather via the operator account (attended) and write a new version; the
|
|
old token stops working.
|
|
owner: fluid-telegram
|
|
review: draft
|
|
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
|
sources:
|
|
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
|
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
|
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create,
|
|
read, update. The future adapter lane (MASON-IN-0003) may read it.
|
|
platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-app:
|
|
description: Telegram API application credentials (api_id, api_hash) for the hall-of-helix provisioner.
|
|
Not a session and not a bot token.
|
|
missing: []
|
|
on_loss: 'Re-create the app at my.telegram.org with the operator''s account and write a new version
|
|
(attended). Cost: provisioning pauses; the existing session and bot keep working.'
|
|
owner: fluid-telegram
|
|
review: draft
|
|
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
|
sources:
|
|
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
|
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
|
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Read only.
|
|
platform/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session:
|
|
description: 'MTProto session (session_b64) of the operator''s Telegram account: a full-account credential.
|
|
Not the bot token.'
|
|
missing: []
|
|
on_loss: Log in again with the operator's Telegram account through the provisioner (attended, needs
|
|
the phone/2FA) and write a new version. Revoke the old session in Telegram if it may have leaked.
|
|
owner: fluid-telegram
|
|
review: draft
|
|
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
|
sources:
|
|
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
|
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
|
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create,
|
|
read, update.
|
|
platform/workloads/coulomb/fluid-telegram/hall-of-helix/redaction-salt:
|
|
description: Redaction salt (salt) for hall-of-helix, created once by the provisioner; write-once.
|
|
missing: []
|
|
on_loss: Not recoverable by design; a new salt changes every redacted identifier. Replacing it is a
|
|
separately approved platform action, not a provisioner capability.
|
|
owner: fluid-telegram
|
|
review: draft
|
|
rotation: ops-mason/plans/fluid-telegram-operator-credential-lane.md; railiance-platform CCR-2026-0039
|
|
sources:
|
|
- ops-mason plan fluid-telegram-operator-credential-lane.md (approved 2026-10-09)
|
|
used_by: Attended fluid-telegram provisioner only, via bao login -method=oidc -path=netkingdom role=fluid-telegram-hall-of-helix-workload-kv
|
|
(group fluid-telegram-operators, aal2, 15m). Agents are denied (agent-high-risk-boundary). Create
|
|
once, read.
|
|
platform/workloads/coulomb/whynot-design/npm-publish:
|
|
description: npm package publishing through ops-warden caller-scoped fetch/exec
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Replace NPM_AUTH_TOKEN value directly in OpenBao and record non-secret
|
|
rotation evidence.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0001-whynot-design-npm-publish.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0001-whynot-design-npm-publish.yaml
|
|
- ops-warden catalog whynot-design-npm-publish
|
|
- railiance-platform reply 3e490cd4 (2026-10-09)
|
|
used_by: Attended whynot-design npm publishing via ops-warden whynot-design-npm-publish (warden access
|
|
... --exec -- npm publish), OIDC role whynot-design-workload-kv-read on auth/netkingdom. Field NPM_AUTH_TOKEN.
|
|
platform/workloads/email-connect/backup-primary:
|
|
description: Read this application backup publisher key pair into the admitted node delivery process;
|
|
no other workload credential or escrow.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Separate owner-approved CAS rotation and atomic host replacement contract
|
|
required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery
|
|
acceptance, then revoke predecessor at provider.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0037-email-connect-backup-primary.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0037-email-connect-backup-primary.yaml
|
|
used_by: /etc/email-connect-backup/primary.env
|
|
platform/workloads/email-connect/transactional:
|
|
description: Deliver EMAIL_CONNECT_INGEST_TOKEN and IONOS SMTP username/password into the email-connect
|
|
namespace via External Secrets so the transactional receiver can send invitation and verification
|
|
mail without baking secrets into the image, Git, or user-engine.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Overlap-first: put new SMTP password and/or ingest token in OpenBao;
|
|
wait for ESO refresh (or force sync); roll email-connect and user-engine as needed; revoke old provider
|
|
password / retire old bearer.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0010-email-connect-transactional.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0010-email-connect-transactional.yaml
|
|
- ops-warden catalog email-connect-transactional
|
|
used_by: ClusterSecretStore openbao-email-connect (tokenSecretRef openbao-email-connect-eso-token; namespace
|
|
condition email-connect) at railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-email-connect.clustersecretstore.yaml
|
|
→ ExternalSecret email-connect/email-connect-runtime → Secret email-connect-runtime. Package manifests
|
|
in email-connect/deploy/k8s/railiance/ (not applied until this CCR is approved and the KV secret is
|
|
provisioned).
|
|
platform/workloads/forgejo/forgejo-admin:
|
|
description: Forgejo admin API token for package prune, registry ops, org webhooks, and operator bootstrap
|
|
on workstations and activity-core worker
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Mint a new PAT in Forgejo, update API_TOKEN in OpenBao, record non-secret
|
|
rotation evidence, and restart dependent automation after downstream consumers load from OpenBao.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0006-forgejo-admin-api-token-lane.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0006-forgejo-admin-api-token-lane.yaml
|
|
- ops-warden catalog forgejo-admin-api-token
|
|
used_by: railiance-platform tools/cmd/forgejo-package-prune, activity-core weekly-forgejo-package-prune
|
|
shell resolver, and railiance-apps Forgejo tools (load_token pattern after lane verified)
|
|
platform/workloads/glas-harness/claude-agent-dev:
|
|
description: Dedicated Claude Code inference for the Glas local agent-dev profile, delivered by the
|
|
sandbox owner.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Create a replacement provider key, write with expected-version CAS,
|
|
stop old runs, verify new delivery and inference, then revoke the predecessor at Anthropic and prove
|
|
its denial.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0016-glas-claude-anthropic.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0016-glas-claude-anthropic.yaml
|
|
used_by: Sand-boxer delivers ANTHROPIC_API_KEY only to the selected Claude workload; neither the Glas
|
|
caller nor the runtime receives an OpenBao token.
|
|
platform/workloads/inbound-library/imap:
|
|
description: inbound-library AppRole for non-interactive library@coulomb.social IMAP read
|
|
missing: []
|
|
on_loss: 'rotate by ops-mason: bao write -f auth/approle/role/inbound-library/secret-id -> new secret_id;
|
|
deliver mode-0600 to ~/.local/inbound-library/approle; shred old secret_id file.'
|
|
owner: ops-mason
|
|
review: accepted
|
|
rotation: ops-warden/wiki/playbooks/inbound-library-imap-approle.md#worker-checklist
|
|
sources:
|
|
- ops-warden catalog inbound-library-imap-approle
|
|
- ops-mason plan (hand-filled 2026-10-09)
|
|
used_by: inbound-library systemd user timer on the workstation, via AppRole inbound-library (reads once
|
|
per run, then revokes its token)
|
|
platform/workloads/informed-decision/audit-sender:
|
|
description: Provide only the informed-decision sender with source=informed-decision, tenants=[tenant:platform],
|
|
may_write=true, may_read=false, evidence_kind=load-bearing, secret_policy=redact.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Reviewed overlap-first rotation: append a replacement to this sender
|
|
only, deliver it, prove acceptance, then remove the predecessor and prove refusal. The first-provision
|
|
helper refuses rotation and unexpected existing values.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0022-informed-decision-audit.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0022-informed-decision-audit.yaml
|
|
used_by: 'ClusterSecretStore openbao-informed-decision-audit restricted to namespace informed-decision;
|
|
ExternalSecret and Secret informed-decision/informed-decision-audit, key token. Source: manifests/factory-audit-senders.yaml.
|
|
A missing namespace stays a workload-owner prerequisite; this packet creates none.'
|
|
platform/workloads/informed-decision/sitting-requester:
|
|
description: create-only sitting requester KeyCape verifier custody; approval:create only; subject informed-decision;
|
|
audience approval-engine.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
|
|
refusal proof.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml#lifecycle.rotate;
|
|
railiance-platform/credential-change-requests/CCR-2026-0027-informed-decision-sitting-requester-reader.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0026-informed-decision-sitting-requester-verifier.yaml
|
|
- CCR-2026-0027-informed-decision-sitting-requester-reader.yaml
|
|
- CCR-2026-0032.yaml
|
|
used_by: sso/keycape-informed-decision-sitting-requester-client via ESO; env KEYCAPE_INFORMED_DECISION_SITTING_REQUESTER_CLIENT_SECRET
|
|
platform/workloads/issue-core/issue-core/issue-core-runtime:
|
|
description: issue-core runtime ingestion through OpenBao workload KV and External Secrets
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Replace issue-core runtime secret values directly in OpenBao and record
|
|
non-secret rotation evidence.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0002-issue-core-ingestion-api-key.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0002-issue-core-ingestion-api-key.yaml
|
|
- ops-warden catalog issue-core-ingestion-api-key
|
|
used_by: ExternalSecret issue-core/issue-core-runtime -> Secret issue-core-runtime in the issue-core
|
|
namespace
|
|
platform/workloads/keycape/secrets-engine-openbao:
|
|
description: Hold the secrets-engine-openbao client secret authoritatively in platform KV and deliver
|
|
it to the KeyCape issuer through sso-only ESO
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Roll-forward only: custody child writes a new version with cas=<current>
|
|
under a standing rotation approval for this CCR (event-driven + 90d); never a read or restore of an
|
|
old version'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0033.yaml#lifecycle.rotate; railiance-platform/credential-change-requests/CCR-2026-0034.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0033.yaml
|
|
- CCR-2026-0034.yaml
|
|
used_by: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side delivery only
|
|
platform/workloads/net-kingdom/keycape-factor-issuer:
|
|
description: Renewable login (USERNAME, PASSWORD, REQUEST) of the local privacyIDEA service admin keycape-factor-reader,
|
|
permission tokenlist for realm coulomb only. Used to obtain the short-lived factor-read JWT. Not the
|
|
JWT KeyCape uses, not a privacyIDEA admin credential (pi-admin is operators/privacyidea/pi-admin).
|
|
missing:
|
|
- rotation
|
|
on_loss: 'Resettable by a privacyIDEA administrator via attended pi-admin custody: new password for
|
|
keycape-factor-reader, CAS-write here. Cost: renewal stops; JWT valid up to 2h, then coulomb MFA lookup
|
|
fails closed until restored.'
|
|
owner: railiance-platform
|
|
review: draft
|
|
rotation: ''
|
|
sources:
|
|
- net-kingdom reply 75b48030 (2026-10-09); rotation is a railiance-platform gap
|
|
used_by: CronJob sso/keycape-factor-renewer (own SA, every 10 min, 5-min OpenBao session); writes keycape-factor-read.
|
|
The keycape-factor-read ESO reader is denied this path.
|
|
platform/workloads/net-kingdom/keycape-factor-read:
|
|
description: Deliver only a provider-issued coulomb factor-read JWT to KeyCape, separating it from issuer
|
|
credentials and signing keys.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Issue replacement before expiry, CAS update exact KV, verify ESO projection
|
|
and consumer acceptance; retain no plaintext artifacts.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0023-keycape-factor-read.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0023-keycape-factor-read.yaml
|
|
used_by: Namespace-restricted ClusterSecretStore openbao-keycape-factor-read -> sso/keycape-factor-read
|
|
Secret admin-token. Mount only the JWT in KeyCape; provider password remains in separate custody.
|
|
platform/workloads/policy-nexus/forgejo-source-read:
|
|
description: Hold a dedicated Forgejo PAT with read:repository only and deliver it as the FORGEJO_SOURCE_TOKEN
|
|
secret to the policy-nexus Actions workflow.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Mint a replacement read:repository-only PAT, update OpenBao and the
|
|
Actions secret through attended custody, pass one candidate build, then revoke the predecessor.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0014-policy-nexus-forgejo-source-read.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0014-policy-nexus-forgejo-source-read.yaml
|
|
- ops-warden catalog policy-nexus-forgejo-source-read
|
|
used_by: Repository Actions secret FORGEJO_SOURCE_TOKEN on coulomb/policy-nexus. Delivery is attended
|
|
and must not expose the value in command output, process arguments, Git, State Hub, or workflow logs.
|
|
platform/workloads/railiance-clock/authority-signing:
|
|
description: Hold one ES256 authority private signing key in OpenBao and deliver it only to the private
|
|
railiance01 Railiance Clock service; no public listener or consumer-wide distribution.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Stop authority, perform separately versioned attended CAS rotation
|
|
and atomic host replacement, then admit new public key and epoch for consumers.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0028-railiance-clock-authority-signing.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0028-railiance-clock-authority-signing.yaml
|
|
used_by: /var/lib/railiance-clock/signing.pem
|
|
platform/workloads/railiance-telemetry/smtp:
|
|
description: Native password-reset notifier; password mounted read-only under /run/secrets/authelia-smtp/password.
|
|
missing: []
|
|
on_loss: 'Resettable by the founder in IONOS mail admin; write a new KV version keeping the other fields,
|
|
wait for ESO refresh. Cost: alert mail and Authelia reset emails fail until then; no data loss.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0035-authelia-platform-smtp.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0035-authelia-platform-smtp.yaml
|
|
- railiance-platform reply 3e490cd4 (2026-10-09)
|
|
used_by: railiance-telemetry alert mail (ESO telemetry-smtp-eso -> Secret telemetry/telemetry-alert-smtp,
|
|
SMTP_PASSWORD only) and the Authelia password-reset notifier (CCR-2026-0035, /run/secrets/authelia-smtp/password).
|
|
Mailbox platform@coulomb.social at IONOS.
|
|
platform/workloads/railiance/backup/object-storage:
|
|
description: Object-store credentials for Railiance backup destinations.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Overlap-first. Put a new key in OpenBao, wait for ESO refresh, revoke
|
|
the old Scaleway key.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0012-backup-object-storage.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0012-backup-object-storage.yaml
|
|
used_by: 'ClusterSecretStore openbao-backup-object-storage (first namespace condition: databases) →
|
|
ExternalSecret databases/platform-pg-backup-s3 → Secret platform-pg-backup-s3 (ACCESS_KEY_ID / ACCESS_SECRET_KEY
|
|
projected from ACCESS_KEY / SECRET_KEY). Drafts live under railiance-platform/argocd/platform-addons/openbao-secretstore/
|
|
and rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml. Do not apply until this CCR is approved
|
|
and the KV values are real.'
|
|
platform/workloads/railiance/backup/offsite-lane:
|
|
description: age-encrypted offsite backup upload through Nextcloud WebDAV file drop
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Mint a new Nextcloud upload token, update NC_WEBDAV_TOKEN in OpenBao,
|
|
and record non-secret rotation evidence.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0004-railiance-backup-offsite-lane.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0004-railiance-backup-offsite-lane.yaml
|
|
- ops-warden catalog railiance-backup-offsite-lane
|
|
used_by: railiance-platform lib/railiance-backup-common.sh and forgejo-backup via RAILIANCE_BACKUP_NC_TOKEN
|
|
env (fetched through OpenBao or warden access)
|
|
platform/workloads/railiance/scaleway/bootstrap:
|
|
description: Create reef-storage object-store members; not the Barman runtime key
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Put a new bootstrap key; do not reuse the scoped backup key.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0011-scaleway-object-storage-bootstrap.yaml
|
|
- ops-warden catalog scaleway-bootstrap
|
|
used_by: reef-storage/tools/create-platform-audit-bucket.sh (reads, never prints)
|
|
platform/workloads/rapp-qonto/keycape-client:
|
|
description: rapp-qonto KeyCape workload client
|
|
missing: []
|
|
on_loss: 'rotate by key-cape: Generate a fresh newline-free secret through an approved execution transport;
|
|
never print it. NOT automatable — no admitted execution and rollback contract (see delegation.blocked_on).'
|
|
owner: key-cape
|
|
review: accepted
|
|
rotation: ops-warden/wiki/CredentialRouting.md#routing-catalog-index
|
|
sources:
|
|
- ops-warden catalog rapp-qonto-keycape-client
|
|
- key-cape reply 40395cc2 (2026-10-10)
|
|
used_by: (1) KeyCape via ESO -> Secret sso/keycape-rapp-qonto-client key client-secret, to verify client_credentials
|
|
for rapp-qonto-client. (2) The rapp-qonto runtime, presenting it to keycape service-token; its delivery
|
|
transport is for railiance-apps/rapp-qonto to name.
|
|
platform/workloads/reuse/reuse-surface/runtime-secrets:
|
|
description: reuse-surface federation hub runtime secrets through OpenBao workload KV and External Secrets
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Replace field values directly in OpenBao, wait for ESO refresh, rollout
|
|
reuse-surface, then run make reuse-forgejo-webhook when rotating the webhook HMAC.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml
|
|
- ops-warden catalog reuse-surface-hub-write-token
|
|
- ops-mason plan reuse-surface-hub-writer (MASON-WP-0011)
|
|
- CCR-2026-0044-reuse-surface-hub-writer-caller.yaml (proposed; role not applied)
|
|
used_by: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env; ClusterSecretStore
|
|
openbao-reuse uses private railiance01 OpenBao and exact reuse/reuse-surface-eso Kubernetes identity.
|
|
Caller-facing OIDC policy workload-kv-read-reuse-surface-runtime remains separately retained.
|
|
The dedicated caller is OIDC role reuse-surface-hub-writer-workload-kv-read, not the platform-admin entity.
|
|
platform/workloads/secrets-engine/approval-client:
|
|
description: Hold the secrets-engine-approval confidential client secret in platform custody and project
|
|
it into the KeyCape runtime so KeyCape can verify presented client_credentials without the value living
|
|
in Git, a chart value, or a hand-created Kubernetes Secret.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: KeyCape mints a replacement client secret; platform writes the new
|
|
KV version under the same attended authority; ESO refresh delivers it and KeyCape restarts or re-reads.
|
|
Rotation is independent of the operator client.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0017-keycape-secrets-engine-approval-client.yaml#lifecycle.rotate;
|
|
railiance-platform/credential-change-requests/CCR-2026-0019-secrets-engine-approval-client-read.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0017-keycape-secrets-engine-approval-client.yaml
|
|
- CCR-2026-0019-secrets-engine-approval-client-read.yaml
|
|
used_by: 'ClusterSecretStore openbao-keycape-secrets-engine-approval, limited to namespace sso, to ExternalSecret
|
|
sso/keycape-secrets-engine-approval-client and Secret sso/keycape-secrets-engine-approval-client with
|
|
key client-secret. KeyCape resolves it as KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET through a
|
|
secretKeyRef, matching the live KEYCAPE_RAPP_QONTO_CLIENT_SECRET shape observed on image main-153258b.
|
|
Manifests: argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstor'
|
|
platform/workloads/secrets-engine/approval-requester:
|
|
description: T03 create-only requester KeyCape verifier custody; execute only the three fixed T03 request
|
|
records.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Rotate through KeyCape and platform using a new version with predecessor
|
|
refusal proof.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0024-t03-requester-verifier.yaml#lifecycle.rotate;
|
|
railiance-platform/credential-change-requests/CCR-2026-0025-t03-requester-reader.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0024-t03-requester-verifier.yaml
|
|
- CCR-2026-0025-t03-requester-reader.yaml
|
|
used_by: sso/keycape-secrets-engine-requester-client via ESO; env KEYCAPE_SECRETS_ENGINE_REQUESTER_CLIENT_SECRET
|
|
platform/workloads/state-hub/repository-rename-preflight:
|
|
description: Deliver one HMAC signing key to the transitional State Hub API; no rename execution, general
|
|
credential vending, or second identity authority.
|
|
missing: []
|
|
on_loss: 'Re-issue per rotation: Stop every API replica and verify no matching pods before CAS rotation;
|
|
wait ESO, recreate API replicas with one version, verify old token invalidation and health.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: railiance-platform/credential-change-requests/CCR-2026-0015-state-hub-preflight-signing.yaml#lifecycle.rotate
|
|
sources:
|
|
- CCR-2026-0015-state-hub-preflight-signing.yaml
|
|
used_by: Namespace SecretStore openbao-state-hub-rename-preflight -> ExternalSecret/Secret state-hub-rename-preflight;
|
|
required explicit API-only secretKeyRef. Owner creation, Retain deletion policy.
|
|
platform/workloads/telemetry/grafana-admin:
|
|
description: Grafana native administrator for rapp-telemetry on railiance01 (ADMIN_USERNAME, ADMIN_PASSWORD),
|
|
the attended bootstrap credential.
|
|
missing: []
|
|
on_loss: 'Resettable by a cluster operator with Grafana''s admin reset in the pod, then a new KV version
|
|
(not yet exercised). Cost: short loss of admin access; dashboards and data unaffected.'
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: 'railiance-platform/docs/credential-lane-designs/telemetry-grafana.md (attended: change the
|
|
Grafana DB admin password and OpenBao together, then test old fails and new works)'
|
|
sources:
|
|
- railiance-platform reply 3e490cd4 (2026-10-09)
|
|
used_by: Grafana in namespace telemetry via ExternalSecret telemetry-grafana-admin (ESO SA/role telemetry-grafana-eso,
|
|
policy telemetry-grafana-admin-eso), plus the attended check scripts/telemetry_grafana_access.py.
|
|
platform/workloads/tenant-engine/audit-core-sender:
|
|
description: tenant-engine's audit-core sender token, a copy of its entry in the audit-core sender registry.
|
|
Not the registry itself.
|
|
missing: []
|
|
on_loss: Reseed from platform/workloads/audit-core/senders with the seed helper (founder, attended).
|
|
audit-core re-mints if the registry entry is also gone; emission waits in tenant-engine's local outbox
|
|
meanwhile.
|
|
owner: railiance-platform
|
|
review: accepted
|
|
rotation: ops-mason/plans/tenant-engine-audit-core-sender-projection.md; reseed with railiance-platform/scripts/tenant_engine_audit_core_sender_seed.py
|
|
sources:
|
|
- ops-mason plan (hand-filled 2026-10-09)
|
|
used_by: ESO ClusterSecretStore openbao-tenant-engine-audit-core-sender (k8s role tenant-engine-audit-core-sender-eso)
|
|
-> Secret tenant-engine/tenant-engine-audit-core-sender key token
|
|
platform/workloads/user-engine/runtime:
|
|
description: 'user-engine runtime secrets: the portal edge marker and the identity-provisioner service
|
|
token. Not a user credential.'
|
|
missing:
|
|
- on_loss
|
|
on_loss: ''
|
|
owner: railiance-platform
|
|
review: draft
|
|
rotation: 'ops-mason/plans/user-engine-openbao-runtime-custody.md (rows 8-9: ExternalSecret is the sole
|
|
writer and rotation path)'
|
|
sources:
|
|
- ops-mason plan (hand-filled 2026-10-09)
|
|
used_by: user-engine and identity-provisioner via External Secrets Operator
|