tegwick 98a2339b81

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 3s

Details

WARDEN-WP-0028: tenant secrets on mount tenants/ (first lane draft)

Adopt tenants/<tenant>/… custody (not platform/workloads). Document
onboarding, add draft binky-company-email-imap catalog entry, and mark
T01–T04/T06–T07 done. Founder Red provision remains T05.

2026-07-17 00:09:28 +02:00

2.9 KiB

Raw Blame History

Tenant secret onboarding

Date: 2026-07-17
Workplan: WARDEN-WP-0028

How to add a client/tenant commercial secret to NetKingdom OpenBao so ops-warden can route it and consumers can use it without pasting values into Git, State Hub, or chat.

Path convention

mount:  tenants                 # dedicated KV v2 mount (not platform/)
path:   tenants/<tenant>/<workload>/<bundle>

Segment	Meaning	Example
`tenant`	Stable client slug	`binky`
`workload`	Capability / system	`company-email`
`bundle`	One purpose / one CCR	`imap`

Do not put new client secrets under platform/workloads/… (fleet/platform services) or invent secret/prod/… as the production home.

First worked lane: tenants/binky/company-email/imap (CCR-2026-0007).

Ownership

Step	Owner
Business need, non-secret host facts, consumer config	Tenant control repo (e.g. `binky-control`)
CCR, policy HCL, OIDC role, mount hygiene	`railiance-platform`
Catalog front door + playbook + rotation guide	`ops-warden`
Value provision (Red)	Human founder/operator
Optional exec wrapper	`secrets-engine` (same path only)

Checklist

Slug + fields — pick tenant/workload/bundle and field names (no values).
CCR — railiance-platform/credential-change-requests/CCR-YYYY-NNNN-….yaml
- openbao.mount: tenants
- openbao.kv_path: tenants/<tenant>/<workload>/<bundle>
- policy_name starts with workload-kv-read-
- OIDC role ends with -workload-kv-read
- risk high for mailbox/admin/recovery-class secrets
Policy file — exact tenants/data/… + tenants/metadata/… read only.
Applier dry-run — scripts/credential-change.py applier-dry-run <CCR>
Approve + apply metadata — policy + OIDC role; no secret write in apply.
ops-warden catalog — draft entry with risk: high, rotation block, concrete fetch_command for primary field; playbook under wiki/playbooks/.
Founder provision — bao kv put tenants/… FIELD=@file (mode 0600 file) or secrets-engine provision; never chat/Git.
Verify capabilities-safe — bao token capabilities allow/deny; never kv get for deny tests (WP-0026).
Promote catalog draft → active when resolvable; update CCR readiness.
Agent boundary — add exact data deny + metadata read to agent-high-risk-boundary for high-risk lanes.

Worker fetch (after active)

bao login -method=oidc -path=netkingdom role=<lane>-workload-kv-read
warden access <catalog-id> --no-policy --out /tmp/secret.file   # mode 0600
# agents: never raw --fetch stream; WARDEN_AGENT_ID + risk=high → exit 7

2.9 KiB Raw Blame History