coulomb/railiance-apps
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RAPPS-WP-0016: correct T02 role/policy naming, point T05 at 1.3 review
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
T02 named the OpenBao policy as the role; the Kubernetes-auth role is
external-secrets-keycape-forgejo-forgejo, carrying only policy
workload-kv-read-keycape-forgejo-forgejo. T05's blocking reason now
points at the Apps 1.3 owner-review record instead of the settled 1.2
option decision.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1045697@bnt-lap001
Assistant-Session: f16df812-4a57-4823-a2da-73c69e3bb4d1
This commit is contained in:
tegwick 2026-10-17 12:12:52 +02:00
parent 0da83472c4
commit 944b30ad63
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
View file

@ -81,9 +81,10 @@ state_hub_task_id: "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
- an ExternalSecret delivering the `forgejo` client secret from OpenBao to a
Secret in the `forgejo` namespace. Custody path is
`platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read through role
`workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0; replaces the
earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The
`platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read by ESO through
Kubernetes-auth role `external-secrets-keycape-forgejo-forgejo`, which carries
only policy `workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0;
replaces the earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The
SA/SecretStore/ExternalSecret shape follows the NK-WP-0048
`deliver-consumer-secret` receipt contract
(`docs/evidence/nk48-t16-owner-review/owner-review-railiance-apps.json`)
@ -145,7 +146,7 @@ step, taken separately.
id: RAPPS-WP-0016-T05
status: wait
depends_on: [RAPPS-WP-0016-T02]
blocking_reason: "Waits for the NK-WP-0048-T16 option decision and net-kingdom's answer to the Apps needs-change record."
blocking_reason: "Waits for net-kingdom's answer to the Apps 1.3 needs-change record (the-custodian docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json: RAPPS-1.3-C1..C3) and the re-frozen 1.3 candidate."
priority: medium
state_hub_task_id: "728786c9-f1f9-5983-a6a4-dea21faf67f5"
```