From 944b30ad63ab054cc24617e374e177d34cd572da Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 12:12:52 +0200 Subject: [PATCH] RAPPS-WP-0016: correct T02 role/policy naming, point T05 at 1.3 review T02 named the OpenBao policy as the role; the Kubernetes-auth role is external-secrets-keycape-forgejo-forgejo, carrying only policy workload-kv-read-keycape-forgejo-forgejo. T05's blocking reason now points at the Apps 1.3 owner-review record instead of the settled 1.2 option decision. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1045697@bnt-lap001 Assistant-Session: f16df812-4a57-4823-a2da-73c69e3bb4d1 --- workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md b/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md index 4640b64..a1615e3 100644 --- a/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md +++ b/workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md @@ -81,9 +81,10 @@ state_hub_task_id: "13cd3aec-c87d-5d3f-a421-39d8ff131edd" - an ExternalSecret delivering the `forgejo` client secret from OpenBao to a Secret in the `forgejo` namespace. Custody path is - `platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read through role - `workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0; replaces the - earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The + `platform/workloads/keycape/forgejo`, field `CLIENT_SECRET`, read by ESO through + Kubernetes-auth role `external-secrets-keycape-forgejo-forgejo`, which carries + only policy `workload-kv-read-keycape-forgejo-forgejo` (net-kingdom 074b3a0; + replaces the earlier `platform/workloads/forgejo/netkingdom-oidc-client` proposal). The SA/SecretStore/ExternalSecret shape follows the NK-WP-0048 `deliver-consumer-secret` receipt contract (`docs/evidence/nk48-t16-owner-review/owner-review-railiance-apps.json`) @@ -145,7 +146,7 @@ step, taken separately. id: RAPPS-WP-0016-T05 status: wait depends_on: [RAPPS-WP-0016-T02] -blocking_reason: "Waits for the NK-WP-0048-T16 option decision and net-kingdom's answer to the Apps needs-change record." +blocking_reason: "Waits for net-kingdom's answer to the Apps 1.3 needs-change record (the-custodian docs/changes/netkingdom-target-2026-10-17/nk48-1.3-owner-review/owner-review-railiance-apps.json: RAPPS-1.3-C1..C3) and the re-frozen 1.3 candidate." priority: medium state_hub_task_id: "728786c9-f1f9-5983-a6a4-dea21faf67f5" ```