51 lines
1.7 KiB
YAML
51 lines
1.7 KiB
YAML
|
schema_version: 1
|
||
|
|
lane_id: informed-decision-sitting-requester-eso
|
||
|
|
ccr_id: CCR-2026-0032
|
||
|
|
title: Informed Decision create-only requester workload read
|
||
|
|
date: '2026-10-04'
|
||
|
|
consumer_repo: informed-decision
|
||
|
|
owner_repo: railiance-platform
|
||
|
|
requester:
|
||
|
|
agent: informed-decision
|
||
|
|
reason: INFD-WP-0005-T05 request cd811073; prepare workload delivery of existing requester custody
|
||
|
|
review_approvers:
|
||
|
|
- platform-owner
|
||
|
|
- informed-decision-owner
|
||
|
|
target:
|
||
|
|
domain: financials
|
||
|
|
tenant: platform
|
||
|
|
workload: informed-decision
|
||
|
|
environment: production
|
||
|
|
purpose: Deliver existing create-only requester client to the review pod through namespace-restricted ESO
|
||
|
|
openbao:
|
||
|
|
mount: platform
|
||
|
|
kv_path: platform/workloads/informed-decision/sitting-requester
|
||
|
|
fields:
|
||
|
|
- CLIENT_SECRET
|
||
|
|
policy_name: workload-kv-read-informed-decision-sitting-requester-eso
|
||
|
|
auth:
|
||
|
|
mount: kubernetes
|
||
|
|
role: informed-decision-sitting-requester-eso
|
||
|
|
audience: openbao
|
||
|
|
service_account_names:
|
||
|
|
- informed-decision-eso
|
||
|
|
service_account_namespaces:
|
||
|
|
- informed-decision
|
||
|
|
ttl: 15m
|
||
|
|
eso:
|
||
|
|
store_name: openbao-informed-decision-sitting-requester
|
||
|
|
server: http://openbao.openbao.svc:8200
|
||
|
|
namespace: informed-decision
|
||
|
|
external_secret_name: informed-decision-sitting-requester
|
||
|
|
secret_name: informed-decision-sitting-requester
|
||
|
|
refresh_interval: 5m
|
||
|
|
data:
|
||
|
|
- secret_key: client-secret
|
||
|
|
property: CLIENT_SECRET
|
||
|
|
risk:
|
||
|
|
classification: high
|
||
|
|
notes:
|
||
|
|
- The whole KV path is readable; the existing CLIENT_SECRET permits approval:create for subject informed-decision
|
||
|
|
- Any ExternalSecret in the informed-decision namespace can reference this store; no other namespace is admitted
|
||
|
|
- No approval:approve, approval:consume, sibling read, metadata listing or new client is granted
|