119 lines
5.4 KiB
YAML
119 lines
5.4 KiB
YAML
|
id: CCR-2026-0005
|
||
|
|
kind: credential-change-request
|
||
|
|
schema_version: 1
|
||
|
|
request_type: workload-kv-read
|
||
|
|
title: reuse-surface runtime secrets lane
|
||
|
|
status: proposed
|
||
|
|
created: '2026-07-07'
|
||
|
|
updated: '2026-07-07'
|
||
|
|
requester:
|
||
|
|
agent: grok
|
||
|
|
reason: Promote reuse-surface hub runtime secrets from bootstrap Kubernetes Secret
|
||
|
|
custody to OpenBao workload KV per RAILIANCE-WP-0011-T01.
|
||
|
|
review:
|
||
|
|
required: true
|
||
|
|
required_approvers:
|
||
|
|
- platform-operator
|
||
|
|
- reuse-surface-owner
|
||
|
|
comments:
|
||
|
|
- at: '2026-07-07T20:15:00+00:00'
|
||
|
|
reviewer: codex
|
||
|
|
decision: metadata_review_binding_confirmed_pending_owner_approval
|
||
|
|
comment: 'Live Railiance01 metadata on 2026-07-07 confirms namespace reuse exists;
|
||
|
|
Deployment reuse-surface consumes envFrom secretRef reuse-surface-env (default
|
||
|
|
service account). Secret reuse-surface-env holds REUSE_SURFACE_TOKEN and
|
||
|
|
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET. External Secrets operator service account
|
||
|
|
external-secrets/external-secrets exists. No ExternalSecret in reuse yet;
|
||
|
|
ClusterSecretStore openbao-forgejo is the interim reference pattern on this
|
||
|
|
cluster (token auth to https://bao.coulomb.social). Proposed Railiance01
|
||
|
|
interim delivery mirrors forgejo-mailer: periodic OpenBao token with policy
|
||
|
|
workload-kv-read-reuse-surface-runtime stored in
|
||
|
|
external-secrets/openbao-reuse-eso-token, ClusterSecretStore openbao-reuse
|
||
|
|
namespace-limited to reuse, ExternalSecret reuse/reuse-surface-runtime targeting
|
||
|
|
Secret reuse-surface-env. Forgejo org webhook id=1 on coulomb is live and must
|
||
|
|
stay aligned with REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET on rotation. Keep CCR
|
||
|
|
status proposed until platform-operator and reuse-surface-owner approval.'
|
||
|
|
target:
|
||
|
|
domain: financials
|
||
|
|
tenant: reuse
|
||
|
|
workload: reuse-surface
|
||
|
|
environment: production
|
||
|
|
purpose: reuse-surface federation hub runtime secrets through OpenBao workload KV
|
||
|
|
and External Secrets
|
||
|
|
openbao:
|
||
|
|
mount: platform
|
||
|
|
kv_path: platform/workloads/reuse/reuse-surface/runtime-secrets
|
||
|
|
fields:
|
||
|
|
- REUSE_SURFACE_TOKEN
|
||
|
|
- REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
||
|
|
policy_name: workload-kv-read-reuse-surface-runtime
|
||
|
|
policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
|
||
|
|
auth:
|
||
|
|
method: kubernetes
|
||
|
|
mount: kubernetes
|
||
|
|
role: external-secrets-reuse-surface
|
||
|
|
bound_claims:
|
||
|
|
service_account_names:
|
||
|
|
- external-secrets
|
||
|
|
service_account_namespaces:
|
||
|
|
- external-secrets
|
||
|
|
bound_claims_confirmed: true
|
||
|
|
policies:
|
||
|
|
- workload-kv-read-reuse-surface-runtime
|
||
|
|
ttl: 15m
|
||
|
|
access_frontdoor:
|
||
|
|
type: ops-warden
|
||
|
|
catalog_id: reuse-surface-hub-write-token
|
||
|
|
selector: reuse-surface federation hub write bearer token
|
||
|
|
command: warden access reuse-surface-hub-write-token --fetch REUSE_SURFACE_TOKEN
|
||
|
|
resolvable: false
|
||
|
|
readiness: pending-review
|
||
|
|
delivery:
|
||
|
|
surface: external-secrets
|
||
|
|
target: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env in
|
||
|
|
the reuse namespace on Railiance01; interim ClusterSecretStore openbao-reuse
|
||
|
|
(token auth to coulombcore OpenBao, namespace-limited to reuse) until
|
||
|
|
railiance01-local OpenBao Wave 7 bootstrap
|
||
|
|
risk:
|
||
|
|
classification: high
|
||
|
|
notes:
|
||
|
|
- REUSE_SURFACE_TOKEN grants authenticated writes to the production federation hub
|
||
|
|
at https://reuse.coulomb.social.
|
||
|
|
- REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET is a dual-consumer HMAC — the hub pod and
|
||
|
|
the Forgejo org webhook must share the same value; rotation requires
|
||
|
|
railiance-apps make reuse-forgejo-webhook after ESO sync.
|
||
|
|
- Railiance01 interim delivery uses a policy-limited periodic OpenBao token in
|
||
|
|
external-secrets/openbao-reuse-eso-token, mirroring the forgejo-mailer lane —
|
||
|
|
not the kubernetes auth role until coulombcore kubernetes auth covers this
|
||
|
|
cluster or railiance01 OpenBao is bootstrapped.
|
||
|
|
- ops-warden must proxy reads as the caller and must not retain token values.
|
||
|
|
verification:
|
||
|
|
positive:
|
||
|
|
- ExternalSecret reuse/reuse-surface-runtime is Ready=True and syncs both fields
|
||
|
|
to Secret reuse-surface-env without printing values.
|
||
|
|
- reuse-surface Deployment rolls cleanly and hub write plus signed webhook POST
|
||
|
|
succeed after migration.
|
||
|
|
negative:
|
||
|
|
- A namespace outside the approved ClusterSecretStore condition cannot use
|
||
|
|
openbao-reuse to read the path.
|
||
|
|
- A periodic token without workload-kv-read-reuse-surface-runtime cannot read
|
||
|
|
the KV path.
|
||
|
|
activation_conditions:
|
||
|
|
- Policy applied on coulombcore OpenBao with platform-admin/operator authority.
|
||
|
|
- Secret values seeded from the existing reuse-surface-env cluster Secret through
|
||
|
|
approved operator custody (values never logged).
|
||
|
|
- Railiance01 ClusterSecretStore openbao-reuse and ExternalSecret deployed.
|
||
|
|
- Positive and negative verification recorded with non-secret audit ids or
|
||
|
|
timestamps.
|
||
|
|
- ops-warden catalog handoff migrated from kubectl to bao kv get (RAILIANCE-WP-0011-T03).
|
||
|
|
lifecycle:
|
||
|
|
deactivate: Disable ops-warden catalog entry, remove ExternalSecret, and detach
|
||
|
|
auth role policy; delete materialized reuse-surface-env only after confirming
|
||
|
|
workload decommission or break-glass fallback.
|
||
|
|
rotate: Replace field values directly in OpenBao, wait for ESO refresh, rollout
|
||
|
|
reuse-surface, then run make reuse-forgejo-webhook when rotating the webhook HMAC.
|
||
|
|
compromised: Immediately deactivate access front door, rotate both fields, re-sync
|
||
|
|
Forgejo org webhook, record blast-radius notes, and open incident follow-up tasks.
|
||
|
|
state_hub:
|
||
|
|
workplan_id: RAILIANCE-WP-0011
|
||
|
|
task_id: RAILIANCE-WP-0011-T01
|