coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0029/0030: activity-core ops_run worker token paths (proposed)

Browse source 
ACTIVITY-WP-0039-T02. Add read on the two exact worker-token paths to
workload-kv-read-activity-core-eso, one CCR per worker identity. Adds
scripts/openbao-policy-sync.sh, a silent attended policy writer that refuses
undeclared live drift and verifies on readback. Not applied; CCRs await
platform-operator and activity-core-owner approval.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex 2026-09-23 20:00:40 +02:00
parent 915a3cacd9
commit 15184aaa01
8 changed files with 413 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
openbao/policies/workload-kv-read-activity-core-eso.hcl
View file

@ -1,7 +1,7 @@
# RPF-WP-0045: ESO delivery for ClusterSecretStore openbao-activity-core via
# Kubernetes auth role activity-core-eso (SA activity-core/activity-core-eso).
# Exactly the four KV paths the four activity-core ExternalSecrets read; data
# read only, no metadata/list/write. ESO also needs lookup-self and revoke-self.
# Exactly the KV paths the activity-core ExternalSecrets read; data read only,
# no metadata/list/write. ESO also needs lookup-self and revoke-self.
path "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" {
capabilities = ["read"]
@ -19,6 +19,16 @@ path "platform/data/workloads/railiance/backup/offsite-lane" {
capabilities = ["read"]
}
# CCR-2026-0029 and CCR-2026-0030 / ACTIVITY-WP-0039-T02: ops_run queue worker tokens, one path
# per worker identity, read by ExternalSecret actcore-ops-run-worker-tokens.
path "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-railiance01" {
capabilities = ["read"]
}
path "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01" {
capabilities = ["read"]
}
path "auth/token/lookup-self" {
capabilities = ["read"]
}