coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Establish scoped KeyCape factor custody and verified automatic renewal
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
KeyCape factor custody acceptance / acceptance (push) Successful in 7s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
codex 2026-09-13 16:25:33 +02:00
parent b75729b799
commit 2e2c31d237
22 changed files with 1169 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
openbao/policies/keycape-factor-renewer.hcl Normal file
View file

@ -0,0 +1,11 @@
# Dedicated renewable service password read and JWT-only publish.
path "platform/data/workloads/net-kingdom/keycape-factor-issuer" {
capabilities = ["read"]
}
path "platform/data/workloads/net-kingdom/keycape-factor-read" {
capabilities = ["read", "create", "update"]
}
path "auth/token/revoke-self" {
capabilities = ["update"]
}

16
openbao/policies/workload-kv-read-keycape-factor-read.hcl Normal file
View file

@ -0,0 +1,16 @@
# Exact-path JWT delivery; no issuer password or sibling paths.
path "platform/data/workloads/net-kingdom/keycape-factor-read" {
capabilities = ["read"]
}
path "platform/metadata/workloads/net-kingdom/keycape-factor-read" {
capabilities = ["read"]
}
# ESO validates its own short-lived workload session.
path "auth/token/lookup-self" {
capabilities = ["read"]
}
path "auth/token/revoke-self" {
capabilities = ["update"]
}