From 31a5de81d0aa3506d546cb40be90484ef4949b59 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 7 Jul 2026 22:38:45 +0200 Subject: [PATCH] Complete RAILIANCE-WP-0011-T03 catalog migration for CCR-2026-0005 Activate CCR front door, document reuse-surface lane in workload-kv-access-lanes, and mark consumer handoff task done. --- ...05-reuse-surface-runtime-secrets-lane.yaml | 14 ++++-- docs/workload-kv-access-lanes.md | 49 +++++++++++++++++++ ...se-surface-runtime-secrets-openbao-lane.md | 12 +++-- 3 files changed, 69 insertions(+), 6 deletions(-) diff --git a/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml b/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml index 22b54c9..3e1b806 100644 --- a/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml +++ b/credential-change-requests/CCR-2026-0005-reuse-surface-runtime-secrets-lane.yaml @@ -3,7 +3,7 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: reuse-surface runtime secrets lane -status: verified +status: active created: '2026-07-07' updated: '2026-07-07' requester: @@ -71,8 +71,9 @@ access_frontdoor: catalog_id: reuse-surface-hub-write-token selector: reuse-surface federation hub write bearer token command: warden access reuse-surface-hub-write-token --fetch REUSE_SURFACE_TOKEN - resolvable: false - readiness: pending-review + resolvable: true + readiness: ready + activation: verified-positive-and-negative-access-frontdoor-active-2026-07-07 delivery: surface: external-secrets target: ExternalSecret reuse/reuse-surface-runtime -> Secret reuse-surface-env in @@ -141,6 +142,13 @@ verification: details: - default-policy OpenBao token denied on platform/workloads/reuse/reuse-surface/runtime-secrets (HTTP permission denied) + - at: '2026-07-07T20:38:32+00:00' + actor: bernd.worsch + kind: frontdoor_activation + result: passed + details: + - ops-warden catalog reuse-surface-hub-write-token migrated to bao kv get handoff; + resolvable=true; playbook and workload-kv-access-lanes updated (RAILIANCE-WP-0011-T03) lifecycle: deactivate: Disable ops-warden catalog entry, remove ExternalSecret, and detach auth role policy; delete materialized reuse-surface-env only after confirming diff --git a/docs/workload-kv-access-lanes.md b/docs/workload-kv-access-lanes.md index b82251e..ad636de 100644 --- a/docs/workload-kv-access-lanes.md +++ b/docs/workload-kv-access-lanes.md @@ -229,6 +229,55 @@ Until positive and negative caller verification are complete, ops-warden should keep the catalog entry in `applied-pending-verify`/non-active state with `resolvable=false`. +## reuse-surface hub runtime secrets (`CCR-2026-0005`) + +Production federation hub at `https://reuse.coulomb.social`. Runtime secrets +are OpenBao-custodied and delivered to Railiance01 via External Secrets. + +| Item | Value | +| --- | --- | +| CCR | `CCR-2026-0005-reuse-surface-runtime-secrets-lane` | +| KV mount | `platform` | +| OpenBao CLI path | `platform/workloads/reuse/reuse-surface/runtime-secrets` | +| Fields | `REUSE_SURFACE_TOKEN`, `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` | +| Read policy | `workload-kv-read-reuse-surface-runtime` | +| Policy file | `openbao/policies/workload-kv-read-reuse-surface-runtime.hcl` | +| K8s auth role | `external-secrets-reuse-surface` (ESO delivery path) | +| Primary consumer | ExternalSecret `reuse/reuse-surface-runtime` → Secret `reuse-surface-env` (Railiance01, 1h refresh) | +| Interim ClusterSecretStore | `openbao-reuse` (token auth to `https://bao.coulomb.social`, namespace `reuse`) | +| ops-warden catalog | `reuse-surface-hub-write-token` | + +Fetch hub write token (do not log the value): + +```bash +export REUSE_SURFACE_TOKEN=$( + bao kv get -field=REUSE_SURFACE_TOKEN \ + platform/workloads/reuse/reuse-surface/runtime-secrets +) +``` + +Webhook HMAC (dual consumer — Forgejo org webhook must match): + +```bash +bao kv get -field=REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET \ + platform/workloads/reuse/reuse-surface/runtime-secrets +``` + +Or via ops-warden: + +```bash +warden access reuse-surface-hub-write-token --fetch REUSE_SURFACE_TOKEN +``` + +**Consumer facts the generated plan does not cover:** + +- `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` is consumed by both the hub pod and + the Forgejo org webhook. After rotation, run `railiance-apps` + `make reuse-forgejo-webhook` once ESO has refreshed. +- Break-glass cluster read remains available via + `kubectl ... get secret reuse-surface-env` when OpenBao is down; steady-state + custody is OpenBao + ESO only. + ## Railiance offsite backup lane (`CCR-2026-0004`) Workstation and platform backup tools (`railiance-backup`, `forgejo-backup`) upload diff --git a/workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md b/workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md index f154be4..b87fa05 100644 --- a/workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md +++ b/workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md @@ -107,7 +107,7 @@ path. CCR status `verified`. T03 catalog migration remains open. ```task id: RAILIANCE-WP-0011-T03 -status: wait +status: done priority: low state_hub_task_id: "52fc7baf-5257-44cd-ae2c-298ef7edbe96" ``` @@ -120,16 +120,22 @@ Blocked on T02 verification. - Add lane to `docs/workload-kv-access-lanes.md` - Deprecate direct kubectl fetch as primary handoff (keep as break-glass note) +**2026-07-07:** ops-warden catalog `reuse-surface-hub-write-token` migrated to +`bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets` +(owner `railiance-platform`, `resolvable=true`). Playbook, CredentialRouting index, +`docs/workload-kv-access-lanes.md`, and railiance-apps export handoff updated; kubectl +documented as break-glass only. CCR-2026-0005 front door `ready`/`resolvable=true`. + ## Forgejo Webhook Rotation Runbook ```task id: RAILIANCE-WP-0011-T04 -status: wait +status: todo priority: low state_hub_task_id: "eafc4011-69cf-473f-842c-c58d6a2bece7" ``` -Blocked on T02. +Blocked on T03. - Document rotation: update OpenBao field → ESO sync → rollout → `make reuse-forgejo-webhook` (updates org hook secret)