coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete RAILIANCE-WP-0011-T03 catalog migration for CCR-2026-0005
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Activate CCR front door, document reuse-surface lane in workload-kv-access-lanes,
and mark consumer handoff task done.
This commit is contained in:
tegwick 2026-07-07 22:38:45 +02:00
parent 363f1fd2df
commit 31a5de81d0
3 changed files with 69 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

49
docs/workload-kv-access-lanes.md
View file

@ -229,6 +229,55 @@ Until positive and negative caller verification are complete, ops-warden should
keep the catalog entry in `applied-pending-verify`/non-active state with
`resolvable=false`.
## reuse-surface hub runtime secrets (`CCR-2026-0005`)
Production federation hub at `https://reuse.coulomb.social`. Runtime secrets
are OpenBao-custodied and delivered to Railiance01 via External Secrets.
| Item | Value |
| --- | --- |
| CCR | `CCR-2026-0005-reuse-surface-runtime-secrets-lane` |
| KV mount | `platform` |
| OpenBao CLI path | `platform/workloads/reuse/reuse-surface/runtime-secrets` |
| Fields | `REUSE_SURFACE_TOKEN`, `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` |
| Read policy | `workload-kv-read-reuse-surface-runtime` |
| Policy file | `openbao/policies/workload-kv-read-reuse-surface-runtime.hcl` |
| K8s auth role | `external-secrets-reuse-surface` (ESO delivery path) |
| Primary consumer | ExternalSecret `reuse/reuse-surface-runtime` → Secret `reuse-surface-env` (Railiance01, 1h refresh) |
| Interim ClusterSecretStore | `openbao-reuse` (token auth to `https://bao.coulomb.social`, namespace `reuse`) |
| ops-warden catalog | `reuse-surface-hub-write-token` |
Fetch hub write token (do not log the value):
```bash
export REUSE_SURFACE_TOKEN=$(
bao kv get -field=REUSE_SURFACE_TOKEN \
platform/workloads/reuse/reuse-surface/runtime-secrets
)
```
Webhook HMAC (dual consumer — Forgejo org webhook must match):
```bash
bao kv get -field=REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET \
platform/workloads/reuse/reuse-surface/runtime-secrets
```
Or via ops-warden:
```bash
warden access reuse-surface-hub-write-token --fetch REUSE_SURFACE_TOKEN
```
**Consumer facts the generated plan does not cover:**
- `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` is consumed by both the hub pod and
the Forgejo org webhook. After rotation, run `railiance-apps`
`make reuse-forgejo-webhook` once ESO has refreshed.
- Break-glass cluster read remains available via
`kubectl ... get secret reuse-surface-env` when OpenBao is down; steady-state
custody is OpenBao + ESO only.
## Railiance offsite backup lane (`CCR-2026-0004`)
Workstation and platform backup tools (`railiance-backup`, `forgejo-backup`) upload