coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document recovered ESO lanes and recognize explicit invalid-token responses
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 18:51:40 +02:00
parent 153223983f
commit 3759850cc4
6 changed files with 78 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/workload-kv-access-lanes.md
View file

@ -242,11 +242,16 @@ are OpenBao-custodied and delivered to Railiance01 via External Secrets.
| Fields | `REUSE_SURFACE_TOKEN`, `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` |
| Read policy | `workload-kv-read-reuse-surface-runtime` |
| Policy file | `openbao/policies/workload-kv-read-reuse-surface-runtime.hcl` |
| K8s auth role | `external-secrets-reuse-surface` (ESO delivery path) |
| K8s auth role | `reuse-surface-runtime-eso`, SA `reuse/reuse-surface-eso`, audience `openbao` |
| Primary consumer | ExternalSecret `reuse/reuse-surface-runtime` → Secret `reuse-surface-env` (Railiance01, 1h refresh) |
| Interim ClusterSecretStore | `openbao-reuse` (token auth to `https://bao.coulomb.social`, namespace `reuse`) |
| ClusterSecretStore | `openbao-reuse` (Kubernetes auth to private railiance01 OpenBao, namespace `reuse`) |
| ops-warden catalog | `reuse-surface-hub-write-token` |
RPF-WP-0037 replaced static ESO authentication without rotating workload values.
ESO uses the separate `workload-kv-read-reuse-surface-runtime-eso` policy: exact
data read and self-token lifecycle only. The caller-facing policy/catalog above
remains separate. See `docs/eso-auth-recovery.md`.
Fetch hub write token (do not log the value):
```bash