coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0045: plan Kubernetes-auth migration for openbao-activity-core and openbao-email-connect
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details

Browse source 
Declares target store specs, two exact-path policies and two ESO
ServiceAccounts. Nothing applied; live steps wait on the founder.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
codex 2026-09-21 19:18:59 +02:00
parent 2d79c2e4e5
commit 6e399bbe64
6 changed files with 347 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

15
openbao/policies/workload-kv-read-email-connect-transactional-eso.hcl Normal file
View file

@ -0,0 +1,15 @@
# RPF-WP-0045: ESO delivery for ClusterSecretStore openbao-email-connect via
# Kubernetes auth role email-connect-transactional-eso
# (SA email-connect/email-connect-eso). One exact KV data read.
path "platform/data/workloads/email-connect/transactional" {
capabilities = ["read"]
}
path "auth/token/lookup-self" {
capabilities = ["read"]
}
path "auth/token/revoke-self" {
capabilities = ["update"]
}