coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0007: binky IMAP on tenants/ mount + CCR allowlist
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Enable tenant commercial secrets: applier accepts mount tenants/, apply
policy and OIDC role for company-email IMAP (metadata only; values are
founder Red provision). Extend agent-high-risk-boundary for the path.
This commit is contained in:
tegwick 2026-07-17 00:09:28 +02:00
parent 347226eb36
commit 86209fa90c
6 changed files with 218 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/workload-kv-access-lanes.md
View file

@ -360,3 +360,39 @@ PAT mint: attended session as Forgejo user `tegwick` (site admin). Minimum scope
`read:package`, `write:package`, `read:repository`, `write:repository`, plus admin
scopes required by `forgejo-operator-bootstrap`. Downstream repos update `load_token()`
to read OpenBao when env is unset after lane verification.
## Tenant commercial secrets (mount `tenants/`) — WARDEN-WP-0028
Client/tenant secrets are **not** under `platform/workloads/`. They use a
dedicated KV v2 mount:
```text
tenants/<tenant_slug>/<workload>/<bundle>
```
CCR applier allowlist accepts `mount: tenants` and paths under `tenants/`
(in addition to `platform/workloads/` for fleet lanes).
### Binky company email IMAP (`CCR-2026-0007`)
| Item | Value |
| --- | --- |
| ops-warden catalog id | `binky-company-email-imap` |
| Tenant | `binky` |
| Mount | `tenants` |
| OpenBao CLI path | `tenants/binky/company-email/imap` |
| Fields | `IMAP_USERNAME`, `IMAP_PASSWORD` |
| Read policy | `workload-kv-read-binky-company-email-imap` |
| Policy file | `openbao/policies/workload-kv-read-binky-company-email-imap.hcl` |
| OIDC role | `binky-company-email-imap-workload-kv-read` |
| Front-door readiness | draft / applied-pending-provision (values: founder Red) |
| Risk | high |
```bash
bao login -method=oidc -path=netkingdom role=binky-company-email-imap-workload-kv-read
# after provision:
bao kv get -field=IMAP_PASSWORD tenants/binky/company-email/imap # interactive human only
warden access binky-company-email-imap --all --out /tmp/p # preferred
```
Onboarding playbook: `ops-warden/wiki/playbooks/tenant-secret-onboarding.md`.