coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document activity-core ESO read of forgejo-admin
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Extend external-secrets-activity-core policy notes with forgejo-admin
paths used by activity-core actcore-forgejo-admin ExternalSecret
(ACTIVITY-WP-0023-T05).
This commit is contained in:
tegwick 2026-07-21 23:19:10 +02:00
parent 1cbaac7a73
commit b11855f64c
2 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
openbao/policies/external-secrets-activity-core.hcl
View file

@ -3,6 +3,12 @@
# Covers: # Covers:
# - llm-connect provider secrets (OPENROUTER_API_KEY) # - llm-connect provider secrets (OPENROUTER_API_KEY)
# - shared issue-core ingestion key for activity-core IssueSink emission # - shared issue-core ingestion key for activity-core IssueSink emission
# - forgejo-admin PAT for weekly package prune (FORGEJO_TOKEN)
#
# Live ESO token on railiance01 currently attaches the finer-grained sibling
# policies (workload-kv-read-issue-core-runtime + workload-kv-read-forgejo-admin)
# via activity-core scripts/openbao-eso-token-apply.sh. This combined policy is
# the documented target set for the openbao-activity-core ClusterSecretStore.
path "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" { path "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" {
capabilities = ["read"] capabilities = ["read"]
@ -18,4 +24,12 @@ path "platform/data/workloads/issue-core/issue-core/issue-core-runtime" {
path "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" { path "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" {
capabilities = ["read"] capabilities = ["read"]
}
path "platform/data/workloads/forgejo/forgejo-admin" {
capabilities = ["read"]
}
path "platform/metadata/workloads/forgejo/forgejo-admin" {
capabilities = ["read"]
} }

6
openbao/policies/workload-kv-read-forgejo-admin.hcl
View file

@ -2,7 +2,11 @@
# #
# Grants read access to the site-admin PAT used by workstation and activity-core # Grants read access to the site-admin PAT used by workstation and activity-core
# automation (package prune, org webhooks, operator bootstrap). Sibling to # automation (package prune, org webhooks, operator bootstrap). Sibling to
# forgejo-mailer (SMTP); no cluster ESO delivery in phase 1. # forgejo-mailer (SMTP).
#
# Cluster delivery (ACTIVITY-WP-0023-T05): attached to the
# openbao-activity-core ESO token so ExternalSecret actcore-forgejo-admin can
# merge FORGEJO_TOKEN into actcore-runtime-secret.
path "platform/data/workloads/forgejo/forgejo-admin" { path "platform/data/workloads/forgejo/forgejo-admin" {
capabilities = ["read"] capabilities = ["read"]