From bb7cfcb184547489805250e3686a7579dad308e1 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 21 Aug 2026 17:30:44 +0200 Subject: [PATCH] feat: add hub-core database lease projections --- WORK-RECORDS.md | 4 ++ .../core-hub.externalsecrets.yaml | 36 +++++++++++++ .../external-secrets-core-hub-database.hcl | 8 +++ tests/test_credential_change.py | 20 +++++++ ...023-hub-core-candidate-credential-lanes.md | 53 +++++++++++++++++++ 5 files changed, 121 insertions(+) create mode 100644 workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 0ad1500..c4d91dc 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -21,6 +21,7 @@ | workplan | RAILIANCE-WP-0016 | finished | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md | | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md | | workplan | RAILIANCE-WP-0022 | blocked | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md | +| workplan | RAILIANCE-WP-0023 | active | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md | @@ -91,6 +92,9 @@ | task | RAILIANCE-WP-0022-T03 | done | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md | | task | RAILIANCE-WP-0022-T04 | done | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md | | task | RAILIANCE-WP-0022-T05 | wait | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md | +| task | RAILIANCE-WP-0023-T01 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | +| task | RAILIANCE-WP-0023-T02 | progress | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | +| task | RAILIANCE-WP-0023-T03 | wait | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md | | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | | task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | diff --git a/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml b/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml index 4dfb562..4511bdb 100644 --- a/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml +++ b/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml @@ -58,3 +58,39 @@ spec: dataFrom: - extract: key: creds/core-hub-migration +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: hub-core-runtime-database + namespace: core-hub +spec: + refreshInterval: 5m + secretStoreRef: + kind: ClusterSecretStore + name: openbao-core-hub-database + target: + name: hub-core-runtime-database + creationPolicy: Owner + deletionPolicy: Retain + dataFrom: + - extract: + key: creds/hub-core-runtime +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: hub-core-migration-database + namespace: core-hub +spec: + refreshInterval: 5m + secretStoreRef: + kind: ClusterSecretStore + name: openbao-core-hub-database + target: + name: hub-core-migration-database + creationPolicy: Owner + deletionPolicy: Retain + dataFrom: + - extract: + key: creds/hub-core-migration diff --git a/openbao/policies/external-secrets-core-hub-database.hcl b/openbao/policies/external-secrets-core-hub-database.hcl index 981962d..8817ed0 100644 --- a/openbao/policies/external-secrets-core-hub-database.hcl +++ b/openbao/policies/external-secrets-core-hub-database.hcl @@ -9,3 +9,11 @@ path "database/creds/core-hub-runtime" { path "database/creds/core-hub-migration" { capabilities = ["read"] } + +path "database/creds/hub-core-runtime" { + capabilities = ["read"] +} + +path "database/creds/hub-core-migration" { + capabilities = ["read"] +} diff --git a/tests/test_credential_change.py b/tests/test_credential_change.py index c354e9d..96fd6aa 100644 --- a/tests/test_credential_change.py +++ b/tests/test_credential_change.py @@ -183,6 +183,8 @@ class CredentialChangeTests(unittest.TestCase): ).read_text() self.assertIn('path "database/creds/core-hub-runtime"', database_policy) self.assertIn('path "database/creds/core-hub-migration"', database_policy) + self.assertIn('path "database/creds/hub-core-runtime"', database_policy) + self.assertIn('path "database/creds/hub-core-migration"', database_policy) self.assertNotIn("platform/data/", database_policy) database_store = credential_change.load_yaml( @@ -204,6 +206,8 @@ class CredentialChangeTests(unittest.TestCase): "core-hub-api-token", "core-hub-runtime-database", "core-hub-migration-database", + "hub-core-runtime-database", + "hub-core-migration-database", }, ) for item in external_secrets: @@ -219,6 +223,22 @@ class CredentialChangeTests(unittest.TestCase): ) self.assertEqual(runtime["spec"]["dataFrom"][0]["extract"]["key"], "creds/core-hub-runtime") self.assertEqual(migration["spec"]["dataFrom"][0]["extract"]["key"], "creds/core-hub-migration") + hub_runtime = next( + item for item in external_secrets + if item["metadata"]["name"] == "hub-core-runtime-database" + ) + hub_migration = next( + item for item in external_secrets + if item["metadata"]["name"] == "hub-core-migration-database" + ) + self.assertEqual( + hub_runtime["spec"]["dataFrom"][0]["extract"]["key"], + "creds/hub-core-runtime", + ) + self.assertEqual( + hub_migration["spec"]["dataFrom"][0]["extract"]["key"], + "creds/hub-core-migration", + ) def test_target_rapp_rejects_non_slug(self) -> None: path = self.unapproved_ccr() diff --git a/workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md b/workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md new file mode 100644 index 0000000..f81d3d4 --- /dev/null +++ b/workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md @@ -0,0 +1,53 @@ +--- +id: RAILIANCE-WP-0023 +type: workplan +title: "Hub-core candidate credential lanes" +domain: financials +repo: railiance-platform +status: active +owner: codex +topic_slug: railiance +created: "2026-08-21" +updated: "2026-08-21" +related: + - CORE-WP-0010 + - RAPPCOREHUB-WP-0002 + - RAPP-POSTGRES-WP-0004 +--- + +# Hub-core candidate credential lanes + +## Extend exact-scope policy and projections + +```task +id: RAILIANCE-WP-0023-T01 +status: done +priority: high +``` + +Add only `database/creds/hub-core-runtime` and +`database/creds/hub-core-migration` to the existing namespace-limited Core Hub +database store, with separate five-minute ExternalSecret projections. + +## Activate and verify production lanes + +```task +id: RAILIANCE-WP-0023-T02 +status: progress +priority: high +``` + +Apply the reviewed policy and projections after rapp-postgres creates the +roles. Verify store validity, SecretSynced status, role separation, and lease +rotation without reading or logging values. + +## Hand off the private candidate + +```task +id: RAILIANCE-WP-0023-T03 +status: wait +priority: high +``` + +Confirm both Secret metadata objects are ready, then hand the candidate +migration and rollout gate back to `RAPPCOREHUB-WP-0002-T03`.