Prepare bounded Kubernetes authentication recovery for three ESO lanes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

openbao/eso-auth-recovery/lanes.json

@@ -0,0 +1,29 @@
+[
+  {
+    "namespace": "forgejo",
+    "name": "forgejo-mailer",
+    "store": "openbao-forgejo",
+    "service_account": "forgejo-mailer-eso",
+    "kv_path": "platform/data/workloads/forgejo/forgejo-mailer",
+    "policy": "workload-kv-read-forgejo-mailer-eso",
+    "role": "forgejo-mailer-eso"
+  },
+  {
+    "namespace": "reuse",
+    "name": "reuse-surface-runtime",
+    "store": "openbao-reuse",
+    "service_account": "reuse-surface-eso",
+    "kv_path": "platform/data/workloads/reuse/reuse-surface/runtime-secrets",
+    "policy": "workload-kv-read-reuse-surface-runtime-eso",
+    "role": "reuse-surface-runtime-eso"
+  },
+  {
+    "namespace": "target-revenue",
+    "name": "target-revenue-runtime",
+    "store": "openbao-target-revenue",
+    "service_account": "target-revenue-eso",
+    "kv_path": "platform/data/workloads/target-revenue/runtime-secrets",
+    "policy": "workload-kv-read-target-revenue-runtime-eso",
+    "role": "target-revenue-runtime-eso"
+  }
+]

openbao/eso-auth-recovery/serviceaccounts.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: forgejo-mailer-eso
+  namespace: forgejo
+automountServiceAccountToken: false
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: reuse-surface-eso
+  namespace: reuse
+automountServiceAccountToken: false
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: target-revenue-eso
+  namespace: target-revenue
+automountServiceAccountToken: false

openbao/policies/workload-kv-read-forgejo-mailer-eso.hcl

@@ -0,0 +1,11 @@
+path "platform/data/workloads/forgejo/forgejo-mailer" {
+  capabilities = ["read"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}

openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl

@@ -0,0 +1,11 @@
+path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
+  capabilities = ["read"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}

openbao/policies/workload-kv-read-target-revenue-runtime-eso.hcl

@@ -0,0 +1,11 @@
+path "platform/data/workloads/target-revenue/runtime-secrets" {
+  capabilities = ["read"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}