coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add email-connect transactional SMTP and ingest custody lane.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
CCR-2026-0010, OpenBao read policies, ClusterSecretStore openbao-email-connect,
and workload-kv lane documentation for EMAIL-WP-0004-T03.
This commit is contained in:
codex 2026-08-12 13:32:11 +02:00
parent b6ad81fe6b
commit c642367d98
5 changed files with 241 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
openbao/policies/external-secrets-email-connect.hcl Normal file
View file

@ -0,0 +1,13 @@
# Least-privilege policy for the External Secrets Operator email-connect lane.
#
# The matching Kubernetes auth role binds only the ESO service account in the
# external-secrets namespace. ClusterSecretStore usage is separately limited to
# the email-connect namespace.
path "platform/data/workloads/email-connect/transactional" {
capabilities = ["read"]
}
path "platform/metadata/workloads/email-connect/transactional" {
capabilities = ["read"]
}

10
openbao/policies/workload-kv-read-email-connect-transactional.hcl Normal file
View file

@ -0,0 +1,10 @@
# Operator / OIDC read lane for email-connect transactional SMTP + ingest token.
# ESO delivery uses the sibling external-secrets-email-connect policy.
path "platform/data/workloads/email-connect/transactional" {
capabilities = ["read"]
}
path "platform/metadata/workloads/email-connect/transactional" {
capabilities = ["read"]
}