coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Activate reuse-surface runtime secrets OpenBao lane (CCR-2026-0005)
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Approve CCR-2026-0005, apply delegated OpenBao metadata, seed the KV path,
verify ExternalSecret delivery on Railiance01, and complete RAILIANCE-WP-0011-T02.
This commit is contained in:
tegwick 2026-07-07 22:34:34 +02:00
parent 8e8300e099
commit d64fa814b1
4 changed files with 101 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md
View file

@ -84,7 +84,7 @@ T02 blocked on platform-operator and reuse-surface-owner approval.
```task
id: RAILIANCE-WP-0011-T02
status: todo
status: done
priority: medium
state_hub_task_id: "69cf1728-8034-4309-b8ad-eb14184af6b6"
```
@ -97,6 +97,12 @@ Blocked on CCR-2026-0005 approval.
- Verify ExternalSecret `SecretSynced` and pod env injection after rollout
- Record non-secret audit evidence (positive + negative reads)
**2026-07-07:** CCR-2026-0005 approved; delegated metadata apply recorded; KV path
seeded (version 1); `openbao-reuse` ClusterSecretStore + `reuse-surface-runtime`
ExternalSecret live on Railiance01 (`SecretSynced` 2026-07-07T20:33:17Z). Positive:
`/v1/federated` 200, signed webhook 200. Negative: default-policy token denied on
path. CCR status `verified`. T03 catalog migration remains open.
## Consumer Handoff And Catalog Migration
```task