id: CCR-2026-0035
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Authelia platform SMTP password projection
status: active
created: '2026-10-06'
updated: '2026-10-06'
requester:
  agent: codex
  reason: CSOC-WP-0010 / NK-WP-0047 restore user-requested password reset email; existing
    platform mailbox custody.
review:
  required: true
  required_approvers:
  - founder
  - railiance-platform-owner
  - net-kingdom-owner
  comments:
  - at: '2026-10-06T18:24:56.793292+00:00'
    reviewer: Bernd Worsch (founder)
    decision: approved
    comment: 'Explicit chat approval: I approve let''s wire this. Exact consumer admission
      and Authelia SMTP rollout approved; owner-attended execution still pending.'
target:
  domain: infotech
  tenant: platform
  workload: authelia
  environment: production
  purpose: Native password-reset notifier; password mounted read-only under /run/secrets/authelia-smtp/password.
openbao:
  mount: platform
  kv_path: platform/workloads/railiance-telemetry/smtp
  fields:
  - SMTP_PASSWORD
  policy_name: authelia-smtp-eso
  auth:
    method: kubernetes
    mount: kubernetes
    role: authelia-smtp-eso
    bound_service_account_names:
    - authelia-smtp-eso
    bound_service_account_namespaces:
    - sso
    audience: openbao
    max_ttl: 15m
delivery:
  namespace: sso
  service_account: authelia-smtp-eso
  secret_store: openbao-authelia-smtp
  external_secret: authelia-smtp
  target_secret: authelia-smtp
  target_key: password
invariants:
- Mailbox credentials/version unchanged
- Telemetry role and Secret unchanged
- No static ESO tokens or credentials in code/logs/chat
- Owner attended admission required; no live activation from this proposal
activation:
  date: '2026-10-06'
  owner_receipt: docs/evidence/authelia-smtp-admission-2026-10-06.json
  status: verified
  kv_version: 2
  credential_changed: false
  consumer: sso/authelia-smtp-eso
  secret_projection_ready: true