id: CCR-2026-0013
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Core Hub runtime API token lane
status: proposed
created: '2026-08-20'
updated: '2026-08-20'
requester:
  agent: codex
  reason: >-
    CORE-WP-0011 and RAPP-CORE-HUB-WP-0001 relocate Core Hub production to
    railiance01. The validated package requires CORE_HUB_API_TOKEN, but the
    value must move through platform custody rather than a copied Kubernetes
    Secret or Git. This request covers only the standing application token;
    PostgreSQL credentials remain dynamic database-engine leases.
review:
  required: true
  required_approvers:
  - platform-operator
  - core-hub-owner
  comments: []
target:
  domain: infotech
  tenant: core-hub
  workload: core-hub
  rapp: rapp-core-hub
  environment: production
  purpose: >-
    Project the existing Core Hub protected-API token into the private
    railiance01 runtime through a namespace-limited ExternalSecret while
    preserving the token across the relocation window.
openbao:
  mount: platform
  kv_path: platform/workloads/core-hub/runtime
  fields:
  - CORE_HUB_API_TOKEN
  policy_name: workload-kv-read-core-hub-runtime
  policy_file: openbao/policies/workload-kv-read-core-hub-runtime.hcl
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-core-hub-runtime
    bound_claims:
      service_account_names:
      - external-secrets
      service_account_namespaces:
      - external-secrets
    bound_claims_confirmed: false
    policies:
    - workload-kv-read-core-hub-runtime
    ttl: 15m
access_frontdoor:
  type: ops-warden
  catalog_id: core-hub-runtime-api-token
  selector: Core Hub runtime protected API token
  command: warden access core-hub-runtime-api-token --fetch CORE_HUB_API_TOKEN
  resolvable: false
  readiness: pending-review
delivery:
  surface: external-secrets
  target: >-
    ClusterSecretStore openbao-core-hub-runtime, limited to namespace
    core-hub, to ExternalSecret core-hub/core-hub-api-token and Secret
    core-hub-api-token. The rapp package consumes this Secret separately from
    runtime and migration PostgreSQL lease Secrets.
risk:
  classification: high
  notes:
  - The token authorizes protected Core Hub API operations and must not be
    printed, placed on argv, committed, or recorded in State Hub.
  - This CCR does not authorize a standing database password or a database URL
    in KV. Those come from the OpenBao database engine.
  - Preserve the current token during the relocation so existing protected API
    consumers do not fail at the same time as the infrastructure move.
  - Later rotation is coordinated with every protected API consumer because
    Core Hub currently accepts one token.
verification:
  positive:
  - An approved core-hub ExternalSecret syncs CORE_HUB_API_TOKEN into Secret
    core-hub-api-token without printing the value.
  - Protected API smoke succeeds against the private shadow endpoint using an
    injected token after the source database has been reconciled.
  negative:
  - A namespace outside core-hub cannot use openbao-core-hub-runtime.
  - A token without workload-kv-read-core-hub-runtime cannot read the KV data
    path.
  - The Core Hub workload identity cannot write or list sibling workload paths.
  activation_conditions:
  - Platform operator and Core Hub owner approve this CCR.
  - The source token is transferred through attended operator custody without
    entering logs, chat, Git, or State Hub.
  - The Kubernetes auth role and policy are applied to railiance01-local
    OpenBao and the bound service-account claims are verified.
  - The package consumes the API-token Secret separately from dynamic database
    lease Secrets.
  - Positive and negative evidence is recorded with non-secret timestamps or
    OpenBao audit references.
  evidence: []
lifecycle:
  deactivate: >-
    Disable the front door and Kubernetes auth role, remove the ExternalSecret,
    and delete the materialized Secret only after Core Hub is retired or a
    reviewed fallback is active.
  rotate: >-
    Coordinate a new random token with all protected API consumers, update the
    OpenBao field through attended custody, wait for ESO sync, roll Core Hub and
    consumers, verify protected calls, then invalidate the old token.
  compromised: >-
    Disable protected writes, replace the token in OpenBao and every consumer,
    roll the workload, review Core Hub protected-operation logs, and open an
    incident follow-up.
state_hub:
  workplan_id: RPF-WP-0021
  task_id: RPF-WP-0021-T04
  decision_id: 4f70311b-a4c4-4959-b1a1-cdd1be97d523
  decision_api_url: http://127.0.0.1:8000/decisions/4f70311b-a4c4-4959-b1a1-cdd1be97d523
  decision_dashboard_url: http://127.0.0.1:3000/decisions