139 lines
6 KiB
YAML
139 lines
6 KiB
YAML
id: CCR-2026-0010
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: email-connect transactional SMTP and ingest token lane
|
|
status: active
|
|
created: '2026-08-12'
|
|
updated: '2026-08-21'
|
|
requester:
|
|
agent: grok
|
|
reason: >-
|
|
EMAIL-WP-0004-T03 requires OpenBao custody for IONOS SMTP STARTTLS credentials
|
|
and the shared caller ingest token so user-engine can call the cluster-local
|
|
transactional receiver without possessing SMTP material. Package manifests live
|
|
in email-connect/deploy/k8s/railiance; this CCR covers the OpenBao path, ESO
|
|
policy/role, and ops-warden catalog front door.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- email-connect-owner
|
|
comments:
|
|
- at: '2026-08-12T00:00:00+00:00'
|
|
reviewer: bernd.worsch
|
|
decision: approved
|
|
comment: >-
|
|
Approved in chat (Grok session, EMAIL-WP-0004-T03) acting as platform-operator
|
|
and email-connect-owner. Daily send-quota privilege tiers explicitly deferred
|
|
(DECISIONS.md); proceed with lane apply and deploy package.
|
|
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: email-connect
|
|
environment: production
|
|
purpose: >-
|
|
Deliver EMAIL_CONNECT_INGEST_TOKEN and IONOS SMTP username/password into the
|
|
email-connect namespace via External Secrets so the transactional receiver can
|
|
send invitation and verification mail without baking secrets into the image,
|
|
Git, or user-engine.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/email-connect/transactional
|
|
fields:
|
|
- EMAIL_CONNECT_INGEST_TOKEN
|
|
- EMAIL_CONNECT_SMTP_USERNAME
|
|
- EMAIL_CONNECT_SMTP_PASSWORD
|
|
policy_name: workload-kv-read-email-connect-transactional
|
|
policy_file: openbao/policies/workload-kv-read-email-connect-transactional.hcl
|
|
eso_policy_name: external-secrets-email-connect
|
|
eso_policy_file: openbao/policies/external-secrets-email-connect.hcl
|
|
auth:
|
|
# Interim railiance01 pattern (matches openbao-activity-core / openbao-reuse):
|
|
# policy-limited orphan child token stored as K8s Secret, not Kubernetes auth.
|
|
# Kubernetes auth role external-secrets-email-connect remains the preferred
|
|
# follow-up once the cluster auth mount is wired for this namespace.
|
|
method: token
|
|
token_secret: external-secrets/openbao-email-connect-eso-token
|
|
bootstrap_script: email-connect/deploy/k8s/railiance/openbao-eso-token-apply.sh
|
|
policies:
|
|
- external-secrets-email-connect
|
|
ttl: 768h
|
|
kubernetes_followup:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-email-connect
|
|
bound_claims:
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
access_frontdoor:
|
|
type: ops-warden
|
|
catalog_id: email-connect-transactional
|
|
selector: email-connect transactional SMTP and ingest token
|
|
command: warden access email-connect-transactional --fetch EMAIL_CONNECT_SMTP_PASSWORD
|
|
resolvable: true
|
|
readiness: ready
|
|
activation: verified-positive-and-negative-2026-08-12
|
|
delivery:
|
|
surface: external-secrets
|
|
target: >-
|
|
ClusterSecretStore openbao-email-connect (tokenSecretRef
|
|
openbao-email-connect-eso-token; namespace condition email-connect) at
|
|
railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-email-connect.clustersecretstore.yaml
|
|
→ ExternalSecret email-connect/email-connect-runtime → Secret
|
|
email-connect-runtime. Package manifests in
|
|
email-connect/deploy/k8s/railiance/ (not applied until this CCR is approved
|
|
and the KV secret is provisioned).
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- SMTP credentials grant outbound mail from the platform IONOS identity; abuse
|
|
is bulk send and reputation damage.
|
|
- The ingest token is a shared bearer between user-engine and email-connect;
|
|
compromise lets a holder submit invitation/verification sends within the
|
|
fixed template allow-list (not arbitrary content).
|
|
- NetworkPolicy restricts ingress to user-engine and egress to DNS + TCP 587;
|
|
credentials are a second gate, not the only one.
|
|
- Interim ESO delivery uses a renewable orphan child token (same pattern as
|
|
activity-core/reuse); ops-warden must proxy operator reads as the caller and
|
|
must not retain values.
|
|
verification:
|
|
positive:
|
|
- An approved email-connect-namespace ExternalSecret can sync the three fields
|
|
to Secret email-connect-runtime without printing values.
|
|
- The email-connect Deployment reaches Ready and /healthz without SMTP fields
|
|
present in user-engine secrets.
|
|
negative:
|
|
- A namespace outside the ClusterSecretStore condition cannot use the store to
|
|
read the path.
|
|
- A token without external-secrets-email-connect cannot read the KV path.
|
|
- Pods outside user-engine cannot reach TCP 8080 on the receiver.
|
|
activation_conditions:
|
|
- Policy applied with platform-admin/operator authority.
|
|
- ESO child token Secret and ClusterSecretStore openbao-email-connect live on
|
|
railiance01, namespace-scoped to email-connect.
|
|
- Secret value provisioned directly in OpenBao through approved operator custody.
|
|
- Positive and negative verification recorded with non-secret audit ids or timestamps.
|
|
evidence:
|
|
- at: '2026-08-20T22:56:00+00:00'
|
|
actor: codex
|
|
kind: auth_path_reconciliation
|
|
result: passed
|
|
details:
|
|
- Live ClusterSecretStore openbao-email-connect uses tokenSecretRef external-secrets/openbao-email-connect-eso-token,
|
|
is namespace-limited to email-connect, and reports Valid.
|
|
- ExternalSecret email-connect-runtime reports SecretSynced. No Secret value was read.
|
|
lifecycle:
|
|
deactivate: Disable ops-warden catalog entry and detach ESO role policy.
|
|
rotate: >-
|
|
Overlap-first: put new SMTP password and/or ingest token in OpenBao; wait for
|
|
ESO refresh (or force sync); roll email-connect and user-engine as needed;
|
|
revoke old provider password / retire old bearer.
|
|
compromised: Immediately deactivate front door, rotate SMTP and ingest token,
|
|
record blast-radius notes, and open incident follow-up.
|
|
state_hub:
|
|
workplan_id: EMAIL-WP-0004
|
|
task_id: EMAIL-WP-0004-T03
|