tegwick
0fada49c38
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
66 lines
1.9 KiB
YAML
66 lines
1.9 KiB
YAML
id: CCR-2026-0035
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Authelia platform SMTP password projection
|
|
status: active
|
|
created: '2026-10-06'
|
|
updated: '2026-10-06'
|
|
requester:
|
|
agent: codex
|
|
reason: CSOC-WP-0010 / NK-WP-0047 restore user-requested password reset email; existing
|
|
platform mailbox custody.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- founder
|
|
- railiance-platform-owner
|
|
- net-kingdom-owner
|
|
comments:
|
|
- at: '2026-10-06T18:24:56.793292+00:00'
|
|
reviewer: Bernd Worsch (founder)
|
|
decision: approved
|
|
comment: 'Explicit chat approval: I approve let''s wire this. Exact consumer admission
|
|
and Authelia SMTP rollout approved; owner-attended execution still pending.'
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: authelia
|
|
environment: production
|
|
purpose: Native password-reset notifier; password mounted read-only under /run/secrets/authelia-smtp/password.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/railiance-telemetry/smtp
|
|
fields:
|
|
- SMTP_PASSWORD
|
|
policy_name: authelia-smtp-eso
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: authelia-smtp-eso
|
|
bound_service_account_names:
|
|
- authelia-smtp-eso
|
|
bound_service_account_namespaces:
|
|
- sso
|
|
audience: openbao
|
|
max_ttl: 15m
|
|
delivery:
|
|
namespace: sso
|
|
service_account: authelia-smtp-eso
|
|
secret_store: openbao-authelia-smtp
|
|
external_secret: authelia-smtp
|
|
target_secret: authelia-smtp
|
|
target_key: password
|
|
invariants:
|
|
- Mailbox credentials/version unchanged
|
|
- Telemetry role and Secret unchanged
|
|
- No static ESO tokens or credentials in code/logs/chat
|
|
- Owner attended admission required; no live activation from this proposal
|
|
activation:
|
|
date: '2026-10-06'
|
|
owner_receipt: docs/evidence/authelia-smtp-admission-2026-10-06.json
|
|
status: verified
|
|
kv_version: 2
|
|
credential_changed: false
|
|
consumer: sso/authelia-smtp-eso
|
|
secret_projection_ready: true
|