1524c54570
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
89 lines
4.2 KiB
YAML
89 lines
4.2 KiB
YAML
id: CCR-2026-0056
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Email-connect platform SMTP password projection
|
|
status: proposed
|
|
created: '2026-10-31'
|
|
updated: '2026-10-31'
|
|
requester:
|
|
agent: coulomb-social
|
|
reason: CSOC-WP-0015-T02 platform sender migration; user selected platform-root with Bernd as the human reply and bounce operator. This ownership choice is not credential admission.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- founder
|
|
- railiance-platform-owner
|
|
- email-connect-owner
|
|
comments: []
|
|
target:
|
|
domain: communication
|
|
tenant: platform
|
|
workload: email-connect
|
|
environment: production
|
|
purpose: Fixed admitted registration and invitation templates from platform@coulomb.social; no new caller or arbitrary notification authority.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/railiance-telemetry/smtp
|
|
fields:
|
|
- SMTP_PASSWORD
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
policy_name: email-connect-platform-smtp-eso
|
|
policy_file: openbao/policies/email-connect-platform-smtp-eso.hcl
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: email-connect-platform-smtp-eso
|
|
bound_claims:
|
|
service_account_names:
|
|
- email-connect-platform-smtp-eso
|
|
service_account_namespaces:
|
|
- email-connect
|
|
bound_claims_confirmed: false
|
|
policies:
|
|
- email-connect-platform-smtp-eso
|
|
ttl: 15m
|
|
audience: openbao
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
access_frontdoor:
|
|
type: external-secrets
|
|
catalog_id: email-connect-platform-smtp
|
|
selector: Namespace email-connect and ServiceAccount email-connect-platform-smtp-eso only
|
|
readiness: pending-review
|
|
resolvable: false
|
|
delivery:
|
|
surface: external-secrets
|
|
namespace: email-connect
|
|
service_account: email-connect-platform-smtp-eso
|
|
secret_store: openbao-email-connect-platform-smtp
|
|
external_secret: email-connect-platform-smtp
|
|
target_secret: email-connect-platform-smtp
|
|
target_key: password
|
|
target: Dedicated namespace SecretStore and password-only ExternalSecret; caller tokens unchanged.
|
|
bootstrap_command: Existing mailbox is reused; this request does not create or rotate a value.
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Shared mailbox reader outside the automatic single-reader profile; existing telemetry and Authelia grants must be preserved.
|
|
- OpenBao authorizes the whole exact KV record, not individual fields. ESO projects only SMTP_PASSWORD; this is not field-level OpenBao access control.
|
|
- SMTP credential can send as the platform mailbox. No IMAP access or mailbox forwarding operation is included.
|
|
- No new application sender, mailbox scan, suppression operator or timer is activated by admission alone.
|
|
verification:
|
|
positive:
|
|
- Exact scoped role and policy readback; certificate-verified STARTTLS AUTH without mail submission.
|
|
- Native service account binding confirmation precedes apply; actual workload login and ESO Ready are verified separately after projection.
|
|
negative:
|
|
- Changed policy, role, settings, approval, source digest or unconfirmed binding refuses.
|
|
- Agent boundary denies both KV data and metadata; workload token denies metadata, sibling and mutation capabilities.
|
|
activation_conditions:
|
|
- Exact CCR approval and native bound claims confirmed through the owner workflow.
|
|
- Attended owner helper receipt verified with unchanged mailbox version and other consumers; Warden session revocation confirmed.
|
|
- Native workload positive and negative login, scoped projection Ready and separate supervised application sender rollout accepted.
|
|
evidence: []
|
|
lifecycle:
|
|
deactivate: Stop the admitted consumer and reconcile pending sends, revoke only this dedicated reader role/policy, and remove only its projection after owner verification. Preserve the mailbox and other consumers.
|
|
rotate: Coordinate provider rotation across telemetry, Authelia and email-connect; verify all projections and consumers before retiring the predecessor. Never rotate a single consumer copy independently.
|
|
compromised: Pause affected sending and coordinate shared-mailbox credential rotation through the owner; preserve ledger evidence and investigate all admitted consumers. Do not auto-resend unknown outcomes.
|