coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md
codex e4af2a1d10
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
fix(workplans): migrate active workplans off the retired RAILIANCE-WP prefix 
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix
registry already lists it retired). Three repositories independently used one
number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here,
a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This
repository also carried two files both numbered 0016.

Active workplans move to the successor prefix and are renumbered from 0001 in
historical order. Archived workplans keep their historical identifiers.

Projection UUIDs are re-derived from the new canonical ids. Records already
registered under the old identifiers leave orphaned hub rows behind; that debt
is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands.

Refs CUST-WP-0068-T03

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 22:58:35 +02:00

5.8 KiB
Raw Permalink Blame History

id type title domain repo status owner topic_slug created updated depends_on_workplans related_repos state_hub_workstream_id
RPF-WP-0005 workplan reuse-surface Runtime Secrets OpenBao Lane financials railiance-platform finished codex railiance 2026-07-07 2026-07-07
RAILIANCE-WP-0007
RAILIANCE-WP-0008
railiance-apps
reuse-surface
ops-warden
7fe172fe-d987-52a0-aa36-67d6a1dd5a7c

RPF-WP-0005 — reuse-surface Runtime Secrets OpenBao Lane

Goal

Promote reuse-surface hub runtime secrets from bootstrap Kubernetes Secret custody to a reviewed OpenBao workload KV lane delivered by External Secrets Operator, matching the platform pattern used by issue-core, OpenRouter, and Forgejo mailer.

Today both secrets live in reuse/reuse-surface-env on Railiance01:

Field Consumer
REUSE_SURFACE_TOKEN Hub write API; operators via warden access / kubectl
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET Hub webhook receiver; Forgejo org webhook HMAC

Functional custody in K8s is sufficient for production today (live since 2026-07-07). This workplan is hygiene and standardization, not a blocker.

No task may paste, commit, log, or send secret values through Git, State Hub, chat, prompts, shell history, or workplan text.

Proposed contract

Item Proposed value
CCR CCR-2026-0005
Tenant/org reuse
Workload reuse-surface
KV mount platform
OpenBao CLI path platform/workloads/reuse/reuse-surface/runtime-secrets
Secret fields REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
Read policy workload-kv-read-reuse-surface-runtime (name TBD at CCR)
K8s auth role external-secrets-reuse-surface (name TBD at CCR)
ExternalSecret reuse/reuse-surface-runtime → target Secret reuse-surface-env
ops-warden catalog migrate reuse-surface-hub-write-token handoff to Bao path

Dual-consumer note: Forgejo org webhook must be updated whenever the webhook HMAC rotates — document in railiance-apps/docs/reuse-surface-on-railiance01.md and keep make reuse-forgejo-webhook idempotent.

Draft OpenBao + ESO Lane

id: RPF-WP-0005-T01
status: done
priority: medium
state_hub_task_id: "4e7f5200-37a5-5208-b01e-a9633fb056df"
  • Draft CCR for the lane (path, fields, policy, k8s role, ESO target)
  • Align with docs/openbao.md path convention and docs/credential-lane-lifecycle-runbook.md
  • Negative review: no secret values in CCR or workplan text

2026-07-07: Drafted CCR-2026-0005 and policy openbao/policies/workload-kv-read-reuse-surface-runtime.hcl. Metadata review confirms Railiance01 reuse/reuse-surface-env (two fields), ESO operator SA, and forgejo-style interim ClusterSecretStore delivery. CCR remains proposed; T02 blocked on platform-operator and reuse-surface-owner approval.

Platform Apply And Verification

id: RPF-WP-0005-T02
status: done
priority: medium
state_hub_task_id: "01b661a1-315b-566c-ad15-00cb71640f5a"

Blocked on CCR-2026-0005 approval.

  • Apply OpenBao policy + Kubernetes auth role (mirror forgejo-mailer / issue-core scripts)
  • Seed path from existing cluster Secret (one-time operator step; value never logged)
  • Add manifests/reuse-surface-runtime-externalsecret.yaml in railiance-apps
  • Verify ExternalSecret SecretSynced and pod env injection after rollout
  • Record non-secret audit evidence (positive + negative reads)

2026-07-07: CCR-2026-0005 approved; delegated metadata apply recorded; KV path seeded (version 1); openbao-reuse ClusterSecretStore + reuse-surface-runtime ExternalSecret live on Railiance01 (SecretSynced 2026-07-07T20:33:17Z). Positive: /v1/federated 200, signed webhook 200. Negative: default-policy token denied on path. CCR status verified. T03 catalog migration remains open.

Consumer Handoff And Catalog Migration

id: RPF-WP-0005-T03
status: done
priority: low
state_hub_task_id: "a521036b-2858-5a42-9d23-6f142137ee6d"

Blocked on T02 verification.

  • Update railiance-apps/docs/reuse-surface-on-railiance01.md custody section
  • Update ops-warden reuse-surface-hub-write-token playbook + routing catalog (fetch_command → bao kv get -field=...)
  • Add lane to docs/workload-kv-access-lanes.md
  • Deprecate direct kubectl fetch as primary handoff (keep as break-glass note)

2026-07-07: ops-warden catalog reuse-surface-hub-write-token migrated to bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets (owner railiance-platform, resolvable=true). Playbook, CredentialRouting index, docs/workload-kv-access-lanes.md, and railiance-apps export handoff updated; kubectl documented as break-glass only. CCR-2026-0005 front door ready/resolvable=true.

Forgejo Webhook Rotation Runbook

id: RPF-WP-0005-T04
status: done
priority: low
state_hub_task_id: "cf1f198e-2af2-5f62-8e3b-1edfc9f537c8"

Blocked on T03.

  • Document rotation: update OpenBao field → ESO sync → rollout → make reuse-forgejo-webhook (updates org hook secret)
  • Add smoke: signed webhook POST returns 200/accepted or expected no-op

2026-07-07: Added docs/reuse-surface-runtime-secrets-rotation-runbook.md, CCR-2026-0005 lane in docs/credential-lane-lifecycle-runbook.md, and railiance-apps make reuse-webhook-smoke (unsigned 401, signed no-op 200, ESO Ready, /v1/federated). Live smoke passed on production.

Acceptance

  • Both fields readable from platform/workloads/reuse/reuse-surface/runtime-secrets
  • ESO owns reuse-surface-env; manual kubectl create secret no longer required for steady state
  • warden access reuse-surface-hub-write-token --fetch uses OpenBao path
  • Forgejo org webhook and hub HMAC aligned (smoke verifies signed/unsigned paths; rotation runbook documents reconcile step)