codex
e4af2a1d10
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
154 lines
5.8 KiB
Markdown
154 lines
5.8 KiB
Markdown
---
|
|
id: RPF-WP-0005
|
|
type: workplan
|
|
title: "reuse-surface Runtime Secrets OpenBao Lane"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-07"
|
|
updated: "2026-07-07"
|
|
depends_on_workplans:
|
|
- RAILIANCE-WP-0007
|
|
- RAILIANCE-WP-0008
|
|
related_repos:
|
|
- railiance-apps
|
|
- reuse-surface
|
|
- ops-warden
|
|
state_hub_workstream_id: "7fe172fe-d987-52a0-aa36-67d6a1dd5a7c"
|
|
---
|
|
|
|
# RPF-WP-0005 — reuse-surface Runtime Secrets OpenBao Lane
|
|
|
|
## Goal
|
|
|
|
Promote reuse-surface hub runtime secrets from bootstrap Kubernetes Secret
|
|
custody to a reviewed OpenBao workload KV lane delivered by External Secrets
|
|
Operator, matching the platform pattern used by issue-core, OpenRouter, and
|
|
Forgejo mailer.
|
|
|
|
Today both secrets live in `reuse/reuse-surface-env` on Railiance01:
|
|
|
|
| Field | Consumer |
|
|
| --- | --- |
|
|
| `REUSE_SURFACE_TOKEN` | Hub write API; operators via `warden access` / kubectl |
|
|
| `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` | Hub webhook receiver; Forgejo org webhook HMAC |
|
|
|
|
Functional custody in K8s is sufficient for production today (live since
|
|
2026-07-07). This workplan is **hygiene and standardization**, not a blocker.
|
|
|
|
No task may paste, commit, log, or send secret values through Git, State Hub,
|
|
chat, prompts, shell history, or workplan text.
|
|
|
|
## Proposed contract
|
|
|
|
| Item | Proposed value |
|
|
| --- | --- |
|
|
| CCR | `CCR-2026-0005` |
|
|
| Tenant/org | `reuse` |
|
|
| Workload | `reuse-surface` |
|
|
| KV mount | `platform` |
|
|
| OpenBao CLI path | `platform/workloads/reuse/reuse-surface/runtime-secrets` |
|
|
| Secret fields | `REUSE_SURFACE_TOKEN`, `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` |
|
|
| Read policy | `workload-kv-read-reuse-surface-runtime` (name TBD at CCR) |
|
|
| K8s auth role | `external-secrets-reuse-surface` (name TBD at CCR) |
|
|
| ExternalSecret | `reuse/reuse-surface-runtime` → target Secret `reuse-surface-env` |
|
|
| ops-warden catalog | migrate `reuse-surface-hub-write-token` handoff to Bao path |
|
|
|
|
Dual-consumer note: Forgejo org webhook must be updated whenever the webhook
|
|
HMAC rotates — document in `railiance-apps/docs/reuse-surface-on-railiance01.md`
|
|
and keep `make reuse-forgejo-webhook` idempotent.
|
|
|
|
## Draft OpenBao + ESO Lane
|
|
|
|
```task
|
|
id: RPF-WP-0005-T01
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "4e7f5200-37a5-5208-b01e-a9633fb056df"
|
|
```
|
|
|
|
- Draft CCR for the lane (path, fields, policy, k8s role, ESO target)
|
|
- Align with `docs/openbao.md` path convention and
|
|
`docs/credential-lane-lifecycle-runbook.md`
|
|
- Negative review: no secret values in CCR or workplan text
|
|
|
|
**2026-07-07:** Drafted `CCR-2026-0005` and policy
|
|
`openbao/policies/workload-kv-read-reuse-surface-runtime.hcl`. Metadata review
|
|
confirms Railiance01 `reuse/reuse-surface-env` (two fields), ESO operator SA,
|
|
and forgejo-style interim ClusterSecretStore delivery. CCR remains `proposed`;
|
|
T02 blocked on platform-operator and reuse-surface-owner approval.
|
|
|
|
## Platform Apply And Verification
|
|
|
|
```task
|
|
id: RPF-WP-0005-T02
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "01b661a1-315b-566c-ad15-00cb71640f5a"
|
|
```
|
|
|
|
Blocked on CCR-2026-0005 approval.
|
|
|
|
- Apply OpenBao policy + Kubernetes auth role (mirror forgejo-mailer / issue-core scripts)
|
|
- Seed path from existing cluster Secret (one-time operator step; value never logged)
|
|
- Add `manifests/reuse-surface-runtime-externalsecret.yaml` in `railiance-apps`
|
|
- Verify ExternalSecret `SecretSynced` and pod env injection after rollout
|
|
- Record non-secret audit evidence (positive + negative reads)
|
|
|
|
**2026-07-07:** CCR-2026-0005 approved; delegated metadata apply recorded; KV path
|
|
seeded (version 1); `openbao-reuse` ClusterSecretStore + `reuse-surface-runtime`
|
|
ExternalSecret live on Railiance01 (`SecretSynced` 2026-07-07T20:33:17Z). Positive:
|
|
`/v1/federated` 200, signed webhook 200. Negative: default-policy token denied on
|
|
path. CCR status `verified`. T03 catalog migration remains open.
|
|
|
|
## Consumer Handoff And Catalog Migration
|
|
|
|
```task
|
|
id: RPF-WP-0005-T03
|
|
status: done
|
|
priority: low
|
|
state_hub_task_id: "a521036b-2858-5a42-9d23-6f142137ee6d"
|
|
```
|
|
|
|
Blocked on T02 verification.
|
|
|
|
- Update `railiance-apps/docs/reuse-surface-on-railiance01.md` custody section
|
|
- Update ops-warden `reuse-surface-hub-write-token` playbook + routing catalog
|
|
(`fetch_command` → `bao kv get -field=...`)
|
|
- Add lane to `docs/workload-kv-access-lanes.md`
|
|
- Deprecate direct kubectl fetch as primary handoff (keep as break-glass note)
|
|
|
|
**2026-07-07:** ops-warden catalog `reuse-surface-hub-write-token` migrated to
|
|
`bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets`
|
|
(owner `railiance-platform`, `resolvable=true`). Playbook, CredentialRouting index,
|
|
`docs/workload-kv-access-lanes.md`, and railiance-apps export handoff updated; kubectl
|
|
documented as break-glass only. CCR-2026-0005 front door `ready`/`resolvable=true`.
|
|
|
|
## Forgejo Webhook Rotation Runbook
|
|
|
|
```task
|
|
id: RPF-WP-0005-T04
|
|
status: done
|
|
priority: low
|
|
state_hub_task_id: "cf1f198e-2af2-5f62-8e3b-1edfc9f537c8"
|
|
```
|
|
|
|
Blocked on T03.
|
|
|
|
- Document rotation: update OpenBao field → ESO sync → rollout →
|
|
`make reuse-forgejo-webhook` (updates org hook secret)
|
|
- Add smoke: signed webhook POST returns 200/accepted or expected no-op
|
|
|
|
**2026-07-07:** Added `docs/reuse-surface-runtime-secrets-rotation-runbook.md`,
|
|
CCR-2026-0005 lane in `docs/credential-lane-lifecycle-runbook.md`, and
|
|
`railiance-apps` `make reuse-webhook-smoke` (unsigned 401, signed no-op 200,
|
|
ESO Ready, `/v1/federated`). Live smoke passed on production.
|
|
|
|
## Acceptance
|
|
|
|
- [x] Both fields readable from `platform/workloads/reuse/reuse-surface/runtime-secrets`
|
|
- [x] ESO owns `reuse-surface-env`; manual `kubectl create secret` no longer required for steady state
|
|
- [x] `warden access reuse-surface-hub-write-token --fetch` uses OpenBao path
|
|
- [x] Forgejo org webhook and hub HMAC aligned (smoke verifies signed/unsigned paths; rotation runbook documents reconcile step)
|