15184aaa01
ACTIVITY-WP-0039-T02. Add read on the two exact worker-token paths to workload-kv-read-activity-core-eso, one CCR per worker identity. Adds scripts/openbao-policy-sync.sh, a silent attended policy writer that refuses undeclared live drift and verifies on readback. Not applied; CCRs await platform-operator and activity-core-owner approval. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
38 lines
1.2 KiB
HCL
38 lines
1.2 KiB
HCL
# RPF-WP-0045: ESO delivery for ClusterSecretStore openbao-activity-core via
|
|
# Kubernetes auth role activity-core-eso (SA activity-core/activity-core-eso).
|
|
# Exactly the KV paths the activity-core ExternalSecrets read; data read only,
|
|
# no metadata/list/write. ESO also needs lookup-self and revoke-self.
|
|
|
|
path "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/issue-core/issue-core/issue-core-runtime" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/railiance/backup/offsite-lane" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
# CCR-2026-0029 and CCR-2026-0030 / ACTIVITY-WP-0039-T02: ops_run queue worker tokens, one path
|
|
# per worker identity, read by ExternalSecret actcore-ops-run-worker-tokens.
|
|
path "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-railiance01" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|