7713a45923
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
50 lines
1.7 KiB
YAML
50 lines
1.7 KiB
YAML
schema_version: 1
|
|
lane_id: informed-decision-sitting-requester-eso
|
|
ccr_id: CCR-2026-0032
|
|
title: Informed Decision create-only requester workload read
|
|
date: '2026-10-04'
|
|
consumer_repo: informed-decision
|
|
owner_repo: railiance-platform
|
|
requester:
|
|
agent: informed-decision
|
|
reason: INFD-WP-0005-T05 request cd811073; prepare workload delivery of existing requester custody
|
|
review_approvers:
|
|
- platform-owner
|
|
- informed-decision-owner
|
|
target:
|
|
domain: financials
|
|
tenant: platform
|
|
workload: informed-decision
|
|
environment: production
|
|
purpose: Deliver existing create-only requester client to the review pod through namespace-restricted ESO
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/informed-decision/sitting-requester
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-informed-decision-sitting-requester-eso
|
|
auth:
|
|
mount: kubernetes
|
|
role: informed-decision-sitting-requester-eso
|
|
audience: openbao
|
|
service_account_names:
|
|
- informed-decision-eso
|
|
service_account_namespaces:
|
|
- informed-decision
|
|
ttl: 15m
|
|
eso:
|
|
store_name: openbao-informed-decision-sitting-requester
|
|
server: http://openbao.openbao.svc:8200
|
|
namespace: informed-decision
|
|
external_secret_name: informed-decision-sitting-requester
|
|
secret_name: informed-decision-sitting-requester
|
|
refresh_interval: 5m
|
|
data:
|
|
- secret_key: client-secret
|
|
property: CLIENT_SECRET
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- The whole KV path is readable; the existing CLIENT_SECRET permits approval:create for subject informed-decision
|
|
- Any ExternalSecret in the informed-decision namespace can reference this store; no other namespace is admitted
|
|
- No approval:approve, approval:consume, sibling read, metadata listing or new client is granted
|