08a406f2f8
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
80 lines
3.2 KiB
Markdown
80 lines
3.2 KiB
Markdown
---
|
|
id: RPF-WP-0037
|
|
type: workplan
|
|
title: "Recover three active ESO lanes from static-token authentication failure"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
created: "2026-09-05"
|
|
updated: "2026-09-05"
|
|
state_hub_workstream_id: "df076911-18b4-5731-99a8-2ecb3c3cc5b3"
|
|
---
|
|
|
|
User authorized continuing with the identified delivery failures. Live metadata
|
|
confirms active Forgejo, reuse-surface and target-revenue consumers. All three
|
|
ClusterSecretStores fail OpenBao token lookup-self with 403. This plan repairs
|
|
delivery authentication; it does not rotate application credentials or restart
|
|
consumers. RPF-WP-0036-T04 retains the separate telemetry acceptance gate.
|
|
|
|
## Diagnose authentication and compare custody without exposing values
|
|
|
|
```task
|
|
id: RPF-WP-0037-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e0e7ff05-01bf-58db-a18e-4c5e48a697fc"
|
|
```
|
|
|
|
Use attended platform-admin and pinned cluster access. Capture token validity,
|
|
policy coordinates and boolean equality between native KV data and the existing
|
|
consumer Secret. No values, tokens, hashes or fingerprints in evidence. Stop
|
|
before any resync if custody disagrees with the deployed Secret.
|
|
|
|
## Replace static authentication with exact Kubernetes bindings
|
|
|
|
```task
|
|
id: RPF-WP-0037-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "01dd799d-f967-57d6-9cf0-9b01971e5bf1"
|
|
```
|
|
|
|
Stage dedicated namespace/SA/audience-bound roles with 15-minute maximum TTL,
|
|
no default policy and exact KV data read plus token self-lookup/revocation.
|
|
Keep namespace restrictions and existing delivery paths. Refuse live drift.
|
|
Validate positive read and wrong-identity/sibling/write denial before changing
|
|
each store. Persist source before apply. Do not overwrite workload key material.
|
|
|
|
## Verify sustained delivery and record closure
|
|
|
|
```task
|
|
id: RPF-WP-0037-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "ee47707c-289b-5bea-a2ad-fdf40fed7034"
|
|
```
|
|
|
|
Require Ready stores and ExternalSecrets, a second successful forced reconcile,
|
|
unchanged deployed key material and healthy consumers. Record safe receipts and
|
|
retire obsolete bootstrap instructions. Remove obsolete static token references
|
|
from stores; retain old token Secret objects until their invalidity is proven.
|
|
Commit and synchronize file-backed work and report any remaining gates.
|
|
|
|
|
|
## Completion — 2026-09-05
|
|
|
|
All three lanes migrated and passed fresh reconciliation, exact reads,
|
|
wrong-SA/namespace/audience rejection, bounded TTL and sibling/write denial.
|
|
OpenBao workload values matched deployed Secrets before and after migration;
|
|
no application credential rotation or consumer rollout was requested. Native
|
|
admin lookup proved old tokens invalid; after proving zero store references,
|
|
all three obsolete token Secrets were removed with deletion preconditions.
|
|
All 27 cluster ExternalSecrets are Ready and all three consumers have one ready
|
|
replica. 187 tests and credential request validation passed. Current source,
|
|
CCR-2026-0005 delivery binding and bootstrap guidance are updated.
|
|
|
|
Evidence: `docs/evidence/RPF-WP-0037-eso-auth-recovery-2026-09-05.json`.
|
|
Runbook: `docs/eso-auth-recovery.md`.
|
|
RPF-WP-0036-T04 retains the independent Q2 signal-delivery acceptance gate;
|
|
backup credential recovery and operator-only cutover remain in WP-0029/0025.
|