railiance-platform/credential-change-requests/CCR-2026-0011-scaleway-object-storage-bootstrap.yaml
codex 382f04412a
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Close CCR drift and high-risk policy gaps
2026-08-21 01:29:28 +02:00

80 lines
2.8 KiB
YAML

id: CCR-2026-0011
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Scaleway bootstrap API key for reef-storage / WP-0002 bucket create
status: in_flight
created: '2026-08-14'
updated: '2026-08-14'
in_flight:
missing_fields:
- openbao.policy_file
- openbao.auth
blocking_reason: Founder bootstrap API key and final operator authentication design
are pending; do not invent metadata or fill placeholders.
owner: platform-operator
requester:
agent: grok
reason: >-
RESOURCE-WP-0002 T03 is human-approved to create a private Scaleway
Multi-AZ bucket in nl-ams. This session has no Scaleway CLI profile.
Founder will provision a bootstrap org/project API key into OpenBao;
the agent reads it only to create the bucket and then writes the
scoped bucket key to a separate path. Values must not appear in Git
or chat.
review:
required: true
required_approvers:
- platform-operator
comments:
- at: '2026-08-14T00:00:00+00:00'
reviewer: bernd.worsch
decision: approved
comment: >-
Approved in chat (Grok session): put Scaleway bootstrap key in
OpenBao first, then create the bucket.
target:
domain: financials
tenant: railiance
workload: scaleway-bootstrap
environment: production
purpose: Create reef-storage object-store members; not the Barman runtime key
openbao:
mount: platform
kv_path: platform/workloads/railiance/scaleway/bootstrap
fields:
- ACCESS_KEY
- SECRET_KEY
- DEFAULT_ORGANIZATION_ID
- DEFAULT_PROJECT_ID
policy_name: operator-kv-scaleway-bootstrap
access_frontdoor:
type: operator-local
catalog_id: scaleway-bootstrap
selector: scaleway bootstrap api
command: bao kv put platform/workloads/railiance/scaleway/bootstrap
resolvable: false
readiness: approved-pending-apply
delivery:
surface: operator-workstation
target: reef-storage/tools/create-platform-audit-bucket.sh (reads, never prints)
risk:
classification: high
notes:
- Bootstrap key can create projects/buckets; rotate or delete after scoped key exists.
- Scoped backup key is a different path: platform/workloads/railiance/backup/object-storage
- Values must not appear in Git, State Hub, or chat.
verification:
positive:
- Field names present on the KV path; values not printed.
negative:
- default-policy token denied on the data path.
activation_conditions:
- Founder supplies the bootstrap credential through attended custody outside Git,
chat, argv, and State Hub.
- Platform operator records the exact policy artifact and authentication method
before the request leaves in_flight status.
lifecycle:
deactivate: Delete bootstrap key at Scaleway after the scoped bucket key works.
rotate: Put a new bootstrap key; do not reuse the scoped backup key.
compromised: Revoke both Scaleway keys; rotate bucket policy.