0f0282a436
credential-change.py generates sys/capabilities-self (update) when openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops calling sys/capabilities with a root token. The OpenBao login page keeps its platform-admin button and adds an allow-listed workload role choice. Repo only; nothing applied to OpenBao or the cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52 |
||
|---|---|---|
| .. | ||
| openbao-ui-overlay | ||
| apps-pg-2-backup.yaml | ||
| apps-pg-2-cluster.yaml | ||
| apps-pg-2-networkpolicies.yaml | ||
| apps-pg-backup.yaml | ||
| apps-pg-cluster.yaml | ||
| apps-pg-consumer-controls.sql | ||
| apps-pg-databases.yaml | ||
| apps-pg-isolation-probe.yaml | ||
| apps-pg-networkpolicies.yaml | ||
| apps-pg-secret.sops.yaml.template | ||
| forgejo-db-backup-networkpolicies.yaml | ||
| forgejo-db-backup.yaml | ||
| forgejo-db-cluster.yaml | ||
| forgejo-db-networkpolicies.yaml | ||
| forgejo-db-secret.sops.yaml.template | ||
| gitea-db-cluster.yaml | ||
| gitea-db-networkpolicies.yaml | ||
| gitea-db-secret.sops.yaml.template | ||
| net-kingdom-pg-inter-hub-networkpolicy.yaml | ||
| openbao-middleware.yaml | ||
| openbao-public-ingress.rollback.yaml | ||
| openbao-ui-overlay-k8s.yaml | ||
| openbao-values.yaml | ||
| playwright-consumer-access.yaml | ||
| postgresql-ha-values.yaml.template | ||
| valkey-values.sops.yaml | ||
| valkey-values.sops.yaml.template | ||
| vergabe-demo-company-controls.sql | ||
| vergabe-demo-company-database.yaml | ||
| vergabe-demo-company-role.yaml | ||