df24a77482
Correct the KV path into platform/workloads/, record secrets-engine consumer coordinates (D1-D4 pending), rotation ownership, live order and rollback, and add a decision-gated custody child with fake-only tests. Nothing executed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
56 lines
1.7 KiB
YAML
56 lines
1.7 KiB
YAML
schema_version: 1
|
|
lane_id: keycape-secrets-engine-openbao-eso
|
|
ccr_id: CCR-2026-0033
|
|
title: KeyCape secrets-engine-openbao issuer workload reader
|
|
date: '2026-10-04'
|
|
consumer_repo: key-cape
|
|
owner_repo: railiance-platform
|
|
requester:
|
|
agent: key-cape
|
|
reason: KEY-WP-0037-T02 owner packet; proposed issuer-side read of separately approved
|
|
service client custody
|
|
review_approvers:
|
|
- platform-owner
|
|
- key-cape-owner
|
|
- net-kingdom-owner
|
|
target:
|
|
domain: financials
|
|
tenant: platform
|
|
workload: keycape
|
|
environment: production
|
|
purpose: Deliver separately approved secrets-engine-openbao client secret to issuer
|
|
through sso-only ESO
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/secrets-engine-openbao
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
|
|
auth:
|
|
mount: kubernetes
|
|
role: external-secrets-keycape-secrets-engine-openbao
|
|
audience: openbao
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
ttl: 15m
|
|
eso:
|
|
store_name: openbao-keycape-secrets-engine-openbao
|
|
server: http://openbao.openbao.svc:8200
|
|
namespace: sso
|
|
external_secret_name: keycape-secrets-engine-openbao-client
|
|
secret_name: keycape-secrets-engine-openbao-client
|
|
refresh_interval: 5m
|
|
data:
|
|
- secret_key: client-secret
|
|
property: CLIENT_SECRET
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Reads whole proposed path holding the secrets-engine-openbao confidential value;
|
|
issuer and consumer copies need separate acceptance
|
|
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers
|
|
are within this boundary
|
|
- Issuer ESO does not deliver the separate secrets-engine consumer file or authorize
|
|
client registration
|