115 lines
4.5 KiB
YAML
115 lines
4.5 KiB
YAML
id: CCR-2026-0013
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Core Hub runtime API token lane
|
|
status: proposed
|
|
created: '2026-08-20'
|
|
updated: '2026-08-20'
|
|
requester:
|
|
agent: codex
|
|
reason: >-
|
|
CORE-WP-0011 and RAPP-CORE-HUB-WP-0001 relocate Core Hub production to
|
|
railiance01. The validated package requires CORE_HUB_API_TOKEN, but the
|
|
value must move through platform custody rather than a copied Kubernetes
|
|
Secret or Git. This request covers only the standing application token;
|
|
PostgreSQL credentials remain dynamic database-engine leases.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- core-hub-owner
|
|
comments: []
|
|
target:
|
|
domain: infotech
|
|
tenant: core-hub
|
|
workload: core-hub
|
|
rapp: rapp-core-hub
|
|
environment: production
|
|
purpose: >-
|
|
Project the existing Core Hub protected-API token into the private
|
|
railiance01 runtime through a namespace-limited ExternalSecret while
|
|
preserving the token across the relocation window.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/core-hub/runtime
|
|
fields:
|
|
- CORE_HUB_API_TOKEN
|
|
policy_name: workload-kv-read-core-hub-runtime
|
|
policy_file: openbao/policies/workload-kv-read-core-hub-runtime.hcl
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-core-hub-runtime
|
|
bound_claims:
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
bound_claims_confirmed: false
|
|
policies:
|
|
- workload-kv-read-core-hub-runtime
|
|
ttl: 15m
|
|
access_frontdoor:
|
|
type: ops-warden
|
|
catalog_id: core-hub-runtime-api-token
|
|
selector: Core Hub runtime protected API token
|
|
command: warden access core-hub-runtime-api-token --fetch CORE_HUB_API_TOKEN
|
|
resolvable: false
|
|
readiness: pending-review
|
|
delivery:
|
|
surface: external-secrets
|
|
target: >-
|
|
ClusterSecretStore openbao-core-hub-runtime, limited to namespace
|
|
core-hub, to ExternalSecret core-hub/core-hub-api-token and Secret
|
|
core-hub-api-token. The rapp package consumes this Secret separately from
|
|
runtime and migration PostgreSQL lease Secrets.
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- The token authorizes protected Core Hub API operations and must not be
|
|
printed, placed on argv, committed, or recorded in State Hub.
|
|
- This CCR does not authorize a standing database password or a database URL
|
|
in KV. Those come from the OpenBao database engine.
|
|
- Preserve the current token during the relocation so existing protected API
|
|
consumers do not fail at the same time as the infrastructure move.
|
|
- Later rotation is coordinated with every protected API consumer because
|
|
Core Hub currently accepts one token.
|
|
verification:
|
|
positive:
|
|
- An approved core-hub ExternalSecret syncs CORE_HUB_API_TOKEN into Secret
|
|
core-hub-api-token without printing the value.
|
|
- Protected API smoke succeeds against the private shadow endpoint using an
|
|
injected token after the source database has been reconciled.
|
|
negative:
|
|
- A namespace outside core-hub cannot use openbao-core-hub-runtime.
|
|
- A token without workload-kv-read-core-hub-runtime cannot read the KV data
|
|
path.
|
|
- The Core Hub workload identity cannot write or list sibling workload paths.
|
|
activation_conditions:
|
|
- Platform operator and Core Hub owner approve this CCR.
|
|
- The source token is transferred through attended operator custody without
|
|
entering logs, chat, Git, or State Hub.
|
|
- The Kubernetes auth role and policy are applied to railiance01-local
|
|
OpenBao and the bound service-account claims are verified.
|
|
- The package consumes the API-token Secret separately from dynamic database
|
|
lease Secrets.
|
|
- Positive and negative evidence is recorded with non-secret timestamps or
|
|
OpenBao audit references.
|
|
evidence: []
|
|
lifecycle:
|
|
deactivate: >-
|
|
Disable the front door and Kubernetes auth role, remove the ExternalSecret,
|
|
and delete the materialized Secret only after Core Hub is retired or a
|
|
reviewed fallback is active.
|
|
rotate: >-
|
|
Coordinate a new random token with all protected API consumers, update the
|
|
OpenBao field through attended custody, wait for ESO sync, roll Core Hub and
|
|
consumers, verify protected calls, then invalidate the old token.
|
|
compromised: >-
|
|
Disable protected writes, replace the token in OpenBao and every consumer,
|
|
roll the workload, review Core Hub protected-operation logs, and open an
|
|
incident follow-up.
|
|
state_hub:
|
|
workplan_id: RPF-WP-0021
|
|
task_id: RPF-WP-0021-T04
|