dfa6373985
Document the one recipe a new rapp uses to acquire runtime secrets: standing KV secrets bind through a CCR target.rapp, leases through grant rapp_id. Stamp the existing postgres grants and the qonto workload CCR. Gate, delivery, and revocation are unchanged.
203 lines
6.4 KiB
YAML
203 lines
6.4 KiB
YAML
version: 1
|
|
updated: "2026-08-13"
|
|
owner_repo: railiance-platform
|
|
owner_domain: financials
|
|
workplan_id: RAILIANCE-WP-0005
|
|
state_hub_workstream_id: 2731fece-6c49-45b8-ab8a-4ea6c04ac603
|
|
|
|
delivery_modes:
|
|
allowed_known:
|
|
- exec-env
|
|
- response-wrap
|
|
- local-token-file
|
|
- kubernetes-auth
|
|
denied_known:
|
|
- chat
|
|
- state-hub-body
|
|
- git
|
|
- command-line-token-argument
|
|
- llm-prompt
|
|
|
|
grant_classes:
|
|
- self-service
|
|
- approval-required
|
|
- break-glass
|
|
|
|
grants:
|
|
- id: rapp-postgres/audit-core-runtime
|
|
title: audit-core runtime PostgreSQL lease
|
|
rapp_id: rapp-postgres
|
|
status: active
|
|
grant_class: self-service
|
|
credential_type: openbao-database-credential
|
|
issuer: openbao
|
|
audience: audit-core
|
|
description: Short-lived runtime connection to the audit-core database.
|
|
openbao:
|
|
namespace: openbao
|
|
token_role: audit-core-runtime-broker
|
|
issuer_policy: credential-broker-audit-core-runtime-issuer
|
|
policies: [credential-broker-audit-core-runtime]
|
|
disallowed_policies: [root, platform-admin]
|
|
mount_paths: [database/creds/audit-core-runtime]
|
|
database:
|
|
role: audit-core-runtime
|
|
host: platform-pg-rw.databases.svc.cluster.local
|
|
port: 5432
|
|
name: audit_core
|
|
env: {PGUSER: username, PGPASSWORD: password, PGHOST: host, PGPORT: port, PGDATABASE: database}
|
|
ttl: {default: 15m, max: 1h, renewable: false, requires_human_above: 1h}
|
|
actors:
|
|
allowed_types: [human-operator, approved-agent, ci-runner]
|
|
required_subject_binding: keycape-or-kubernetes-service-account
|
|
authorization:
|
|
flex_auth_required: false
|
|
flex_auth_mode: optional-preflight
|
|
approval_required: false
|
|
purpose_required: true
|
|
allowed_purpose_examples: [audit-core-runtime]
|
|
delivery:
|
|
allowed: [exec-env]
|
|
preferred: exec-env
|
|
denied: [chat, state-hub-body, git, command-line-token-argument, llm-prompt]
|
|
exec_env: {child_only: true, redact_logs: true}
|
|
audit: {openbao_audit_required: true, state_hub_metadata_allowed: true, record_secret_values: false}
|
|
revocation: {required: true, by_accessor: true, on_exec_exit: true, on_denied_request: false}
|
|
|
|
- id: rapp-postgres/audit-core-migration
|
|
title: audit-core migration PostgreSQL lease
|
|
rapp_id: rapp-postgres
|
|
status: active
|
|
grant_class: self-service
|
|
credential_type: openbao-database-credential
|
|
issuer: openbao
|
|
audience: audit-core
|
|
description: Short-lived migration connection to the audit-core database.
|
|
openbao:
|
|
namespace: openbao
|
|
token_role: audit-core-migration-broker
|
|
issuer_policy: credential-broker-audit-core-migration-issuer
|
|
policies: [credential-broker-audit-core-migration]
|
|
disallowed_policies: [root, platform-admin]
|
|
mount_paths: [database/creds/audit-core-migration]
|
|
database:
|
|
role: audit-core-migration
|
|
host: platform-pg-rw.databases.svc.cluster.local
|
|
port: 5432
|
|
name: audit_core
|
|
env: {PGUSER: username, PGPASSWORD: password, PGHOST: host, PGPORT: port, PGDATABASE: database}
|
|
ttl: {default: 10m, max: 30m, renewable: false, requires_human_above: 30m}
|
|
actors:
|
|
allowed_types: [human-operator, approved-agent, ci-runner]
|
|
required_subject_binding: keycape-or-kubernetes-service-account
|
|
authorization:
|
|
flex_auth_required: false
|
|
flex_auth_mode: optional-preflight
|
|
approval_required: false
|
|
purpose_required: true
|
|
allowed_purpose_examples: [audit-core-migration]
|
|
delivery:
|
|
allowed: [exec-env]
|
|
preferred: exec-env
|
|
denied: [chat, state-hub-body, git, command-line-token-argument, llm-prompt]
|
|
exec_env: {child_only: true, redact_logs: true}
|
|
audit: {openbao_audit_required: true, state_hub_metadata_allowed: true, record_secret_values: false}
|
|
revocation: {required: true, by_accessor: true, on_exec_exit: true, on_denied_request: false}
|
|
|
|
- id: ops-warden/warden-sign
|
|
title: Ops Warden OpenBao SSH signing smoke token
|
|
status: pilot
|
|
grant_class: self-service
|
|
credential_type: openbao-token
|
|
issuer: openbao
|
|
audience: ops-warden
|
|
description: >
|
|
Short-lived OpenBao child token for ops-warden SSH signing smoke tests.
|
|
The token may only use the warden-sign policy and must not be treated as
|
|
an ops-warden-owned secret.
|
|
openbao:
|
|
namespace: openbao
|
|
token_role: warden-sign
|
|
issuer_policy: credential-broker-warden-sign-issuer
|
|
policies:
|
|
- warden-sign
|
|
disallowed_policies:
|
|
- root
|
|
- platform-admin
|
|
mount_paths:
|
|
- ssh/sign/adm-role
|
|
- ssh/sign/agt-role
|
|
- ssh/sign/atm-role
|
|
- ssh/roles
|
|
ttl:
|
|
default: 15m
|
|
max: 1h
|
|
renewable: false
|
|
requires_human_above: 1h
|
|
actors:
|
|
allowed_types:
|
|
- human-operator
|
|
- approved-agent
|
|
- ci-runner
|
|
required_subject_binding: keycape-or-kubernetes-service-account
|
|
authorization:
|
|
flex_auth_required: false
|
|
flex_auth_mode: optional-preflight
|
|
approval_required: false
|
|
purpose_required: true
|
|
allowed_purpose_examples:
|
|
- flex-auth-openbao-smoke
|
|
- ops-warden-production-sign-smoke
|
|
delivery:
|
|
allowed:
|
|
- exec-env
|
|
- response-wrap
|
|
- local-token-file
|
|
- kubernetes-auth
|
|
preferred: exec-env
|
|
denied:
|
|
- chat
|
|
- state-hub-body
|
|
- git
|
|
- command-line-token-argument
|
|
- llm-prompt
|
|
exec_env:
|
|
variable: VAULT_TOKEN
|
|
child_only: true
|
|
redact_logs: true
|
|
response_wrap:
|
|
ttl: 5m
|
|
unwrap_once: true
|
|
local_token_file:
|
|
directory: .local/credential-leases
|
|
mode: "0600"
|
|
kubernetes_auth:
|
|
mount: auth/kubernetes
|
|
role: credential-broker-warden-sign
|
|
audience: openbao
|
|
service_account_names:
|
|
- credential-broker
|
|
- ops-warden-smoke
|
|
namespaces:
|
|
- openbao
|
|
- ops-warden
|
|
audit:
|
|
openbao_audit_required: true
|
|
state_hub_metadata_allowed: true
|
|
record_secret_values: false
|
|
metadata_fields:
|
|
- grant_id
|
|
- actor
|
|
- subject
|
|
- purpose
|
|
- requested_ttl
|
|
- issued_ttl
|
|
- delivery_mode
|
|
- lease_accessor
|
|
- decision_id
|
|
- status
|
|
revocation:
|
|
required: true
|
|
by_accessor: true
|
|
on_exec_exit: true
|
|
on_denied_request: false
|