dfc1641c49
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
62 lines
2.3 KiB
Markdown
62 lines
2.3 KiB
Markdown
---
|
|
id: RPF-WP-0037
|
|
type: workplan
|
|
title: "Recover three active ESO lanes from static-token authentication failure"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: active
|
|
owner: codex
|
|
created: "2026-09-05"
|
|
updated: "2026-09-05"
|
|
state_hub_workstream_id: "df076911-18b4-5731-99a8-2ecb3c3cc5b3"
|
|
---
|
|
|
|
User authorized continuing with the identified delivery failures. Live metadata
|
|
confirms active Forgejo, reuse-surface and target-revenue consumers. All three
|
|
ClusterSecretStores fail OpenBao token lookup-self with 403. This plan repairs
|
|
delivery authentication; it does not rotate application credentials or restart
|
|
consumers. RPF-WP-0036-T04 retains the separate telemetry acceptance gate.
|
|
|
|
## Diagnose authentication and compare custody without exposing values
|
|
|
|
```task
|
|
id: RPF-WP-0037-T01
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "e0e7ff05-01bf-58db-a18e-4c5e48a697fc"
|
|
```
|
|
|
|
Use attended platform-admin and pinned cluster access. Capture token validity,
|
|
policy coordinates and boolean equality between native KV data and the existing
|
|
consumer Secret. No values, tokens, hashes or fingerprints in evidence. Stop
|
|
before any resync if custody disagrees with the deployed Secret.
|
|
|
|
## Replace static authentication with exact Kubernetes bindings
|
|
|
|
```task
|
|
id: RPF-WP-0037-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "01dd799d-f967-57d6-9cf0-9b01971e5bf1"
|
|
```
|
|
|
|
Stage dedicated namespace/SA/audience-bound roles with 15-minute maximum TTL,
|
|
no default policy and exact KV data read plus token self-lookup/revocation.
|
|
Keep namespace restrictions and existing delivery paths. Refuse live drift.
|
|
Validate positive read and wrong-identity/sibling/write denial before changing
|
|
each store. Persist source before apply. Do not overwrite workload key material.
|
|
|
|
## Verify sustained delivery and record closure
|
|
|
|
```task
|
|
id: RPF-WP-0037-T03
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "ee47707c-289b-5bea-a2ad-fdf40fed7034"
|
|
```
|
|
|
|
Require Ready stores and ExternalSecrets, a second successful forced reconcile,
|
|
unchanged deployed key material and healthy consumers. Record safe receipts and
|
|
retire obsolete bootstrap instructions. Remove obsolete static token references
|
|
from stores; retain old token Secret objects until their invalidity is proven.
|
|
Commit and synchronize file-backed work and report any remaining gates.
|