f3ba7ca882
Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the field name is corrected to CLIENT_SECRET for the platform uppercase convention and the CCR validator. Kubernetes delivery references are confirmed against the live sso namespace. Attended authority is the governed openbao-platform-admin-login lane, and the rollout is one attended window ordered after the Authelia issuer precondition. Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05. Nothing is applied and no value exists: both CCRs remain proposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
# CCR-2026-0017 / CCR-2026-0018 (KEY-WP-0013-T02, RPF-WP-0035-T05).
|
|
# KeyCape-side delivery of the two approval-engine confidential client secrets.
|
|
# The Kubernetes Secret key stays client-secret to match the live
|
|
# KEYCAPE_RAPP_QONTO_CLIENT_SECRET secretKeyRef shape; the OpenBao field is
|
|
# CLIENT_SECRET because KV field names are uppercase by platform convention.
|
|
#
|
|
# Apply only after the stores sync and inside the agreed attended rollout window;
|
|
# the KeyCape image that reads both environment names rolls out after these sync.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: keycape-secrets-engine-approval-client
|
|
namespace: sso
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-keycape-secrets-engine-approval
|
|
target:
|
|
name: keycape-secrets-engine-approval-client
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
- secretKey: client-secret
|
|
remoteRef:
|
|
key: workloads/secrets-engine/approval-client
|
|
property: CLIENT_SECRET
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: keycape-approval-engine-operator-client
|
|
namespace: sso
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-keycape-approval-engine-operator
|
|
target:
|
|
name: keycape-approval-engine-operator-client
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
- secretKey: client-secret
|
|
remoteRef:
|
|
key: workloads/approval-engine/operator-client
|
|
property: CLIENT_SECRET
|