coulomb/reef-railiance
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Start Qonto workload identity gate

Browse source
This commit is contained in:
codex 2026-07-27 02:08:54 +02:00
parent 269d922631
commit 0a4f4b9de6
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -21,7 +21,7 @@
| task | REEF-RAILIANCE-WP-0002-T04 | cancel | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
| task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
| task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
| task | REEF-RAILIANCE-WP-0003-T01 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T01 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
| task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |

7
workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
View file

@ -18,7 +18,7 @@ state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d"
```task
id: REEF-RAILIANCE-WP-0003-T01
status: todo
status: progress
priority: high
state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d"
```
@ -26,6 +26,11 @@ state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d"
Establish the `rapp-qonto` identity and OpenBao-backed ExternalSecret lane
without exposing credential values.
2026-07-27: ops-mason surveyed live OpenBao state and produced reviewed plan
`rapp-qonto-openbao-kubernetes-lane`. It reuses the existing exact-scope Qonto
policy, replaces the draft static-token store with Kubernetes authentication,
and awaits the mandatory structural-access approval before build.
## T02 - Enforce restricted Qonto egress
```task