coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add native rotate and persistent lane overlay states
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
rotate replaces one declared KV field through the merge-safe patch path
and never prints the value. Overlay states active/suspended/deactivated/
compromised live under the evidence directory. compromise/reactivate and
successful suspend/deactivate/revoke update that overlay; exec/wrap/
handoff/provision refuse non-active lanes. Provider-side rotation stays
with rotation.owner. Production remains fail-closed.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-02 13:09:10 +02:00
parent 85d4548035
commit 72d3327c28
12 changed files with 596 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/cli.md
View file

@ -53,6 +53,7 @@ secrets-engine decision inspect <decision-or-ccr-id>
secrets-engine plan <ref> --stage <build|test|prod>
secrets-engine apply <ref> --stage <stage> [--dry-run] [--bootstrap-token-file F]
secrets-engine provision <catalog-id> --stage <stage> --field NAME (--from-file F | --generate)
secrets-engine rotate <catalog-id> --stage <stage> --field NAME --from-file F [--dry-run]
secrets-engine verify <catalog-id> [--field NAME] [--positive] [--negative] [--negative-token-file F]
secrets-engine handoff <catalog-id> --stage <stage> --role-id-file F --secret-id-file F
secrets-engine wrap <catalog-id> --out F [--ttl 15m]
@ -64,6 +65,9 @@ secrets-engine session revoke (--accessor-file F | --lease-id-file F) [--stage s
secrets-engine lifecycle suspend <catalog-id> [--dry-run]
secrets-engine lifecycle deactivate <catalog-id> [--dry-run]
secrets-engine lifecycle destroy <catalog-id> [--dry-run] [--confirm-destroy <catalog-id>]
secrets-engine lifecycle compromise <catalog-id> [--reason TEXT] [--dry-run]
secrets-engine lifecycle reactivate <catalog-id> [--dry-run]
secrets-engine state show <catalog-id> [--json]
secrets-engine audit <catalog-id> [--json]
secrets-engine secret-use snapshot [--catalog-id ID] [--json]
```
@ -117,6 +121,15 @@ All three preserve externally managed auth and workload delivery. The legacy
`revoke` command is a compatibility alias for safe native deactivation, never
KV destruction.
`rotate` replaces one declared KV field through the same merge-safe patch as
provision. It does not roll ESO/consumers or revoke a provider credential;
that remains `rotation.owner`. Auth-capability lanes use wrap/handoff instead.
`lifecycle compromise` / `reactivate` and successful suspend/deactivate/revoke
write a non-secret overlay under the evidence directory. `state show` reads it.
exec/wrap/handoff/provision refuse non-active overlay states; rotate is still
allowed on compromised lanes. Overlay state does not recreate OpenBao objects.
`exec --mode exec-file` writes the selected field to a mode-0600 temp file and
sets `{FIELD}_FILE` to that path for the child only. The file is overwritten
and unlinked after the child exits. The value is not copied into the child