feat: admit existing OpenBao catalog lanes
This commit is contained in:
parent
9d383442c8
commit
784be978bf
29 changed files with 1490 additions and 79 deletions
78
catalog/email-connect-transactional.yaml
Normal file
78
catalog/email-connect-transactional.yaml
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0010.
|
||||
id: email-connect-transactional
|
||||
kind: kv
|
||||
org: coulomb
|
||||
repo: email-connect
|
||||
stage: prod
|
||||
description: >-
|
||||
IONOS transactional SMTP identity and the shared user-engine ingest bearer for
|
||||
email-connect. user-engine must never receive the SMTP fields.
|
||||
|
||||
mount: platform
|
||||
path: workloads/email-connect/transactional
|
||||
mount_management: existing
|
||||
fields:
|
||||
- EMAIL_CONNECT_INGEST_TOKEN
|
||||
- EMAIL_CONNECT_SMTP_USERNAME
|
||||
- EMAIL_CONNECT_SMTP_PASSWORD
|
||||
|
||||
consumers:
|
||||
- name: email-connect-runtime
|
||||
auth: token
|
||||
claim: clustersecretstore:openbao-email-connect
|
||||
purpose: sync email-connect-runtime through the namespace-limited ESO store
|
||||
- name: user-engine-ingest-caller
|
||||
auth: shared-bearer-copy
|
||||
claim: service:user-engine
|
||||
purpose: consume only EMAIL_CONNECT_INGEST_TOKEN from its separately managed runtime Secret
|
||||
- name: secrets-engine-operator-exec
|
||||
auth: approle
|
||||
claim: catalog:email-connect-transactional
|
||||
purpose: approved SMTP/ingest smoke in a child process and non-secret verification
|
||||
|
||||
workload_delivery:
|
||||
- mode: external-secrets
|
||||
owner: railiance-platform + email-connect
|
||||
|
||||
delivery_modes: [exec-env, read-check]
|
||||
delivery_auth:
|
||||
method: approle
|
||||
management: engine
|
||||
policy_name: se-prod-email-connect-transactional
|
||||
role_name: se-prod-email-connect-transactional
|
||||
token_ttl: 15m
|
||||
token_max_ttl: 30m
|
||||
secret_id_ttl: 15m
|
||||
secret_id_num_uses: 1
|
||||
token_num_uses: 8
|
||||
|
||||
approval:
|
||||
model: ccr
|
||||
decision_ref: CCR-2026-0010
|
||||
notes: >-
|
||||
CCR-2026-0010 approves the existing workload lane. A live native AppRole
|
||||
apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
|
||||
|
||||
verification:
|
||||
positive: approved delivery AppRole can read each declared field without printing it
|
||||
negative: unrelated token is denied on platform/data/workloads/email-connect/transactional
|
||||
|
||||
risk:
|
||||
classification: high
|
||||
notes: SMTP credentials can send as the platform identity and the ingest bearer authorizes transactional requests
|
||||
|
||||
rotation:
|
||||
owner: railiance-platform + email-connect + user-engine
|
||||
expectation: >-
|
||||
Rotate overlap-first, wait for ESO refresh, roll email-connect and user-engine
|
||||
when the bearer changes, verify health, then revoke the old provider password/bearer.
|
||||
ttl: provider-defined
|
||||
|
||||
deactivation:
|
||||
owner: railiance-platform + email-connect
|
||||
expectation: >-
|
||||
Disable the front door, detach ESO/native read access, remove materialized
|
||||
Secrets, stop email-connect, and revoke the IONOS app password if applicable.
|
||||
|
||||
audit:
|
||||
evidence: CCR id, actor, exact path, field names, ESO refresh timestamp, request ids, and pass/fail only
|
||||
77
catalog/forgejo-admin-api-token.yaml
Normal file
77
catalog/forgejo-admin-api-token.yaml
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0006.
|
||||
id: forgejo-admin-api-token
|
||||
kind: kv
|
||||
org: coulomb
|
||||
repo: railiance-platform
|
||||
stage: prod
|
||||
description: >-
|
||||
Forgejo site-admin PAT and non-secret companion metadata for attended operator
|
||||
and automation tooling. This lane is distinct from Forgejo SMTP credentials.
|
||||
|
||||
mount: platform
|
||||
path: workloads/forgejo/forgejo-admin
|
||||
mount_management: existing
|
||||
fields:
|
||||
- API_TOKEN
|
||||
- API_USER
|
||||
- API_BASE_URL
|
||||
- TOKEN_SCOPES
|
||||
- GENERATED_AT
|
||||
|
||||
consumers:
|
||||
- name: forgejo-platform-operators
|
||||
auth: oidc
|
||||
claim: group:net-kingdom-admins
|
||||
purpose: existing attended reads through forgejo-admin-workload-kv-read
|
||||
- name: forgejo-automation
|
||||
auth: approle
|
||||
claim: catalog:forgejo-admin-api-token
|
||||
purpose: approved package, repository, webhook, and bootstrap commands in a child process
|
||||
|
||||
workload_delivery:
|
||||
- mode: operator-oidc
|
||||
owner: railiance-platform
|
||||
|
||||
delivery_modes: [exec-env, read-check]
|
||||
delivery_auth:
|
||||
method: approle
|
||||
management: engine
|
||||
# Avoid broad-admin name guards while retaining an exact-path read policy.
|
||||
policy_name: se-prod-forgejo-operator-api-token
|
||||
role_name: se-prod-forgejo-operator-api-token
|
||||
token_ttl: 15m
|
||||
token_max_ttl: 30m
|
||||
secret_id_ttl: 15m
|
||||
secret_id_num_uses: 1
|
||||
token_num_uses: 8
|
||||
|
||||
approval:
|
||||
model: ccr
|
||||
decision_ref: CCR-2026-0006
|
||||
notes: >-
|
||||
CCR-2026-0006 approves the existing OIDC/operator lane. A live native
|
||||
AppRole apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
|
||||
|
||||
verification:
|
||||
positive: approved delivery AppRole can read declared fields and an exec smoke authenticates to Forgejo
|
||||
negative: unrelated token is denied on platform/data/workloads/forgejo/forgejo-admin
|
||||
|
||||
risk:
|
||||
classification: high
|
||||
notes: API_TOKEN is a Forgejo site-admin PAT with package, repository, webhook, and operator impact
|
||||
|
||||
rotation:
|
||||
owner: railiance-platform + Forgejo operator
|
||||
expectation: >-
|
||||
Mint a replacement PAT as the site-admin account, update OpenBao, verify all
|
||||
consumers through exec delivery, then delete the old PAT in Forgejo.
|
||||
ttl: provider-defined
|
||||
|
||||
deactivation:
|
||||
owner: railiance-platform + Forgejo operator
|
||||
expectation: >-
|
||||
Disable the front door, detach native/OIDC read access, revoke the PAT in
|
||||
Forgejo, and preserve package/webhook audit evidence.
|
||||
|
||||
audit:
|
||||
evidence: CCR id, actor, exact path, field names, Forgejo token identifier/scopes if non-secret, timestamps, and pass/fail only
|
||||
78
catalog/issue-core-ingestion-api-key.yaml
Normal file
78
catalog/issue-core-ingestion-api-key.yaml
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0002.
|
||||
id: issue-core-ingestion-api-key
|
||||
kind: kv
|
||||
org: coulomb
|
||||
repo: issue-core
|
||||
stage: prod
|
||||
description: >-
|
||||
Runtime credentials for issue-core ingestion and its Forgejo backend. The
|
||||
existing workload path is delivered by ESO; native secrets-engine exec is a
|
||||
separate exact-path AppRole proposed for attended operator/agent use.
|
||||
|
||||
mount: platform
|
||||
path: workloads/issue-core/issue-core/issue-core-runtime
|
||||
mount_management: existing
|
||||
fields:
|
||||
- ISSUE_CORE_API_KEY
|
||||
- GITEA_BACKEND_TOKEN
|
||||
|
||||
consumers:
|
||||
- name: issue-core-runtime
|
||||
auth: kubernetes
|
||||
claim: serviceaccount:external-secrets/external-secrets
|
||||
purpose: sync the issue-core runtime Secret through the namespace-limited ESO store
|
||||
- name: activity-core-issue-sink
|
||||
auth: kubernetes
|
||||
claim: serviceaccount:external-secrets/external-secrets
|
||||
purpose: sync the shared ingestion key for activity-core issue emission
|
||||
- name: secrets-engine-operator-exec
|
||||
auth: approle
|
||||
claim: catalog:issue-core-ingestion-api-key
|
||||
purpose: approved child-process delivery and non-secret verification only
|
||||
|
||||
workload_delivery:
|
||||
- mode: external-secrets
|
||||
owner: railiance-platform + issue-core + activity-core
|
||||
|
||||
delivery_modes: [exec-env, read-check]
|
||||
delivery_auth:
|
||||
method: approle
|
||||
management: engine
|
||||
policy_name: se-prod-issue-core-ingestion-api-key
|
||||
role_name: se-prod-issue-core-ingestion-api-key
|
||||
token_ttl: 15m
|
||||
token_max_ttl: 30m
|
||||
secret_id_ttl: 15m
|
||||
secret_id_num_uses: 1
|
||||
token_num_uses: 8
|
||||
|
||||
approval:
|
||||
model: ccr
|
||||
decision_ref: CCR-2026-0002
|
||||
notes: >-
|
||||
CCR-2026-0002 approves the existing workload lane. A live native AppRole
|
||||
apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
|
||||
|
||||
verification:
|
||||
positive: approved delivery AppRole can read both declared fields without printing them
|
||||
negative: unrelated token is denied on platform/data/workloads/issue-core/issue-core/issue-core-runtime
|
||||
|
||||
risk:
|
||||
classification: high
|
||||
notes: path includes the shared ingestion bearer and the issue-core Forgejo backend token
|
||||
|
||||
rotation:
|
||||
owner: railiance-platform + issue-core + activity-core
|
||||
expectation: >-
|
||||
Update OpenBao first, wait for both ESO consumers, roll issue-core and the
|
||||
activity-core workers, then revoke the replaced provider credential.
|
||||
ttl: provider-defined
|
||||
|
||||
deactivation:
|
||||
owner: railiance-platform + issue-core
|
||||
expectation: >-
|
||||
Disable the front door, detach read access, remove materialized workload
|
||||
Secrets, restart consumers, and preserve non-secret audit evidence.
|
||||
|
||||
audit:
|
||||
evidence: CCR id, actor, exact path, field names, audit request ids, timestamps, and pass/fail only
|
||||
72
catalog/openrouter-llm-connect.yaml
Normal file
72
catalog/openrouter-llm-connect.yaml
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0003.
|
||||
id: openrouter-llm-connect
|
||||
kind: kv
|
||||
org: coulomb
|
||||
repo: llm-connect
|
||||
stage: prod
|
||||
description: >-
|
||||
OpenRouter provider credential used by llm-connect for activity-core. The
|
||||
catalog does not generalize this key to other OpenRouter consumers.
|
||||
|
||||
mount: platform
|
||||
path: workloads/activity-core/llm-connect/llm-connect-provider-secrets
|
||||
mount_management: existing
|
||||
fields:
|
||||
- OPENROUTER_API_KEY
|
||||
|
||||
consumers:
|
||||
- name: llm-connect-activity-core
|
||||
auth: kubernetes
|
||||
claim: serviceaccount:external-secrets/external-secrets
|
||||
purpose: sync llm-connect-provider-secrets for the activity-core deployment
|
||||
- name: secrets-engine-operator-exec
|
||||
auth: approle
|
||||
claim: catalog:openrouter-llm-connect
|
||||
purpose: approved llm-connect smoke in a child process and non-secret verification
|
||||
|
||||
workload_delivery:
|
||||
- mode: external-secrets
|
||||
owner: railiance-platform + llm-connect
|
||||
|
||||
delivery_modes: [exec-env, read-check]
|
||||
delivery_auth:
|
||||
method: approle
|
||||
management: engine
|
||||
policy_name: se-prod-openrouter-llm-connect
|
||||
role_name: se-prod-openrouter-llm-connect
|
||||
token_ttl: 15m
|
||||
token_max_ttl: 30m
|
||||
secret_id_ttl: 15m
|
||||
secret_id_num_uses: 1
|
||||
token_num_uses: 8
|
||||
|
||||
approval:
|
||||
model: ccr
|
||||
decision_ref: CCR-2026-0003
|
||||
notes: >-
|
||||
CCR-2026-0003 approves the existing workload lane. A live native AppRole
|
||||
apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
|
||||
|
||||
verification:
|
||||
positive: approved delivery AppRole can read OPENROUTER_API_KEY without printing it
|
||||
negative: unrelated token is denied on platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets
|
||||
|
||||
risk:
|
||||
classification: high
|
||||
notes: provider key can incur spend and remains valid outside OpenBao until revoked at OpenRouter
|
||||
|
||||
rotation:
|
||||
owner: railiance-platform + llm-connect provider operator
|
||||
expectation: >-
|
||||
Mint a replacement at OpenRouter, update every live cluster copy, wait for
|
||||
ESO refresh, restart llm-connect, verify, and revoke the old provider key.
|
||||
ttl: provider-defined
|
||||
|
||||
deactivation:
|
||||
owner: railiance-platform + llm-connect
|
||||
expectation: >-
|
||||
Disable the front door and workload read path, remove materialized Secrets,
|
||||
stop consumers, and revoke the provider key at OpenRouter.
|
||||
|
||||
audit:
|
||||
evidence: CCR id, actor, exact path, field name, provider key identifier if non-secret, timestamps, and pass/fail only
|
||||
77
catalog/reuse-surface-hub-write-token.yaml
Normal file
77
catalog/reuse-surface-hub-write-token.yaml
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0005.
|
||||
id: reuse-surface-hub-write-token
|
||||
kind: kv
|
||||
org: coulomb
|
||||
repo: reuse-surface
|
||||
stage: prod
|
||||
description: >-
|
||||
Production federation-hub write bearer and Forgejo webhook HMAC. ESO remains
|
||||
the workload delivery path; native exec is a separate exact-path AppRole.
|
||||
|
||||
mount: platform
|
||||
path: workloads/reuse/reuse-surface/runtime-secrets
|
||||
mount_management: existing
|
||||
fields:
|
||||
- REUSE_SURFACE_TOKEN
|
||||
- REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
||||
|
||||
consumers:
|
||||
- name: reuse-surface-runtime
|
||||
auth: kubernetes
|
||||
claim: serviceaccount:external-secrets/external-secrets
|
||||
purpose: sync reuse-surface-env through the namespace-limited ESO store
|
||||
- name: forgejo-coulomb-org-webhook
|
||||
auth: shared-hmac
|
||||
claim: forgejo-org:coulomb
|
||||
purpose: share the webhook HMAC with the reuse-surface receiver
|
||||
- name: secrets-engine-operator-exec
|
||||
auth: approle
|
||||
claim: catalog:reuse-surface-hub-write-token
|
||||
purpose: approved hub tooling in a child process and non-secret verification
|
||||
|
||||
workload_delivery:
|
||||
- mode: external-secrets
|
||||
owner: railiance-platform + reuse-surface + railiance-apps
|
||||
|
||||
delivery_modes: [exec-env, read-check]
|
||||
delivery_auth:
|
||||
method: approle
|
||||
management: engine
|
||||
policy_name: se-prod-reuse-surface-hub-write-token
|
||||
role_name: se-prod-reuse-surface-hub-write-token
|
||||
token_ttl: 15m
|
||||
token_max_ttl: 30m
|
||||
secret_id_ttl: 15m
|
||||
secret_id_num_uses: 1
|
||||
token_num_uses: 8
|
||||
|
||||
approval:
|
||||
model: ccr
|
||||
decision_ref: CCR-2026-0005
|
||||
notes: >-
|
||||
CCR-2026-0005 approves the existing workload lane. A live native AppRole
|
||||
apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
|
||||
|
||||
verification:
|
||||
positive: approved delivery AppRole can read both declared fields without printing them
|
||||
negative: unrelated token is denied on platform/data/workloads/reuse/reuse-surface/runtime-secrets
|
||||
|
||||
risk:
|
||||
classification: high
|
||||
notes: hub writes affect the production federation index and the HMAC has two coordinated consumers
|
||||
|
||||
rotation:
|
||||
owner: railiance-platform + reuse-surface + railiance-apps
|
||||
expectation: >-
|
||||
Patch OpenBao, force ESO refresh, roll reuse-surface, and reconfigure the
|
||||
Forgejo org webhook whenever its HMAC changes.
|
||||
ttl: rotate-on-compromise
|
||||
|
||||
deactivation:
|
||||
owner: railiance-platform + reuse-surface
|
||||
expectation: >-
|
||||
Disable the front door, detach ESO access, and remove the materialized
|
||||
Secret only after confirming decommission or break-glass posture.
|
||||
|
||||
audit:
|
||||
evidence: CCR id, actor, exact path, field names, ESO refresh timestamp, request ids, and pass/fail only
|
||||
Loading…
Add table
Add a link
Reference in a new issue