coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind platform OpenBao service identity to tenant zero
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0
This commit is contained in:
tegwick 2026-09-27 16:43:31 +02:00
parent cbe218b26a
commit f0d82908e9
6 changed files with 35 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/secrets_engine/authorization.py
View file

@ -36,11 +36,9 @@ DIGEST_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
#: the vendored replay fixtures in ``tests/test_decision_replay.py`` instead of
#: being left to a deployment to supply correctly.
#:
#: This is not the KeyCape JWT tenant. ``service_auth.TENANT`` is
#: ``tenant:coulomb``, which is the exact value this package denies. Whether
#: those name one tenant or two layers is an open owner question -- see
#: ``docs/tenant-alignment.md`` -- and is deliberately not resolved by reusing
#: one constant for both.
#: Operator clarification, 2026-09-27: the platform infrastructure identity
#: also belongs to tenant:platform. Keep audience-specific profile validation;
#: matching tenant strings do not grant cross-audience or workload authority.
REQUEST_TENANT = "tenant:platform"
SCHEMA_VERSION = "0.1"