77 lines
2.5 KiB
YAML
77 lines
2.5 KiB
YAML
# NON-SECRET catalog metadata derived from railiance-platform CCR-2026-0005.
|
|
id: reuse-surface-hub-write-token
|
|
kind: kv
|
|
org: coulomb
|
|
repo: reuse-surface
|
|
stage: prod
|
|
description: >-
|
|
Production federation-hub write bearer and Forgejo webhook HMAC. ESO remains
|
|
the workload delivery path; native exec is a separate exact-path AppRole.
|
|
|
|
mount: platform
|
|
path: workloads/reuse/reuse-surface/runtime-secrets
|
|
mount_management: existing
|
|
fields:
|
|
- REUSE_SURFACE_TOKEN
|
|
- REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
|
|
|
consumers:
|
|
- name: reuse-surface-runtime
|
|
auth: kubernetes
|
|
claim: serviceaccount:external-secrets/external-secrets
|
|
purpose: sync reuse-surface-env through the namespace-limited ESO store
|
|
- name: forgejo-coulomb-org-webhook
|
|
auth: shared-hmac
|
|
claim: forgejo-org:coulomb
|
|
purpose: share the webhook HMAC with the reuse-surface receiver
|
|
- name: secrets-engine-operator-exec
|
|
auth: approle
|
|
claim: catalog:reuse-surface-hub-write-token
|
|
purpose: approved hub tooling in a child process and non-secret verification
|
|
|
|
workload_delivery:
|
|
- mode: external-secrets
|
|
owner: railiance-platform + reuse-surface + railiance-apps
|
|
|
|
delivery_modes: [exec-env, read-check]
|
|
delivery_auth:
|
|
method: approle
|
|
management: engine
|
|
policy_name: se-prod-reuse-surface-hub-write-token
|
|
role_name: se-prod-reuse-surface-hub-write-token
|
|
token_ttl: 15m
|
|
token_max_ttl: 30m
|
|
secret_id_ttl: 15m
|
|
secret_id_num_uses: 1
|
|
token_num_uses: 8
|
|
|
|
approval:
|
|
model: ccr
|
|
decision_ref: CCR-2026-0005
|
|
notes: >-
|
|
CCR-2026-0005 approves the existing workload lane. A live native AppRole
|
|
apply remains gated by SECRETS-WP-0006-T05 review and operator approval.
|
|
|
|
verification:
|
|
positive: approved delivery AppRole can read both declared fields without printing them
|
|
negative: unrelated token is denied on platform/data/workloads/reuse/reuse-surface/runtime-secrets
|
|
|
|
risk:
|
|
classification: high
|
|
notes: hub writes affect the production federation index and the HMAC has two coordinated consumers
|
|
|
|
rotation:
|
|
owner: railiance-platform + reuse-surface + railiance-apps
|
|
expectation: >-
|
|
Patch OpenBao, force ESO refresh, roll reuse-surface, and reconfigure the
|
|
Forgejo org webhook whenever its HMAC changes.
|
|
ttl: rotate-on-compromise
|
|
|
|
deactivation:
|
|
owner: railiance-platform + reuse-surface
|
|
expectation: >-
|
|
Disable the front door, detach ESO access, and remove the materialized
|
|
Secret only after confirming decommission or break-glass posture.
|
|
|
|
audit:
|
|
evidence: CCR id, actor, exact path, field names, ESO refresh timestamp, request ids, and pass/fail only
|