coulomb/ops-warden
Archived
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate reuse-surface hub token lane to OpenBao handoff

Browse Source 
RAILIANCE-WP-0011-T03: point reuse-surface-hub-write-token catalog,
playbook, and tests at bao kv get on platform/workloads/reuse/reuse-surface/runtime-secrets;
kubectl documented as break-glass only.
This commit is contained in:
Bernd Worsch
2026-07-07 22:38:45 +02:00
parent 3ddccaf701
commit 1e6c4eedf1
5 changed files with 61 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
registry/routing/catalog.yaml
View File

@@ -216,21 +216,25 @@ entries:
- id: reuse-surface-hub-write-token
title: reuse-surface federation hub write bearer token
need_keywords: [reuse-surface, reuse_surface, hub, register, federation, write, token, bearer, REUSE_SURFACE_TOKEN, reuse.coulomb.social]
owner_repo: reuse-surface
subsystem: reuse-surface federation hub
need_keywords: [reuse-surface, reuse_surface, hub, register, federation, write, token, bearer, REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET, reuse.coulomb.social]
owner_repo: railiance-platform
subsystem: OpenBao + reuse-surface
warden_executes: false
wiki_ref: wiki/playbooks/reuse-surface-hub-write-token.md#worker-checklist
canon_ref: reuse-surface/specs/FederationHubAPI.md
reviewed: "2026-07-07"
status: active
# Concrete, owner-confirmed lane — REUSE-WP-0011 / RAILIANCE-WP-0007 (hub live
# 2026-06-15): token is the cluster Secret reuse-surface-env on Railiance01,
# not OpenBao. warden access proxies kubectl as the caller and never holds the value.
auth_method: "kubectl with Railiance01 kubeconfig (~/.kube/config-hosteurope)"
path_template: "reuse/reuse-surface-env"
fetch_command: "kubectl --kubeconfig ~/.kube/config-hosteurope get secret reuse-surface-env -n reuse -o jsonpath='{.data.REUSE_SURFACE_TOKEN}' | base64 -d"
# Concrete, owner-confirmed lane — railiance-platform CCR-2026-0005 / RAILIANCE-WP-0011
# (promoted 2026-07-07): policy workload-kv-read-reuse-surface-runtime; ExternalSecret
# reuse/reuse-surface-runtime SecretSynced to reuse-surface-env on Railiance01;
# positive + negative access verified. Production consumer is ESO; warden access
# proxies reads as the caller and never holds the value.
auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-reuse-surface-runtime)"
path_template: "platform/workloads/reuse/reuse-surface/runtime-secrets"
fetch_command: "bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets"
policy_ref: "flex-auth check secret.read:reuse"
exec_capable: true
resolvable: true
lane: secret
- id: openrouter-llm-connect