generated from coulomb/repo-seed
tegwick
1237cc767b
Add platform-secret playbooks for issue-core ingestion, OpenRouter llm-connect, object-storage STS, and database dynamic credentials. Extend the routing catalog with draft entries and implement `warden route list --stale` for quarterly drift review. Document the review cadence in AccessRouting and mark the workplan finished.
102 lines
3.2 KiB
Markdown
102 lines
3.2 KiB
Markdown
# Database Dynamic Credentials — OpenBao
|
||
|
||
Date: 2026-06-24
|
||
Workplan: WARDEN-WP-0012 T4
|
||
Catalog: `database-dynamic-credentials` (draft until engine ships)
|
||
|
||
Pointer playbook for short-lived database passwords issued by OpenBao dynamic
|
||
secret engines (e.g. CNPG-managed PostgreSQL). ops-warden does not issue DB
|
||
credentials — custody and engine configuration belong to `railiance-platform`;
|
||
consumers request credentials through approved paths after flex-auth policy where
|
||
required.
|
||
|
||
---
|
||
|
||
## Owners
|
||
|
||
| Concern | Owner repo | Authoritative doc |
|
||
| --- | --- | --- |
|
||
| OpenBao database engine, paths, policies | `railiance-platform` | `docs/openbao.md`, `workplans/RAIL-PL-WP-0002-openbao-platform-secrets-service.md` |
|
||
| Authorization before sensitive reads | `flex-auth` | `INTENT.md` |
|
||
| Application connection and lease handling | Owning app repo | App-specific deployment docs |
|
||
|
||
---
|
||
|
||
## Do not ask ops-warden
|
||
|
||
```bash
|
||
warden route show openbao-api-key --json
|
||
warden route show database-dynamic-credentials --json # after promotion
|
||
```
|
||
|
||
Never paste DB passwords, connection strings with credentials, or root DB admin
|
||
tokens in Git, State Hub, logs, or agent chat.
|
||
|
||
---
|
||
|
||
## Platform path convention
|
||
|
||
From `railiance-platform/docs/openbao.md`:
|
||
|
||
```text
|
||
platform/databases/<consumer>
|
||
```
|
||
|
||
Dynamic credentials are issued via OpenBao database secrets engine roles — not
|
||
static KV copies. Coordinate the exact mount and role name with platform before
|
||
wiring workloads.
|
||
|
||
**Promotion gate:** catalog entry stays `status: draft` until the database
|
||
secrets engine and consumer role exist in the live cluster.
|
||
|
||
---
|
||
|
||
## Worker checklist
|
||
|
||
### 1. Confirm need type
|
||
|
||
- [ ] Short-lived DB password (dynamic) vs long-lived KV secret — prefer dynamic
|
||
- [ ] Target database identified (CNPG cluster, service name, database name)
|
||
- [ ] flex-auth policy requires approval for this read (if tenant policy says so)
|
||
|
||
### 2. Platform provisioning (operator)
|
||
|
||
- [ ] Database secrets engine configured with least-privilege creation statements
|
||
- [ ] Role TTL aligned to workload session (minutes–hours, not days)
|
||
- [ ] Path registered under `platform/databases/<consumer>`
|
||
- [ ] Audit logging enabled on secret access
|
||
|
||
### 3. Workload consumption
|
||
|
||
- [ ] App uses ESO or CSI to materialize username/password into K8s Secret
|
||
- [ ] Connection pool handles credential rotation before lease expiry
|
||
- [ ] No hard-coded passwords in Helm values or ConfigMaps
|
||
|
||
### 4. Verify
|
||
|
||
- [ ] App connects with issued credentials
|
||
- [ ] Lease renewal or re-read succeeds before expiry
|
||
- [ ] Revocation on pod teardown (if policy requires)
|
||
|
||
### 5. Rotation / revocation
|
||
|
||
- [ ] OpenBao revokes lease on role change
|
||
- [ ] Platform operator documents break-glass DB admin path separately (not via warden)
|
||
|
||
---
|
||
|
||
## Owner-repo next actions
|
||
|
||
| Repo | Action |
|
||
| --- | --- |
|
||
| `railiance-platform` | Configure database secrets engine, roles, and policies |
|
||
| Owning application | Wire ESO/CSI and connection handling for lease TTL |
|
||
| `flex-auth` | Policy for database credential requests (if gated) |
|
||
|
||
---
|
||
|
||
## See also
|
||
|
||
- `railiance-platform/docs/openbao.md`
|
||
- `railiance-platform/workplans/RAIL-PL-WP-0002-openbao-platform-secrets-service.md`
|
||
- `wiki/CredentialRouting.md#routing-table` |