Provision public OpenBao workload identities through protected Terraform #105

Merged

gitchegumi merged 1 commit from kiyi/terraform-openbao-identities into main

2026-10-15 15:49:10 -05:00

kiyi commented

2026-10-15 15:31:52 -05:00

Member

The reserved openbao-identities selector uses a library-owned Seaweed backend/root contract and the owning repository’s public declarations/observed claims. It reuses protected main/actor gates, OIDC/OpenBao login and session revocation, private locked plan fingerprint/re-plan/saved-plan apply, convergence and recovery. It fetches only the selected state key credential; no S3 application provider or runtime secret. Existing storage/bootstrap paths and every workflow/job/status name remain unchanged.

Exact names, policies, subject/audience/IDs/workflow/ref/event, TTLs and existing-account engine scopes are checked against the reviewed declaration. Shared mounts, Core identities and runner self-management are excluded. An unmanaged existing name requires explicit import; permission denial is not absence. Routine deletion/replacement is rejected. Only a retained temporary disabled declaration permits deletion of its matching prior JWT/policy; it cannot own an engine role.

Validation: 45 credential-free Terraform delivery/catalog/bootstrap/identity tests passed; workflow reference tests and channel static compilation passed. Three existing channel shell-execution scenarios remain blocked by Windows shell/Python fixture behavior; hosted Linux library checks are required. Native Gitleaks 8.30.1 and diff checks passed. No live provisioning/release/deployment performed.

Merge this with any compatible workflow changes, publish one release, then promote stable-v1 before the new owning Terraform caller is dispatched. v1.40.0 does not contain this profile. The central Terraform runner still needs one reviewed initial trust/state setup; no CI administrator token is introduced.

Add the missing identity-management profile to the existing protected Terraform implementation, so workload OpenBao policy/JWT/issuance-role setup can be declared in IaC rather than repeated manually. Companion: [terraform-modules #12](https://git.gitchegumi.com/Homelab/terraform-modules/pulls/12); first consumer: [platform #128](https://git.gitchegumi.com/Homelab/platform/pulls/128). The reserved `openbao-identities` selector uses a library-owned Seaweed backend/root contract and the owning repository’s public declarations/observed claims. It reuses protected main/actor gates, OIDC/OpenBao login and session revocation, private locked plan fingerprint/re-plan/saved-plan apply, convergence and recovery. It fetches only the selected state key credential; no S3 application provider or runtime secret. Existing storage/bootstrap paths and every workflow/job/status name remain unchanged. Exact names, policies, subject/audience/IDs/workflow/ref/event, TTLs and existing-account engine scopes are checked against the reviewed declaration. Shared mounts, Core identities and runner self-management are excluded. An unmanaged existing name requires explicit import; permission denial is not absence. Routine deletion/replacement is rejected. Only a retained temporary disabled declaration permits deletion of its matching prior JWT/policy; it cannot own an engine role. Validation: 45 credential-free Terraform delivery/catalog/bootstrap/identity tests passed; workflow reference tests and channel static compilation passed. Three existing channel shell-execution scenarios remain blocked by Windows shell/Python fixture behavior; hosted Linux library checks are required. Native Gitleaks 8.30.1 and diff checks passed. No live provisioning/release/deployment performed. Merge this with any compatible workflow changes, publish one release, then promote `stable-v1` before the new owning Terraform caller is dispatched. v1.40.0 does not contain this profile. The central Terraform runner still needs one reviewed initial trust/state setup; no CI administrator token is introduced.

kiyi added 1 commit

2026-10-15 15:31:52 -05:00

Provision public OpenBao workload identities through protected Terraform

Workflow acceptance / acceptance (pull_request) Successful in 1m41s

Details

Repository security / security-1 (pull_request) Successful in 3m53s

Details

Library checks / tests (pull_request) Successful in 4m13s

Details

102e35f703

portegumi approved these changes

2026-10-15 15:33:20 -05:00

portegumi left a comment

Source review of 102e35f703: the reserved openbao-identities selector uses the library-owned Seaweed state profile and state credential only, retaining the protected dispatch/session and locked, fingerprint-bound plan/apply. The new identity validator constrains exact JWT claims, declared policy/TTL and existing-account Kubernetes role scope; creation probes distinguish unowned names from access failures, and routine deletion/replacement is rejected. The changed tests exercise these positive/negative guards. No UDS gateway, route, deployment package, admission policy or controller is modified; actual OpenBao/provider and live workload compatibility remain first-use acceptance, not established by mocked tests. This is source-only approval, not release or merge readiness: Library checks, Workflow acceptance and Repository security are pending at review time. Keep required checks and companion caller/release promotion gates before use.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review of 102e35f703e077c53ff0178f378ba6746ca7d17e: the reserved openbao-identities selector uses the library-owned Seaweed state profile and state credential only, retaining the protected dispatch/session and locked, fingerprint-bound plan/apply. The new identity validator constrains exact JWT claims, declared policy/TTL and existing-account Kubernetes role scope; creation probes distinguish unowned names from access failures, and routine deletion/replacement is rejected. The changed tests exercise these positive/negative guards. No UDS gateway, route, deployment package, admission policy or controller is modified; actual OpenBao/provider and live workload compatibility remain first-use acceptance, not established by mocked tests. This is source-only approval, not release or merge readiness: Library checks, Workflow acceptance and Repository security are pending at review time. Keep required checks and companion caller/release promotion gates before use. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.