From 9abe2ac8202f5a5ad8e6db728251787151cd388f Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sun, 27 Sep 2026 18:36:42 +0200 Subject: [PATCH] feat(openbao): secret-exists-check policy for Argus and Atlas Argus and Atlas need to verify that a cluster secret exists (for example before reviewing or merging a PR that consumes it through an ExternalSecret) without being able to read its value. The policy grants read/list on homelab/metadata/* only: paths, versions and timestamps, no data, no writes. Whole tree, per owner decision. Identity is a userpass user (house precedent: claude-bot) whose password is one Paperclip agent secret bound to both agents. Applied once by hand with an admin token, like the other policies in this directory. Co-Authored-By: Claude Opus 5.5 --- .../openbao/policies/secret-exists-check.hcl | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 kubernetes/infrastructure/openbao/policies/secret-exists-check.hcl diff --git a/kubernetes/infrastructure/openbao/policies/secret-exists-check.hcl b/kubernetes/infrastructure/openbao/policies/secret-exists-check.hcl new file mode 100644 index 00000000..e6e16123 --- /dev/null +++ b/kubernetes/infrastructure/openbao/policies/secret-exists-check.hcl @@ -0,0 +1,21 @@ +# OpenBao policy: secret-exists-check +# +# Lets the Paperclip agents Argus and Atlas check whether a secret exists in the +# `homelab` KV v2 mount (paths, versions, timestamps) without reading any value. +# Metadata only: no access to homelab/data/*, no writes. +# +# Identity: userpass user `agent-secret-check`. Its password is a Paperclip +# agent secret bound to Argus and Atlas. +# +# NOT applied by Flux. Apply ONCE with an admin token: +# +# bao policy write secret-exists-check kubernetes/infrastructure/openbao/policies/secret-exists-check.hcl +# bao write auth/userpass/users/agent-secret-check \ +# password= token_policies=secret-exists-check \ +# token_ttl=1h token_max_ttl=4h +# +# Check: `bao kv metadata get homelab/` succeeds, `bao kv get homelab/` is denied. + +path "homelab/metadata/*" { + capabilities = ["read", "list"] +} -- 2.54.0