On this page
WP-03 Trust & Secret Services
Summary
Provide shared secrets, certificates, and key-management services for the platform.
Scope
- Deliver centralized secrets, certificates, and key-management services as a shared platform baseline.
- Integrate secret synchronization patterns for in-cluster workloads with rotation and audit controls.
- Define approved break-glass procedures and evidence requirements for emergency access.
Architecture Context
- Domain architecture index: Security Architecture
- OpenShift runtime context where relevant: Platform Architecture
Decision Context
Dependencies
- No hard package dependency is currently recorded.
- Delivery coordination is required with wp-05-observability-and-incident-response, wp-06-security-posture-and-hardening, and wp-12-database-as-a-service-dbaas.
Acceptance Criteria
- No secret values are committed to Git in scope repositories.
- Secret-scanning enforcement and audit evidence are retained.
- Centrally managed application/configuration secrets are sourced from Secrets Management (ABB) via openbao and ESO.
- Synchronized values are materialized in-cluster as Kubernetes Secret objects with etcd encryption at rest, RBAC least privilege, rotation, audit logging, and documented break-glass controls (validated as platform prerequisites for this package).
- Certificate renewals are automated with alerting on failure.