12 lines
907 B
Markdown
12 lines
907 B
Markdown
# Credential onboarding
|
|
|
|
Do not put credential values in this file, Git, generated configuration, command arguments, terminal history, or logs.
|
|
|
|
1. Obtain written authorization for `<credential-purpose>`, `<consumer-inventory>`, `<approved-scope>`, and `<rotation-window>`.
|
|
2. Have the authorized operator enter `<credential-value>` only through the approved secure prompt or standard input boundary.
|
|
3. Store it only in the configured SOPS-encrypted operational-secrets file, then reseed and verify OpenBao before changing consumers.
|
|
4. Keep the previous credential active only for the approved overlap window; revoke it only after every consumer check succeeds.
|
|
5. Record `<credential-identifier>`, `<timestamp>`, `<operator>`, and `<status>` without recording any credential value.
|
|
|
|
See [docs/secrets.md](docs/secrets.md) and [docs/runbooks/credential-rotation.md](docs/runbooks/credential-rotation.md).
|