Secrets and Identity: Project Plan #
Secrets and identity services for the mobile site, one of three plans with the Extended Management Plane and Observability.
- GitHub: https://github.com/deevnet/ansible-collection-deevnet.mgmt
- Documentation: https://deevnet.github.io/deevnet-docs/
Roadmap item: Secrets and Identity
✓ 3 |
↻ 2 |
⏳ 4
(9 total)
Legend: ✅ Complete | 🔄 In Progress | ⏳ Planned
Project Vision & Scope #
In Scope
- Secrets management
- Identity and access management
Out of Scope
- External identity federation (future phase)
Secrets Management 🔄 #
OpenBao on dv02idn001v01, unsealed by a key ansible-vault delivers, which stays the root of trust
(
ADR-0016).
- ✅ Migrate IaC secrets from env var lookups to Ansible Vault in inventory
- ✅ Evaluate dedicated secrets solutions: OpenBao ( ADR-0016)
- ✅ Deploy secrets management service ( CHG-0010)
- 🔄 Integrate consumers: the Deevnet API reads its backend credentials at start ( CHG-0010), and image-factory and tenant-fabric builds fetch the Proxmox token per run, with nothing on the Builder’s disk ( CHG-0026). Ansible administers OpenBao through its own AppRole, but most playbook secrets are still read from ansible-vault in inventory
- ⏳ Define secrets rotation policies ( Credential Rotation)
Identity Management 🔄 #
- 🔄 Evaluate identity solutions: Keycloak, with a realm per tenant, proposed in ADR-0025
- ⏳ Deploy identity provider
- ⏳ Configure SSO for infrastructure services
- ⏳ Define RBAC policies