chore(m04): decide safe-session Vault signer future before Vault sunset #609

New issue

Closed

opened 2026-05-29 19:01:07 +02:00 by codex · 0 comments

codex commented

2026-05-29 19:01:07 +02:00

Collaborator

Context

#607 Phase 1 metadata-only Vault inventory found that live HashiCorp Vault on rs2000 does not expose a general KV secret/ engine.

Observed metadata-only shape:

secret engines: cubbyhole/, identity/, ssh/, sys/
policy: safe-session-signer
AppRole: safe-session-api
SSH role: safe-session

The repo also models safe-session-api as active with upstream dependency vault.

Scope

Decide what should happen to the safe-session subsystem before any Vault sunset continues.

Acceptance criteria

Decide whether safe-session-api and safe-session-web still provide value.
If keeping them, document Vault as a narrow internal SSH signer, not a general legacy secret manager.
If retiring them, create a separate runtime-gated retirement plan covering safe-session-api, safe-session-web, vault, and vault-bootstrap together.
Do not stop Vault from this issue.
Do not delete Vault volumes.
Do not rotate or expose Vault tokens.
Do not mirror anything to Infisical unless a later issue identifies actual KV secrets.

Out of scope

Vault shutdown.
Safe-session runtime changes.
Infisical writes.
Secret value reads.

Notes

Infisical remains the canonical platform secret backend. This issue exists because Vault is currently serving a different function: SSH certificate/signing support for safe-session.

## Context #607 Phase 1 metadata-only Vault inventory found that live HashiCorp Vault on `rs2000` does not expose a general KV `secret/` engine. Observed metadata-only shape: ```text secret engines: cubbyhole/, identity/, ssh/, sys/ policy: safe-session-signer AppRole: safe-session-api SSH role: safe-session ``` The repo also models `safe-session-api` as active with upstream dependency `vault`. ## Scope Decide what should happen to the `safe-session` subsystem before any Vault sunset continues. ## Acceptance criteria - Decide whether `safe-session-api` and `safe-session-web` still provide value. - If keeping them, document Vault as a narrow internal SSH signer, not a general legacy secret manager. - If retiring them, create a separate runtime-gated retirement plan covering `safe-session-api`, `safe-session-web`, `vault`, and `vault-bootstrap` together. - Do not stop Vault from this issue. - Do not delete Vault volumes. - Do not rotate or expose Vault tokens. - Do not mirror anything to Infisical unless a later issue identifies actual KV secrets. ## Out of scope - Vault shutdown. - Safe-session runtime changes. - Infisical writes. - Secret value reads. ## Notes Infisical remains the canonical platform secret backend. This issue exists because Vault is currently serving a different function: SSH certificate/signing support for `safe-session`.

Rows
Columns