tegwick
0ced2995ee
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine - cmd/flex-auth: prints the rename and exits 2, with a test - image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside; live pins pass only args, so their next roll is unaffected - Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans, decisions and ADRs left as written - runtime names (module, audience, k8s, image package, /opt paths) unchanged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
64 lines
3 KiB
Markdown
64 lines
3 KiB
Markdown
# secrets-engine example
|
|
|
|
Policy package, manifests, and fixtures for `secrets-engine`'s gated
|
|
catalog-lane operations. Opened by `FLEX-DEC-2026-005`, carried by
|
|
`FLEX-WP-0021`.
|
|
|
|
| File | What it is |
|
|
| --- | --- |
|
|
| `policy_package.md` | `secrets-engine.catalog-lane.lifecycle` v2, `allow_ttl: 15m` |
|
|
| `protected_system_manifest.yaml` | the `secret-catalog-lane` resource type and twelve actions |
|
|
| `subject_manifest.yaml` | the single `secrets-engine` service identity |
|
|
| `registry_snapshot.json` | loadable snapshot combining both manifests |
|
|
| `policy_fixtures.yaml` | 32 fixtures — 11 allows, dual control both ways, and every denial branch |
|
|
| `check_request_*.json` | standalone requests for `POST /v1/check` |
|
|
|
|
The action vocabulary is **secrets-engine's**, delivered under
|
|
`FLEX-WP-0021-T01` and recorded in
|
|
[`../../docs/secrets-engine-action-vocabulary.md`](../../docs/secrets-engine-action-vocabulary.md).
|
|
Read that before changing any action string here.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
go run ./cmd/access-engine validate -kind policy -file examples/secrets-engine/policy_package.md
|
|
go run ./cmd/access-engine load-registry -file examples/secrets-engine/registry_snapshot.json
|
|
```
|
|
|
|
28 Rego tests and 32 fixtures.
|
|
|
|
## Deployed, and the version to pin
|
|
|
|
`FLEX-WP-0021-T04` deployed the `flex-auth-secrets-engine` pin on 2026-09-06:
|
|
|
|
```text
|
|
Service: http://flex-auth-secrets-engine.flex-auth.svc.cluster.local.:8080
|
|
^ trailing dot, required
|
|
Package: secrets-engine.catalog-lane.lifecycle
|
|
Version: v2
|
|
callerAuth.mode: warn (not enforced caller authentication)
|
|
```
|
|
|
|
**The trailing dot is not cosmetic, and this address is in-cluster only.**
|
|
`secrets-engine` reported and flex-auth reproduced that on the workstation a
|
|
bare `*.svc.cluster.local` name resolves through `search ad.binect.de` to one
|
|
unrelated public host — a name for a service that does not exist resolves to the
|
|
same address, which proves it is suffix expansion rather than a record. The
|
|
trailing-dot form correctly fails to resolve instead. A bare Service name in a
|
|
handover is therefore not merely unreachable from a workstation, it is a live
|
|
misdirection. See `../../docs/operator-caller-access-path.md`.
|
|
|
|
Ingress admits namespace `secrets-engine` with pod label
|
|
`app.kubernetes.io/name=secrets-engine` and default-denies everything else. A
|
|
workstation CLI process is not that, and Service DNS is not workstation
|
|
connectivity — an operator-run consumer needs a decided access path before it
|
|
can call this pin at all (`FLEX-WP-0021-T04`'s three shapes).
|
|
|
|
**Pin `_VERSION` to `v2`, never `v1`.** `v1` is deployed and superseded: it had
|
|
no tenant rule and allowed a foreign tenant. See the correction section in
|
|
`policy_package.md`. The pin still serves `v1` until the redeploy lands, which
|
|
is why the version is stated here rather than left to be read off the running
|
|
service.
|
|
|
|
`SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE` / `_VERSION` remain fallback-free
|
|
and fail-closed by design; nothing here changes that.
|