tegwick
0ced2995ee
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine - cmd/flex-auth: prints the rename and exits 2, with a test - image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside; live pins pass only args, so their next roll is unaffected - Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans, decisions and ADRs left as written - runtime names (module, audience, k8s, image package, /opt paths) unchanged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
50 lines
2.4 KiB
Markdown
50 lines
2.4 KiB
Markdown
# Ops-Warden SSH Signing Policy Gate
|
|
|
|
This example is the flex-auth side of ops-warden's opt-in pre-sign gate.
|
|
When `policy.enabled: true`, ops-warden calls `POST /v1/check` before signing
|
|
or issuing an SSH certificate.
|
|
|
|
Files:
|
|
|
|
- `protected_system_manifest.yaml` declares the `ops-warden` protected system,
|
|
`ssh-certificate` resource type, and `sign` action.
|
|
- `resource_manifest.yaml` declares fixture SSH certificate actor resources and
|
|
non-secret policy attributes such as allowed principals and TTL maxima.
|
|
- `subject_manifest.yaml` declares non-secret fixture actors for `adm`, `agt`,
|
|
and `atm` signing paths.
|
|
- `registry_snapshot.json` is the combined local registry used by the CLI and
|
|
service examples.
|
|
- `policy_package.md` is the Rego-in-Markdown policy package.
|
|
- `policy_fixtures.yaml` contains allow and deny expectations for package
|
|
validation.
|
|
- `check_request_*.json` files are ops-warden-shaped `/v1/check` requests.
|
|
|
|
Run locally:
|
|
|
|
```bash
|
|
access-engine validate --kind protected-system --file examples/ops-warden/protected_system_manifest.yaml
|
|
access-engine validate --kind resource-manifest --file examples/ops-warden/resource_manifest.yaml
|
|
access-engine validate --kind subject-manifest --file examples/ops-warden/subject_manifest.yaml
|
|
access-engine load-registry --file examples/ops-warden/registry_snapshot.json
|
|
access-engine test-policy --file examples/ops-warden/policy_package.md
|
|
access-engine check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_allow_adm.json
|
|
access-engine check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_deny_wrong_tenant.json
|
|
```
|
|
|
|
The fixture public-key fingerprints are examples only. Do not put real keys,
|
|
OpenBao tokens, or private signing material in these files.
|
|
|
|
|
|
## Production Registry Fixture
|
|
|
|
production_registry_snapshot.json is a non-secret fixture generated by
|
|
ops-warden for FLEX-WP-0007 coverage. It mirrors the current production actor
|
|
names used by ops-warden inventory and should be refreshed when that inventory
|
|
changes.
|
|
|
|
Validate both registries locally:
|
|
|
|
access-engine load-registry --file examples/ops-warden/registry_snapshot.json
|
|
access-engine load-registry --file examples/ops-warden/production_registry_snapshot.json
|
|
|
|
The production sync contract is documented in docs/ops-warden-registry-sync.md.
|