From 6e3dfaeb41b7fe901bf07cca86b0f58f1d7a4625 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 6 Sep 2026 23:38:36 +0200 Subject: [PATCH] Enforce verified secrets-engine operator caller identity Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb --- WORK-RECORDS.md | 10 ++--- deploy/secrets-engine-operator-caller.yaml | 9 +++++ docs/operator-caller-access-path.md | 15 +++++++- values/secrets-engine.yaml | 2 +- ...LEX-WP-0023-operator-caller-access-path.md | 38 +++++++++++++++++-- 5 files changed, 64 insertions(+), 10 deletions(-) create mode 100644 deploy/secrets-engine-operator-caller.yaml diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 204cb55..d56bbd9 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -30,8 +30,8 @@ | workplan | FLEX-WP-0020 | proposed | — | workplans/FLEX-WP-0020-repository-identity-migration.md | | workplan | FLEX-WP-0021 | finished | — | workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md | | workplan | FLEX-WP-0022 | proposed | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md | -| workplan | FLEX-WP-0023 | ready | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | -| workplan | FLEX-WP-0024 | ready | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | +| workplan | FLEX-WP-0023 | active | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | +| workplan | FLEX-WP-0024 | active | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | @@ -138,9 +138,9 @@ | task | FLEX-WP-0022-T01 | todo | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md | | task | FLEX-WP-0022-T02 | wait | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md | | task | FLEX-WP-0022-T03 | todo | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md | -| task | FLEX-WP-0023-T01 | todo | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | -| task | FLEX-WP-0023-T02 | wait | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | -| task | FLEX-WP-0023-T03 | wait | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | +| task | FLEX-WP-0023-T01 | done | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | +| task | FLEX-WP-0023-T02 | done | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | +| task | FLEX-WP-0023-T03 | done | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | | task | FLEX-WP-0023-T04 | todo | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | | task | FLEX-WP-0023-T05 | wait | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | | task | FLEX-WP-0024-T01 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | diff --git a/deploy/secrets-engine-operator-caller.yaml b/deploy/secrets-engine-operator-caller.yaml new file mode 100644 index 0000000..b422d05 --- /dev/null +++ b/deploy/secrets-engine-operator-caller.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: secrets-engine + namespace: secrets-engine + labels: + app.kubernetes.io/part-of: flex-auth + app.kubernetes.io/component: operator-caller +automountServiceAccountToken: false diff --git a/docs/operator-caller-access-path.md b/docs/operator-caller-access-path.md index 7452b16..a73cc09 100644 --- a/docs/operator-caller-access-path.md +++ b/docs/operator-caller-access-path.md @@ -1,6 +1,6 @@ # Operator caller access path -**Status:** design published, live receipts outstanding +**Status:** revision 3 enforces adopted caller; positive and all four negative live checks pass **Opened by:** `glas-harness` (`GLAS-WP-0015`, 2026-09-06), carried by `FLEX-WP-0023` **Supersedes:** the workload assumption in `FLEX-WP-0021-T04` @@ -206,3 +206,16 @@ So a decision record proves the *subject* was allowed. It cannot prove the between "this decision permits the action" and "this caller was permitted to obtain this decision". Recorded as `FLEX-DEC-2026-009`; it is a gap in flex-auth's own §17 contract, not in the deployment. + + +## Live execution update — 2026-09-06 + +The earlier absent-SA and warn-mode observations above are historical design +findings. Glas created the bound identity from +`deploy/secrets-engine-operator-caller.yaml`, proved adoption with no warnings, +and upgraded the dedicated pin to Helm revision 3 / enforce. Positive request and N1–N4 pass, including an actually expired issued token +(401) followed by a fresh token (200). The temporary forward is closed. +See FLEX-WP-0023 and glas-harness/docs/evidence/GLAS-WP-0015-caller-auth-2026-09-06.json. +No other consumer deployment changed. Recreate a loopback-only forward and mint +a fresh bounded token for each authorized operator session; the verification +forward is temporary and is not the runtime endpoint after cleanup. diff --git a/values/secrets-engine.yaml b/values/secrets-engine.yaml index a28dabb..f153b5c 100644 --- a/values/secrets-engine.yaml +++ b/values/secrets-engine.yaml @@ -12,7 +12,7 @@ args: - --policy - /opt/flex-auth/examples/secrets-engine/policy_package.md callerAuth: - mode: warn + mode: enforce kubernetesURL: https://10.43.0.1 binding: secrets-engine=system:serviceaccount:secrets-engine:secrets-engine consumer: diff --git a/workplans/FLEX-WP-0023-operator-caller-access-path.md b/workplans/FLEX-WP-0023-operator-caller-access-path.md index cea0d1a..2e4f7fc 100644 --- a/workplans/FLEX-WP-0023-operator-caller-access-path.md +++ b/workplans/FLEX-WP-0023-operator-caller-access-path.md @@ -46,7 +46,7 @@ admitted exactly one pod. Here the warn window protects nothing while it runs. ```task id: FLEX-WP-0023-T01 -status: todo +status: done priority: high state_hub_task_id: "10e5a40c-f142-55b9-ab15-fc77c0064ce0" ``` @@ -73,7 +73,7 @@ Gate: `kubectl -n secrets-engine create token secrets-engine --audience=flex-aut ```task id: FLEX-WP-0023-T02 -status: wait +status: done priority: high state_hub_task_id: "79a8d82d-777c-5462-b49d-098f4b7a3b9c" ``` @@ -110,7 +110,7 @@ isolates. Nothing is reported as verified that was not run. ```task id: FLEX-WP-0023-T03 -status: wait +status: done priority: high state_hub_task_id: "8117c9d8-6efa-5ccf-8ed4-4da2519c3de3" ``` @@ -183,3 +183,35 @@ because a decision turning on registry content must be replayable from its own record. **A decision gated by caller authentication is not auditable from its own record by the same argument.** Carry it into the outstanding v0.8 assent review rather than as a separate message. + + +## Operator execution from Glas — 2026-09-06 + +Standing production authorization applied to this bounded owner procedure. +Added deploy/secrets-engine-operator-caller.yaml and applied it after server +validation: SA secrets-engine/secrets-engine, automount disabled, no role or +role binding added. Ten-minute TokenRequest token has exact bound sub and +flex-auth audience; token values remain only in proof-process memory. + +Positive adoption passed under warn with zero authentication warnings. Helm +lint/server dry-run passed; dedicated release upgraded to revision 3 with +callerAuth.mode=enforce. Correct caller gets 200 allow v2; missing token 401, +wrong principal 403, wrong audience 401. Expiry proof passed against an actually issued token: 401 after its exp +plus 65 seconds, followed by a fresh-token 200 allow v2. Other three Deployment +specs were compared and are unchanged. The temporary forward binds 127.0.0.1 +and is removed when the proof finishes. Value-free receipts are in glas-harness: +docs/evidence/GLAS-WP-0015-caller-auth-2026-09-06.json. + +The initial proof reader assumed JSON error responses; the server correctly +returns plain-text authentication failures. Corrected the temporary reader and +reran the checks; this was a proof-harness failure, not a production code change. + +T04 caller provenance and FLEX-WP-0024 signatures remain separate open work. +An authenticated API-server port-forward authenticates the responder for this +operator path; it does not produce a signed portable decision artifact. + + +Final receipt: T01–T03 complete; N4 expired-token 401 at epoch 1788730498, +fresh-token positive 200 at 1788730499. Temporary forward closed and proof +process exited, discarding its in-memory credentials. No port-forward remains +as an implicit runtime dependency. T04 and T05 remain open; plan stays active.