coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enforce verified secrets-engine operator caller identity
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 23:38:36 +02:00
parent 74216643eb
commit 6e3dfaeb41
5 changed files with 64 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

38
workplans/FLEX-WP-0023-operator-caller-access-path.md
View file

@ -46,7 +46,7 @@ admitted exactly one pod. Here the warn window protects nothing while it runs.
```task
id: FLEX-WP-0023-T01
status: todo
status: done
priority: high
state_hub_task_id: "10e5a40c-f142-55b9-ab15-fc77c0064ce0"
```
@ -73,7 +73,7 @@ Gate: `kubectl -n secrets-engine create token secrets-engine --audience=flex-aut
```task
id: FLEX-WP-0023-T02
status: wait
status: done
priority: high
state_hub_task_id: "79a8d82d-777c-5462-b49d-098f4b7a3b9c"
```
@ -110,7 +110,7 @@ isolates. Nothing is reported as verified that was not run.
```task
id: FLEX-WP-0023-T03
status: wait
status: done
priority: high
state_hub_task_id: "8117c9d8-6efa-5ccf-8ed4-4da2519c3de3"
```
@ -183,3 +183,35 @@ because a decision turning on registry content must be replayable from its own
record. **A decision gated by caller authentication is not auditable from its
own record by the same argument.** Carry it into the outstanding v0.8 assent
review rather than as a separate message.
## Operator execution from Glas — 2026-09-06
Standing production authorization applied to this bounded owner procedure.
Added deploy/secrets-engine-operator-caller.yaml and applied it after server
validation: SA secrets-engine/secrets-engine, automount disabled, no role or
role binding added. Ten-minute TokenRequest token has exact bound sub and
flex-auth audience; token values remain only in proof-process memory.
Positive adoption passed under warn with zero authentication warnings. Helm
lint/server dry-run passed; dedicated release upgraded to revision 3 with
callerAuth.mode=enforce. Correct caller gets 200 allow v2; missing token 401,
wrong principal 403, wrong audience 401. Expiry proof passed against an actually issued token: 401 after its exp
plus 65 seconds, followed by a fresh-token 200 allow v2. Other three Deployment
specs were compared and are unchanged. The temporary forward binds 127.0.0.1
and is removed when the proof finishes. Value-free receipts are in glas-harness:
docs/evidence/GLAS-WP-0015-caller-auth-2026-09-06.json.
The initial proof reader assumed JSON error responses; the server correctly
returns plain-text authentication failures. Corrected the temporary reader and
reran the checks; this was a proof-harness failure, not a production code change.
T04 caller provenance and FLEX-WP-0024 signatures remain separate open work.
An authenticated API-server port-forward authenticates the responder for this
operator path; it does not produce a signed portable decision artifact.
Final receipt: T01–T03 complete; N4 expired-token 401 at epoch 1788730498,
fresh-token positive 200 at 1788730499. Temporary forward closed and proof
process exited, discarding its in-memory credentials. No port-forward remains
as an implicit runtime dependency. T04 and T05 remain open; plan stays active.