coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(policy): adopt security zone stances
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 15:17:13 +02:00
parent fbef547cfa
commit e521e7b715
8 changed files with 248 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

65
examples/ops-warden/policy_package.md
View file

@ -2,7 +2,7 @@
id: ops-warden.ssh-certificate.sign
name: Ops-Warden SSH certificate signing
namespace: ops-warden:ssh-certificate
version: v1
version: v2
status: ready
package: flexauth.ops_warden.ssh_signing
actions:
@ -41,12 +41,13 @@ activation:
mode: local
metadata:
source: examples/ops-warden/policy_package.md
ops_warden_policy_gate: v2
ops_warden_policy_gate: security-zones-v0.1
security_zone_standard: security-zones_v0.1
---
# Ops-Warden SSH Certificate Signing
This package authorizes ops-warden's opt-in pre-sign policy gate. The caller
This package authorizes ops-warden's zone-aware pre-sign policy gate. The caller
keeps SSH CA custody, actor inventory, and OpenBao signing; flex-auth decides
whether a specific `sign` request is allowed now.
@ -60,11 +61,45 @@ import future.keywords.in
actor_types := {"adm", "agt", "atm"}
decision := {"effect": "allow", "reason": "signing_policy_matched"} if {
security_zone_stance == "enforced"
allowed
} else := {"effect": "deny", "reason": first_denial} if {
security_zone_stance == "enforced"
} else := {"effect": "audit_only", "reason": advisory_reason} if {
true
}
default security_zone := "unknown"
security_zone := input.resource.attributes.security_zone if {
input.resource.attributes.security_zone in {
"z0-experimental",
"z1-operational",
"z2-protected",
"z2-continuity",
"z3-critical",
"unknown",
}
}
default security_zone_stance := "advisory"
security_zone_stance := "enforced" if {
security_zone in {"z2-protected", "z2-continuity", "z3-critical"}
}
security_zone_stance := "enforced" if {
input.resource.attributes.security_zone_admission == "not-applicable"
}
base_reason := "signing_policy_matched" if {
allowed
} else := first_denial if {
true
}
advisory_reason := sprintf("advisory_would_%s", [base_reason])
allowed if {
input.action == "sign"
input.resource.system == "ops-warden"
@ -211,7 +246,9 @@ adm_request := {
"actor_type": "adm",
"allowed_subjects": ["platform-steward", "iam:platform-steward"],
"allowed_principals": ["platform", "root"],
"max_ttl_hours": 8
"max_ttl_hours": 8,
"security_zone": "z2-protected",
"security_zone_admission": "satisfied"
}
},
"context": {
@ -254,4 +291,24 @@ test_missing_fingerprint_denied if {
}
}
}
test_unknown_zone_is_advisory if {
ssh_signing.decision.effect == "audit_only" with input as object.union(
adm_request,
{"resource": object.union(adm_request.resource, {"attributes": object.union(
adm_request.resource.attributes,
{"security_zone": "unknown", "security_zone_admission": "unknown"},
)})},
)
}
test_native_non_workload_subject_keeps_enforced_policy if {
ssh_signing.decision.effect == "allow" with input as object.union(
adm_request,
{"resource": object.union(adm_request.resource, {"attributes": object.union(
adm_request.resource.attributes,
{"security_zone": "unknown", "security_zone_admission": "not-applicable"},
)})},
)
}
```