coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/examples/ops-warden
History
Exact
tegwick e521e7b715
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details
feat(policy): adopt security zone stances 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
2026-08-22 15:17:13 +02:00
..
check_request_allow_adm.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_allow_agt.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_allow_atm.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_actor_type_mismatch.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_disallowed_principal.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_missing_fingerprint.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_ttl_above_max.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
check_request_deny_unknown_subject.json FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
policy_fixtures.yaml feat(policy): adopt security zone stances 2026-08-22 15:17:13 +02:00
policy_package.md feat(policy): adopt security zone stances 2026-08-22 15:17:13 +02:00
production_registry_snapshot.json feat(policy): adopt security zone stances 2026-08-22 15:17:13 +02:00
protected_system_manifest.yaml FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
README.md FLEX-WP-0007: production registry fixture, tests, and sync runbook 2026-06-24 14:52:35 +02:00
registry_snapshot.json feat(policy): adopt security zone stances 2026-08-22 15:17:13 +02:00
resource_manifest.yaml FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00
subject_manifest.yaml FLEX-WP-0006: implement ops-warden signing gate policy 2026-06-23 21:17:42 +02:00

README.md

Ops-Warden SSH Signing Policy Gate

This example is the flex-auth side of ops-warden's opt-in pre-sign gate. When policy.enabled: true, ops-warden calls POST /v1/check before signing or issuing an SSH certificate.

Files:

  • protected_system_manifest.yaml declares the ops-warden protected system, ssh-certificate resource type, and sign action.
  • resource_manifest.yaml declares fixture SSH certificate actor resources and non-secret policy attributes such as allowed principals and TTL maxima.
  • subject_manifest.yaml declares non-secret fixture actors for adm, agt, and atm signing paths.
  • registry_snapshot.json is the combined local registry used by the CLI and service examples.
  • policy_package.md is the Rego-in-Markdown policy package.
  • policy_fixtures.yaml contains allow and deny expectations for package validation.
  • check_request_*.json files are ops-warden-shaped /v1/check requests.

Run locally:

flex-auth validate --kind protected-system --file examples/ops-warden/protected_system_manifest.yaml
flex-auth validate --kind resource-manifest --file examples/ops-warden/resource_manifest.yaml
flex-auth validate --kind subject-manifest --file examples/ops-warden/subject_manifest.yaml
flex-auth load-registry --file examples/ops-warden/registry_snapshot.json
flex-auth test-policy --file examples/ops-warden/policy_package.md
flex-auth check --registry examples/ops-warden/registry_snapshot.json --policy examples/ops-warden/policy_package.md --request examples/ops-warden/check_request_allow_adm.json

The fixture public-key fingerprints are examples only. Do not put real keys, OpenBao tokens, or private signing material in these files.

Production Registry Fixture

production_registry_snapshot.json is a non-secret fixture generated by ops-warden for FLEX-WP-0007 coverage. It mirrors the current production actor names used by ops-warden inventory and should be refreshed when that inventory changes.

Validate both registries locally:

flex-auth load-registry --file examples/ops-warden/registry_snapshot.json
flex-auth load-registry --file examples/ops-warden/production_registry_snapshot.json

The production sync contract is documented in docs/ops-warden-registry-sync.md.