NK-WP-0054-T04: rerun on fresh export confirms keycape alias gone; window-scoped executor role
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 149903@bnt-lap001 Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6
This commit is contained in:
parent
15c487313e
commit
6252ab8d7e
7 changed files with 7276 additions and 7 deletions
|
|
@ -56,5 +56,25 @@ Two earlier dry runs failed inside the helper, before any change: one left no re
|
|||
`4d70743`. On the first attempt WSL interop timeouts kept Edge from opening. On another, Authelia once dropped the
|
||||
OIDC flow to its default URL, `users.coulomb.social`.
|
||||
|
||||
Still open: railiance-platform removes the alias from its declarations (message `051b7391`), and a fresh export
|
||||
confirms the change with `make service-identity-observe`.
|
||||
Still open: railiance-platform removes the alias from its declarations (message `051b7391`).
|
||||
|
||||
## Rerun on a fresh export, 2026-11-07 14:40Z
|
||||
|
||||
The founder re-exported with the RPF-WP-0067-T03 commands. Both exited 0, and no secret-shaped values were found.
|
||||
|
||||
| File | SHA-256 | collected_at |
|
||||
|---|---|---|
|
||||
| `openbao-identity-metadata-20261107.json` | `58ceec665c8cbe6f3214d24307bbb584e63362ca51c30920db21ecdfdebd3cc7` | 2026-11-07T14:34:38Z |
|
||||
| `postgresql-identity-metadata-20261107.json` | `76fd1d795b3597fa44ab971c452956e4d3173230bd1d8b0e8708f742c1f560b2` | 2026-11-07T14:35:35Z |
|
||||
|
||||
**What changed in the data:**
|
||||
- Auth mounts are now `approle`, `keycape-services`, `kubernetes`, `netkingdom` and `token`; `keycape` is gone.
|
||||
- The only role removed since 2026-11-03 is `keycape/platform-admin`. Five executor and window-watch roles were
|
||||
added.
|
||||
|
||||
`report-20261107-rerun.json` (exit 0):
|
||||
- **Declared identities:** 6 conformant, 1 unknown (the `netkingdom/platform-admin` max TTL).
|
||||
- **Undeclared:** 0 non-conformant, 14 unknown.
|
||||
|
||||
The executor's write role `net-kingdom-bind-executor-svc-authelia-write` is absent, which CCR-2026-0058 requires
|
||||
between admitted runs. The checker now treats that absence as conformant (`window_scoped`).
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,97 @@
|
|||
{
|
||||
"collected_at": "2026-11-07T14:35:35Z",
|
||||
"postgresql": {
|
||||
"cluster": "net-kingdom-pg",
|
||||
"databases": [
|
||||
{
|
||||
"name": "interhub",
|
||||
"owner": "interhub"
|
||||
},
|
||||
{
|
||||
"name": "postgres",
|
||||
"owner": "postgres"
|
||||
},
|
||||
{
|
||||
"name": "privacyidea_db",
|
||||
"owner": "privacyidea"
|
||||
},
|
||||
{
|
||||
"name": "probe",
|
||||
"owner": "probe"
|
||||
}
|
||||
],
|
||||
"namespace": "databases",
|
||||
"roles": [
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "interhub",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": true,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": true,
|
||||
"create_role": true,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "postgres",
|
||||
"replication": true,
|
||||
"superuser": true,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "privacyidea",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "probe",
|
||||
"replication": false,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
},
|
||||
{
|
||||
"bypass_rls": false,
|
||||
"can_login": true,
|
||||
"connection_limit": -1,
|
||||
"create_db": false,
|
||||
"create_role": false,
|
||||
"inherit": true,
|
||||
"member_of": [],
|
||||
"name": "streaming_replica",
|
||||
"replication": true,
|
||||
"superuser": false,
|
||||
"valid_until": null
|
||||
}
|
||||
],
|
||||
"server_version": "16.13 (Debian 16.13-1.pgdg11+1)"
|
||||
},
|
||||
"schema": "railiance-platform.service-identity-metadata.v1",
|
||||
"service": "postgresql",
|
||||
"source_kind": "live",
|
||||
"value_safe": true
|
||||
}
|
||||
|
|
@ -0,0 +1,217 @@
|
|||
{
|
||||
"as_of": "2026-11-07T14:40:00Z",
|
||||
"freshness": [
|
||||
{
|
||||
"age_hours": 0.1,
|
||||
"collected_at": "2026-11-07T14:34:38Z",
|
||||
"fresh": true,
|
||||
"max_age_days": 7,
|
||||
"service": "openbao",
|
||||
"source_kind": "live"
|
||||
},
|
||||
{
|
||||
"age_hours": 0.1,
|
||||
"collected_at": "2026-11-07T14:35:35Z",
|
||||
"fresh": true,
|
||||
"max_age_days": 7,
|
||||
"service": "postgresql",
|
||||
"source_kind": "live"
|
||||
}
|
||||
],
|
||||
"identities": [
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [
|
||||
{
|
||||
"detail": "netkingdom/platform-admin has no role max ttl; renewal is bounded by the mount/system default, which the export does not include",
|
||||
"identity": "netkingdom-platform-admin",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "lifetime",
|
||||
"verdict": "unknown"
|
||||
}
|
||||
],
|
||||
"identity": "netkingdom-platform-admin",
|
||||
"observed_as": [
|
||||
"netkingdom/platform-admin"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "credential-broker-keycape-client-secret-generate",
|
||||
"observed_as": [
|
||||
"netkingdom/credential-broker-keycape-client-secret-generate"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "fluid-telegram-operators",
|
||||
"observed_as": [
|
||||
"netkingdom/fluid-telegram-hall-of-helix-workload-kv"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "secrets-engine-openbao",
|
||||
"observed_as": [
|
||||
"keycape-services/secrets-engine-openbao"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "coding-agent",
|
||||
"observed_as": [
|
||||
"netkingdom/coding-agent",
|
||||
"approle/coding-agent-railiance-platform"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "openbao",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "openbao",
|
||||
"findings": [],
|
||||
"identity": "net-kingdom-bounded-executor",
|
||||
"observed_as": [
|
||||
"kubernetes/net-kingdom-bind-executor-svc-authelia-write"
|
||||
],
|
||||
"owner": "railiance-platform (OpenBao role) for NetKingdom",
|
||||
"service": "bounded-executor",
|
||||
"verdict": "conformant"
|
||||
},
|
||||
{
|
||||
"evidence": "postgresql",
|
||||
"findings": [],
|
||||
"identity": "privacyidea",
|
||||
"observed_as": [
|
||||
"net-kingdom-pg/privacyidea"
|
||||
],
|
||||
"owner": "railiance-platform",
|
||||
"service": "postgresql",
|
||||
"verdict": "conformant"
|
||||
}
|
||||
],
|
||||
"summary": {
|
||||
"conformant": 6,
|
||||
"unknown": 1
|
||||
},
|
||||
"undeclared": [
|
||||
{
|
||||
"detail": "undeclared role shares declared policies ['workload-kv-read-issue-core-runtime']",
|
||||
"identity": "kubernetes/external-secrets-issue-core",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-company-email-imap'])",
|
||||
"identity": "netkingdom/binky-company-email-imap-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-binky-qonto-api'])",
|
||||
"identity": "netkingdom/binky-qonto-api-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-forgejo-admin'])",
|
||||
"identity": "netkingdom/forgejo-admin-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-informed-decision-sitting-requester-client'])",
|
||||
"identity": "netkingdom/informed-decision-sitting-requester-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-policy-nexus-forgejo-source'])",
|
||||
"identity": "netkingdom/policy-nexus-forgejo-source-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-railiance-backup-offsite-lane'])",
|
||||
"identity": "netkingdom/railiance-backup-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-approval-client'])",
|
||||
"identity": "netkingdom/secrets-engine-approval-client-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['net-kingdom-admins'], policies ['workload-kv-read-secrets-engine-requester-client'])",
|
||||
"identity": "netkingdom/secrets-engine-requester-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared human OIDC role without aal2 (groups ['whynot-design'], policies ['workload-kv-read-whynot-design-npm-publish'])",
|
||||
"identity": "netkingdom/whynot-design-workload-kv-read",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags none, owns ['interhub'])",
|
||||
"identity": "net-kingdom-pg/interhub",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags ['superuser', 'create_role', 'create_db', 'replication', 'bypass_rls'], owns ['postgres'])",
|
||||
"identity": "net-kingdom-pg/postgres",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags none, owns ['probe'])",
|
||||
"identity": "net-kingdom-pg/probe",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
},
|
||||
{
|
||||
"detail": "undeclared login role (flags ['replication'], owns nothing)",
|
||||
"identity": "net-kingdom-pg/streaming_replica",
|
||||
"owner": "railiance-platform",
|
||||
"rule": "SI-11",
|
||||
"verdict": "unknown"
|
||||
}
|
||||
],
|
||||
"undeclared_summary": {
|
||||
"non-conformant": 0,
|
||||
"unknown": 14
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue