spec: runbook-pack/v0.2
id: nk.openbao-token-revocation
title: OpenBao token revocation
owner: net-kingdom
outcome: Short-lived, temporary or disclosed OpenBao tokens are revoked without token values on the local command line.
engine: native
confirm_phrase: I understand this cannot be undone
framing:
  - Token values are typed at hidden prompts only; the accessor is the handle for a disclosed token.
  - Needs an initialized OpenBao instance.
  - Ported from the security bootstrap console runbook "OpenBao token revocation".
actors:
  - id: operator
    role: OpenBao ceremony operator
    description: Revokes tokens with a root or sudo-capable token.
    privileges: [openbao-root-or-sudo]
datapoints:
  - id: which
    label: What to revoke
    type: enum
    values: [current-helper-token, disclosed-by-accessor]
    default: current-helper-token
    dimensions: {actor: operator, kind: decision, subsystem: openbao}
    ask_in: revoke
stages:
  - id: revoke
    title: Revoke
    goal: The token no longer works.
    steps:
      - id: revoke-self
        title: Revoke the current helper token
        actor: operator
        owner: openbao
        description: For the token in the pod token helper, usually right after an attended check.
        command: |
          kubectl exec -it -n openbao openbao-0 -- sh -lc 'export BAO_ADDR=http://127.0.0.1:8200; bao token lookup >/dev/null; bao token revoke -self'
        reversible: false
        idempotent: non-idempotent
        auto_confirm: manual-only
        verify:
          done_when: The revoke command succeeded
          expect: manual
      - id: revoke-accessor
        title: Revoke a disclosed token by accessor
        actor: operator
        owner: openbao
        description: Prompts for a root or sudo token and the accessor of the disclosed token.
        command: |
          kubectl exec -it -n openbao openbao-0 -- sh -lc 'printf "OpenBao token: " >&2; stty -echo; read -r BAO_TOKEN; stty echo; printf "\n" >&2; export BAO_TOKEN; printf "Token accessor to revoke: " >&2; read -r TARGET_ACCESSOR; bao token revoke -accessor "$TARGET_ACCESSOR"; unset TARGET_ACCESSOR'
        reversible: false
        idempotent: idempotent
        idempotent_note: Revoking an already revoked accessor fails harmlessly.
        auto_confirm: manual-only
        verify:
          done_when: The accessor is revoked
          expect: manual
    gates:
      - id: revoked
        title: The token is dead
        goal: contained-exposure
        blocking: true
        downstream_risk: A disclosed token keeps its access.
        checks:
          - done_when: Using the revoked token is refused
            expect: manual