tegwick
2387409d08
Executor credentials declared (planned) with executor_subject; service-identity gains convention executor (SI-15: approved-only grants, no person, not interactive) and --admissions, checking that an admission's ceiling lies inside the executor's declared grants (pilot covered). RBAC in sso-mfa/k8s/bounded-executor (not applied): ServiceAccount without automount, a Role limited to the authelia Deployment and ExternalSecret, no read of credential objects; tests tie Role, declaration and pilot ceiling. The pilot example's delivery check now reads the ExternalSecret status. railiance-apps and glas-harness answers recorded (T02). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
52 lines
2 KiB
YAML
52 lines
2 KiB
YAML
# Bounded executor identity in sso (NK-WP-0056-T03). PREPARED IN SOURCE, NOT APPLIED.
|
|
#
|
|
# The ServiceAccount the executor runs as, with exactly the pilot's Kubernetes authority (T06: rotate the
|
|
# svc-authelia bind): force-sync one ExternalSecret and restart one Deployment. No Secret, ConfigMap or Pod
|
|
# access, no create/delete, no wildcard, no cluster scope. Its OpenBao and LLDAP credentials are declared in
|
|
# tools/service-identity/declarations/bounded-executor.yaml; all of it acts only under a consumed admission
|
|
# (canon/standards/bounded-execution-admission_v0.1.md). Packaging and apply belong to rapp-bounded-executor
|
|
# (ADR-0015, founder decision 6d1adce9). Tests: sso-mfa/k8s/bounded-executor/test_rbac.py.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: nk-bind-executor
|
|
namespace: sso
|
|
labels:
|
|
app.kubernetes.io/name: bounded-executor
|
|
app.kubernetes.io/part-of: net-kingdom-sso-mfa
|
|
automountServiceAccountToken: false # the executor pod mounts a projected, audience-bound token instead
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: nk-bind-executor
|
|
namespace: sso
|
|
labels:
|
|
app.kubernetes.io/name: bounded-executor
|
|
rules:
|
|
# restart: kubectl rollout restart patches the pod template annotation; rollout status reads and watches
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
resourceNames: ["authelia"]
|
|
verbs: ["get", "watch", "patch"]
|
|
# deliver: force-sync annotation, then read status (Ready, refreshTime) as the check; never the Secret
|
|
- apiGroups: ["external-secrets.io"]
|
|
resources: ["externalsecrets"]
|
|
resourceNames: ["authelia-secrets"]
|
|
verbs: ["get", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: nk-bind-executor
|
|
namespace: sso
|
|
labels:
|
|
app.kubernetes.io/name: bounded-executor
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: nk-bind-executor
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: nk-bind-executor
|
|
namespace: sso
|