tegwick
cdf0d9bf25
Window-scoped write role (CCR-2026-0058 approved as amended), bind self-rotation (pilot step is OPERATE on the one bind; svc-executor-pw dropped), pilot without the PDP gate (not-evaluated), started event plus one receipt per run, rapp Job in sso, owner workplans approved. New tasks: T11 core runner, T12 pilot operations and packaging; T06 depends on T12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
71 lines
4.6 KiB
YAML
71 lines
4.6 KiB
YAML
schema_version: "0.1"
|
|
service: bounded-executor
|
|
owner: "NetKingdom (executor source); runtime package rapp-bounded-executor (NK-WP-0056-T02, founder decision 6d1adce9)"
|
|
declared_at: 2026-10-31
|
|
attestation:
|
|
authored_by: claude-code
|
|
basis: [canon/standards/bounded-execution-admission_v0.1.md, examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml, sso-mfa/k8s/bounded-executor/rbac.yaml, workplans/NK-WP-0056-bounded-executor-path.md]
|
|
owner_confirmed: false
|
|
complete: false
|
|
# Every credential the bounded executor holds carries executor_subject service:nk-bind-executor, the identity
|
|
# its admissions name. Together they are its declared authority; `validate.py --admissions` checks that an
|
|
# admission's scope ceiling lies inside them. All grants are APPROVED: they act only during a consumed
|
|
# admission (SI-15). Pilot scope (T06): rotate the svc-authelia bind, one consumer.
|
|
identities:
|
|
- name: nk-bind-executor
|
|
principal_type: WORKLOAD
|
|
conventions: [executor]
|
|
executor_subject: "service:nk-bind-executor"
|
|
purpose: "Kubernetes ServiceAccount sso/nk-bind-executor: force-sync the authelia-secrets ExternalSecret and restart the authelia Deployment; no Secret read"
|
|
grants:
|
|
- {mode: OPERATE, scope: k8s/sso/deployment/authelia, activation: APPROVED, environments: [PRODUCTION], note: "Role: get, watch, patch on deployments/authelia"}
|
|
- {mode: OPERATE, scope: k8s/sso/externalsecret/authelia-secrets, activation: APPROVED, environments: [PRODUCTION], note: "Role: get, patch on externalsecrets/authelia-secrets"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [delivered-secret]
|
|
consumers: [{name: bounded-executor, kind: service}]
|
|
owner: "NetKingdom"
|
|
rotation: {path: "Projected ServiceAccount token, short-lived; nothing to rotate by hand", coupling: [bounded-executor]}
|
|
status: planned
|
|
- name: net-kingdom-bounded-executor
|
|
principal_type: WORKLOAD
|
|
conventions: [executor]
|
|
executor_subject: "service:nk-bind-executor"
|
|
purpose: "OpenBao Kubernetes-auth role for sso/nk-bind-executor (CCR-2026-0058, approved, window-scoped): write the next version of the svc-authelia bind (CAS) and read it; holding the current value is what lets the executor change the bind's own password in LLDAP"
|
|
grants:
|
|
- {mode: OPERATE, scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia, activation: APPROVED, environments: [PRODUCTION], note: "KV data read and CAS write; 15 min TTL; role exists only in the admitted window (CCR-2026-0058)"}
|
|
- {mode: OPERATE, scope: lldap/people/svc-authelia, activation: APPROVED, environments: [PRODUCTION], note: "self-rotation: signs in as the bind with the KV value and changes its own password (hub 3d0c8f86)"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [openbao-lease]
|
|
consumers: [{name: bounded-executor, kind: service}]
|
|
owner: "railiance-platform (OpenBao role) for NetKingdom"
|
|
rotation: {path: "OpenBao lease per run; no standing secret", coupling: [bounded-executor]}
|
|
status: planned
|
|
- name: svc-executor-read
|
|
principal_type: SERVICE
|
|
conventions: [bind]
|
|
executor_subject: "service:nk-bind-executor"
|
|
purpose: "Read-only directory bind for plan and verify steps (users, groups, bind identities); replaces the founder signing in as admin for reads"
|
|
grants: [{mode: USE, scope: directory, activation: STANDING, environments: [PRODUCTION], read_only: true}]
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [openbao-lease]
|
|
consumers: [{name: bounded-executor, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Bind password in OpenBao, rotated by the executor itself under an admission", coupling: [bounded-executor]}
|
|
status: planned
|
|
- name: svc-executor-admin
|
|
principal_type: SERVICE
|
|
conventions: [executor]
|
|
executor_subject: "service:nk-bind-executor"
|
|
purpose: "lldap_admin, only for root-class steps (create svc-* accounts, change the configured super-admin) under a high-risk admission; how membership is granted per run and removed afterwards is open"
|
|
grants:
|
|
- {mode: ADMINISTER, scope: lldap, activation: APPROVED, environments: [PRODUCTION], note: "root-class only; no narrower LLDAP group (SI-X6)"}
|
|
interactive_login: false
|
|
second_factor: not_applicable
|
|
custody: [openbao-lease]
|
|
consumers: [{name: bounded-executor, kind: service}]
|
|
owner: "NetKingdom directory and User Engine owners"
|
|
rotation: {path: "Per-run activation to be designed; not part of the T06 pilot", coupling: [bounded-executor]}
|
|
status: planned
|