tegwick
1fbebb2d94
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 6969@bnt-lap001 Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0
84 lines
3.3 KiB
YAML
84 lines
3.3 KiB
YAML
spec: runbook-pack/v0.2
|
|
id: nk.openbao-key-compromise
|
|
title: OpenBao key material compromised
|
|
owner: net-kingdom
|
|
outcome: The exposure is recorded, reset versus rotation is chosen and carried out, and only the non-secret outcome is on record.
|
|
engine: native
|
|
confirm_phrase: I understand this cannot be undone
|
|
framing:
|
|
- "Nothing secret is recorded here: not init output, shares, tokens or their fragments."
|
|
- Treat everything the exposed material could reach as untrusted until the response is complete.
|
|
- Ported from the security bootstrap console runbook "Key material compromised".
|
|
actors:
|
|
- id: operator
|
|
role: OpenBao ceremony operator
|
|
description: Runs the attended OpenBao commands and records the outcome.
|
|
privileges: [openbao-root-or-sudo]
|
|
datapoints:
|
|
- id: response
|
|
label: Chosen response
|
|
type: enum
|
|
values: [reset, rotate-keys]
|
|
default: rotate-keys
|
|
help: Reset when the instance holds nothing yet worth keeping; rotate when it holds live data.
|
|
dimensions: {actor: operator, kind: decision, subsystem: openbao}
|
|
ask_in: respond
|
|
- id: exposure_summary
|
|
label: Non-secret exposure summary
|
|
type: text
|
|
default: ""
|
|
help: What escaped, where, when. No secret values.
|
|
dimensions: {actor: operator, kind: evidence, subsystem: openbao}
|
|
ask_in: assess
|
|
stages:
|
|
- id: assess
|
|
title: Assess the exposure
|
|
goal: You know what escaped and which paths it could reach.
|
|
steps:
|
|
- id: status
|
|
title: Check OpenBao state
|
|
actor: operator
|
|
owner: openbao
|
|
command: kubectl exec -n openbao openbao-0 -- bao status
|
|
idempotent: idempotent
|
|
verify:
|
|
done_when: Status is shown
|
|
expect: manual
|
|
- id: inspect-paths
|
|
title: Inspect affected mounts and auth methods
|
|
actor: operator
|
|
owner: openbao
|
|
requires: [status]
|
|
command: |
|
|
printf "OpenBao token: " >&2; read -rs OPENBAO_TOKEN; printf "\n" >&2
|
|
printf "%s\n" "$OPENBAO_TOKEN" | kubectl exec -i -n openbao openbao-0 -- sh -c 'read -r BAO_TOKEN; export BAO_TOKEN; bao secrets list; bao auth list'
|
|
unset OPENBAO_TOKEN
|
|
idempotent: idempotent
|
|
verify:
|
|
done_when: The affected paths are listed and noted
|
|
expect: manual
|
|
- id: respond
|
|
title: Reset or rotate
|
|
goal: The exposed material is no longer valid.
|
|
requires: [assess]
|
|
steps:
|
|
- id: carry-out
|
|
title: Carry out the chosen response
|
|
actor: operator
|
|
owner: openbao
|
|
uses: [response]
|
|
description: "If rotate-keys, run the pack nk.openbao-rotate-unseal-keys and revoke exposed tokens with nk.openbao-token-revocation. If reset, reinitialize per the attended ceremony runbook (docs/openbao-attended-ceremony-runbook.md); this destroys stored data."
|
|
reversible: false
|
|
idempotent: non-idempotent
|
|
verify:
|
|
done_when: The response is complete and the old material no longer works
|
|
expect: manual
|
|
gates:
|
|
- id: response-complete
|
|
title: The compromise response is complete
|
|
goal: contained-exposure
|
|
blocking: true
|
|
downstream_risk: Production trust would rest on material an outsider may hold.
|
|
checks:
|
|
- done_when: Exposed shares and tokens are invalid and the non-secret outcome is recorded
|
|
expect: manual
|