tegwick
1fbebb2d94
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 6969@bnt-lap001 Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0
65 lines
2.6 KiB
YAML
65 lines
2.6 KiB
YAML
spec: runbook-pack/v0.2
|
|
id: nk.openbao-token-revocation
|
|
title: OpenBao token revocation
|
|
owner: net-kingdom
|
|
outcome: Short-lived, temporary or disclosed OpenBao tokens are revoked without token values on the local command line.
|
|
engine: native
|
|
confirm_phrase: I understand this cannot be undone
|
|
framing:
|
|
- Token values are typed at hidden prompts only; the accessor is the handle for a disclosed token.
|
|
- Needs an initialized OpenBao instance.
|
|
- Ported from the security bootstrap console runbook "OpenBao token revocation".
|
|
actors:
|
|
- id: operator
|
|
role: OpenBao ceremony operator
|
|
description: Revokes tokens with a root or sudo-capable token.
|
|
privileges: [openbao-root-or-sudo]
|
|
datapoints:
|
|
- id: which
|
|
label: What to revoke
|
|
type: enum
|
|
values: [current-helper-token, disclosed-by-accessor]
|
|
default: current-helper-token
|
|
dimensions: {actor: operator, kind: decision, subsystem: openbao}
|
|
ask_in: revoke
|
|
stages:
|
|
- id: revoke
|
|
title: Revoke
|
|
goal: The token no longer works.
|
|
steps:
|
|
- id: revoke-self
|
|
title: Revoke the current helper token
|
|
actor: operator
|
|
owner: openbao
|
|
description: For the token in the pod token helper, usually right after an attended check.
|
|
command: |
|
|
kubectl exec -it -n openbao openbao-0 -- sh -lc 'export BAO_ADDR=http://127.0.0.1:8200; bao token lookup >/dev/null; bao token revoke -self'
|
|
reversible: false
|
|
idempotent: non-idempotent
|
|
auto_confirm: manual-only
|
|
verify:
|
|
done_when: The revoke command succeeded
|
|
expect: manual
|
|
- id: revoke-accessor
|
|
title: Revoke a disclosed token by accessor
|
|
actor: operator
|
|
owner: openbao
|
|
description: Prompts for a root or sudo token and the accessor of the disclosed token.
|
|
command: |
|
|
kubectl exec -it -n openbao openbao-0 -- sh -lc 'printf "OpenBao token: " >&2; stty -echo; read -r BAO_TOKEN; stty echo; printf "\n" >&2; export BAO_TOKEN; printf "Token accessor to revoke: " >&2; read -r TARGET_ACCESSOR; bao token revoke -accessor "$TARGET_ACCESSOR"; unset TARGET_ACCESSOR'
|
|
reversible: false
|
|
idempotent: idempotent
|
|
idempotent_note: Revoking an already revoked accessor fails harmlessly.
|
|
auto_confirm: manual-only
|
|
verify:
|
|
done_when: The accessor is revoked
|
|
expect: manual
|
|
gates:
|
|
- id: revoked
|
|
title: The token is dead
|
|
goal: contained-exposure
|
|
blocking: true
|
|
downstream_risk: A disclosed token keeps its access.
|
|
checks:
|
|
- done_when: Using the revoked token is refused
|
|
expect: manual
|