MASON-WP-0015-T06: agent kubeconfig is cluster-admin (MASON-IN-0006)

kubectl auth can-i shows system:admin can create ServiceAccount tokens,
pods and impersonate cluster-wide, so any OpenBao Kubernetes role can be
assumed. Recorded as an open intake for founder decision; nothing changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 278674@bnt-lap001
Assistant-Session: 64827407-e196-4ce3-b70c-76e7b537493f

.custodian-brief.md

@@ -2,17 +2,16 @@
 # Custodian Brief — ops-mason
 
 **Domain:** infotech  
-**Last synced:** 2026-10-18 10:45 UTC  
+**Last synced:** 2026-10-18 10:53 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Restore ops-mason as the OpenBao builder: the ops-mason-construct grant
-Progress: 4/7 done  |  workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804`
+Progress: 5/7 done  |  workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804`
 
 **Open tasks:**
 - ! Submit CCRs from approved plans (RPF-WP-0061)  `ebc420c6`
-- · Executor and post-build check  `7b7a436f`
 - · Close the Kubernetes variant  `feb17422`
 
 ### Describe every stored credential so the store is navigable

INTENT.md

@@ -164,6 +164,7 @@ tooling_contacts:
         until: "2026-12-21"
         rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding."
       relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision."
+      identity_gap: "2026-10-18 (MASON-IN-0006): the kube identity applied with is system:admin (system:masters). Refusing Pod and Secret kinds is a code limit in kubernetes_plane, not an RBAC limit; the identity can mint any ServiceAccount token."
       enforcement: "src/ops_mason/readiness.py: inspect_readiness and resolve_tier; kubernetes_plane.apply refuses before Kubernetes writes. Source/history verification, explicit whitehat placement, dated policy-nexus transition, and recorded BREAK_GLASS."
   - id: bao-session-grant
     shape: "5.2"

WORK-RECORDS.md

@@ -98,7 +98,7 @@
 | task | MASON-WP-0015-T01 | done | — | workplans/MASON-WP-0015-construct-grant.md |
 | task | MASON-WP-0015-T02 | done | — | workplans/MASON-WP-0015-construct-grant.md |
 | task | MASON-WP-0015-T03 | done | — | workplans/MASON-WP-0015-construct-grant.md |
-| task | MASON-WP-0015-T04 | todo | — | workplans/MASON-WP-0015-construct-grant.md |
+| task | MASON-WP-0015-T04 | done | — | workplans/MASON-WP-0015-construct-grant.md |
 | task | MASON-WP-0015-T05 | done | — | workplans/MASON-WP-0015-construct-grant.md |
 | task | MASON-WP-0015-T06 | todo | — | workplans/MASON-WP-0015-construct-grant.md |
 | task | MASON-WP-0015-T07 | wait | — | workplans/MASON-WP-0015-construct-grant.md |

intakes/intakes.md

@@ -228,3 +228,46 @@ resolution: >-
 updated: '2026-10-18T00:00:00Z'
 state_hub_intake_id: "01a14e6a-47d0-7e1d-bc28-2908e7c50b35"
 ```
+
+## MASON-IN-0006 — The agent kubeconfig is cluster-admin, so any OpenBao Kubernetes role can be assumed
+
+```yaml
+id: MASON-IN-0006
+kind: intake
+title: The agent kubeconfig is cluster-admin, so any OpenBao Kubernetes role can be assumed
+status: open
+origin: review
+origin_ref: MASON-WP-0015-T06 (2026-10-18)
+priority: high
+owner: ops-mason
+requested_by: ops-mason
+description: >-
+  The kubeconfig ops-mason applies with on the workstation (~/.kube/config and
+  config-railiance01, context default, server 127.0.0.1:16444 over the
+  k3s-api-railiance01 tunnel) authenticates as system:admin in system:masters.
+  kubectl auth can-i, 2026-10-18: create serviceaccounts/token, create pods and
+  impersonate serviceaccounts are all yes in mas and cluster-wide. An agent
+  session holding it can mint a token for any ServiceAccount bound to an
+  OpenBao Kubernetes role and log in to OpenBao as that workload, and can read
+  Kubernetes Secret objects directly. This bypasses the ops-mason-construct
+  "never log in" invariant (MASON-IN-0005) and every per-lane OpenBao scope.
+  The only control against Secret reads is the guard-secret-reads transcript
+  hook, which is a convention, not access control. Checked by capability
+  queries only; not exercised.
+  Side note: ~/.kube/config-hosteurope points at 127.0.0.1:16443, where nothing
+  is listening, but the railiance-platform runbooks still reference it.
+options: >-
+  (a) A dedicated, scoped kube identity for ops-mason (client certificate or
+  ServiceAccount token) whose RBAC covers only the kinds kubernetes_plane
+  applies (Namespace, ServiceAccount, NetworkPolicy and similar), with no
+  serviceaccounts/token, pods, Secret objects, impersonate or RBAC
+  escalate/bind. ops-mason's bundles name that context (expected_context), and
+  the admin kubeconfig leaves the agent's default path.
+  (b) As (a), with the admin kubeconfig reachable only through an attended
+  warden access lane, the same as the OpenBao platform-admin login.
+  (c) Accept for now (build phase) and record it as a known gap with a review
+  date.
+  Cluster RBAC and the kubeconfig distribution belong to railiance-platform
+  (and railiance-infra for node credentials); this is a founder decision.
+updated: '2026-10-18T00:00:00Z'
+```

workplans/MASON-WP-0015-construct-grant.md

@@ -113,7 +113,7 @@ only. They edit their own files.
 
 ```task
 id: MASON-WP-0015-T06
-status: todo
+status: wait
 priority: medium
 state_hub_task_id: "feb17422-9490-51f4-a62d-55647a5f6b05"
 ```
@@ -125,6 +125,11 @@ binds roles to (`kubectl auth can-i`). `kubernetes_plane` already refuses
 the Pod and Secret kinds. Record the result in INTENT.md's
 `kubernetes-plane-apply` entry.
 
+Result 2026-10-18: **open.** The kube identity is system:admin
+(system:masters). It can create serviceaccounts/token, pods and impersonate,
+cluster-wide. Raised as MASON-IN-0006; this waits on the founder's decision
+there.
+
 ## Submit CCRs from approved plans (RPF-WP-0061)
 
 ```task