diff --git a/.custodian-brief.md b/.custodian-brief.md index 1e3ed36..4731457 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,16 @@ # Custodian Brief — ops-mason **Domain:** infotech -**Last synced:** 2026-10-18 10:45 UTC +**Last synced:** 2026-10-18 10:53 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Restore ops-mason as the OpenBao builder: the ops-mason-construct grant -Progress: 4/7 done | workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804` +Progress: 5/7 done | workplan_id: `384b3efc-f9a5-5ea9-b224-0ce900e79804` **Open tasks:** - ! Submit CCRs from approved plans (RPF-WP-0061) `ebc420c6` -- · Executor and post-build check `7b7a436f` - · Close the Kubernetes variant `feb17422` ### Describe every stored credential so the store is navigable diff --git a/INTENT.md b/INTENT.md index b66ff1b..1ea5148 100644 --- a/INTENT.md +++ b/INTENT.md @@ -164,6 +164,7 @@ tooling_contacts: until: "2026-12-21" rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding." relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision." + identity_gap: "2026-10-18 (MASON-IN-0006): the kube identity applied with is system:admin (system:masters). Refusing Pod and Secret kinds is a code limit in kubernetes_plane, not an RBAC limit; the identity can mint any ServiceAccount token." enforcement: "src/ops_mason/readiness.py: inspect_readiness and resolve_tier; kubernetes_plane.apply refuses before Kubernetes writes. Source/history verification, explicit whitehat placement, dated policy-nexus transition, and recorded BREAK_GLASS." - id: bao-session-grant shape: "5.2" diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 08540a1..2696695 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -98,7 +98,7 @@ | task | MASON-WP-0015-T01 | done | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T02 | done | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T03 | done | — | workplans/MASON-WP-0015-construct-grant.md | -| task | MASON-WP-0015-T04 | todo | — | workplans/MASON-WP-0015-construct-grant.md | +| task | MASON-WP-0015-T04 | done | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T05 | done | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T06 | todo | — | workplans/MASON-WP-0015-construct-grant.md | | task | MASON-WP-0015-T07 | wait | — | workplans/MASON-WP-0015-construct-grant.md | diff --git a/intakes/intakes.md b/intakes/intakes.md index e8e7fb8..d70cd2a 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -228,3 +228,46 @@ resolution: >- updated: '2026-10-18T00:00:00Z' state_hub_intake_id: "01a14e6a-47d0-7e1d-bc28-2908e7c50b35" ``` + +## MASON-IN-0006 — The agent kubeconfig is cluster-admin, so any OpenBao Kubernetes role can be assumed + +```yaml +id: MASON-IN-0006 +kind: intake +title: The agent kubeconfig is cluster-admin, so any OpenBao Kubernetes role can be assumed +status: open +origin: review +origin_ref: MASON-WP-0015-T06 (2026-10-18) +priority: high +owner: ops-mason +requested_by: ops-mason +description: >- + The kubeconfig ops-mason applies with on the workstation (~/.kube/config and + config-railiance01, context default, server 127.0.0.1:16444 over the + k3s-api-railiance01 tunnel) authenticates as system:admin in system:masters. + kubectl auth can-i, 2026-10-18: create serviceaccounts/token, create pods and + impersonate serviceaccounts are all yes in mas and cluster-wide. An agent + session holding it can mint a token for any ServiceAccount bound to an + OpenBao Kubernetes role and log in to OpenBao as that workload, and can read + Kubernetes Secret objects directly. This bypasses the ops-mason-construct + "never log in" invariant (MASON-IN-0005) and every per-lane OpenBao scope. + The only control against Secret reads is the guard-secret-reads transcript + hook, which is a convention, not access control. Checked by capability + queries only; not exercised. + Side note: ~/.kube/config-hosteurope points at 127.0.0.1:16443, where nothing + is listening, but the railiance-platform runbooks still reference it. +options: >- + (a) A dedicated, scoped kube identity for ops-mason (client certificate or + ServiceAccount token) whose RBAC covers only the kinds kubernetes_plane + applies (Namespace, ServiceAccount, NetworkPolicy and similar), with no + serviceaccounts/token, pods, Secret objects, impersonate or RBAC + escalate/bind. ops-mason's bundles name that context (expected_context), and + the admin kubeconfig leaves the agent's default path. + (b) As (a), with the admin kubeconfig reachable only through an attended + warden access lane, the same as the OpenBao platform-admin login. + (c) Accept for now (build phase) and record it as a known gap with a review + date. + Cluster RBAC and the kubeconfig distribution belong to railiance-platform + (and railiance-infra for node credentials); this is a founder decision. +updated: '2026-10-18T00:00:00Z' +``` diff --git a/workplans/MASON-WP-0015-construct-grant.md b/workplans/MASON-WP-0015-construct-grant.md index a0ad419..69ff0d8 100644 --- a/workplans/MASON-WP-0015-construct-grant.md +++ b/workplans/MASON-WP-0015-construct-grant.md @@ -113,7 +113,7 @@ only. They edit their own files. ```task id: MASON-WP-0015-T06 -status: todo +status: wait priority: medium state_hub_task_id: "feb17422-9490-51f4-a62d-55647a5f6b05" ``` @@ -125,6 +125,11 @@ binds roles to (`kubectl auth can-i`). `kubernetes_plane` already refuses the Pod and Secret kinds. Record the result in INTENT.md's `kubernetes-plane-apply` entry. +Result 2026-10-18: **open.** The kube identity is system:admin +(system:masters). It can create serviceaccounts/token, pods and impersonate, +cluster-wide. Raised as MASON-IN-0006; this waits on the founder's decision +there. + ## Submit CCRs from approved plans (RPF-WP-0061) ```task