coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015-T06: apply as the scoped ops-mason-builder identity

Browse source 
The default path is user ops-mason-builder. Token mint, pod create, and
serviceaccount impersonation are no. Admin stays on the attended warden lane.
Negative-scope verify treats a denied get as the proof, and the CCR test
interpreter can import the platform generator.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
tegwick 2026-10-22 08:58:21 +02:00
parent ede8aee129
commit 57773aa8a2
8 changed files with 299 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

2
INTENT.md
View file

@ -164,7 +164,7 @@ tooling_contacts:
until: "2026-12-21"
rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding."
relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision."
identity_gap: "2026-10-22: founder chose MASON-IN-0006 (b), decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. A scoped ops-mason identity will apply the plane, and the admin kubeconfig will be an attended warden lane. That identity is not installed. Context default, name-only kubectl auth can-i --all-namespaces at 2026-10-21T23:55:17Z returned yes for create serviceaccounts/token, yes for create pods, and yes for impersonate serviceaccounts. The kube identity applied with is still system:admin (system:masters). Refusing Pod and Secret kinds is a code limit in kubernetes_plane, not an RBAC limit. T06 waits on railiance-platform to install (b)."
identity_gap: "2026-10-22: founder choice (b) is installed, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. Context default is user ops-mason-builder. Captured 2026-10-22T06:56:46Z: create serviceaccounts --subresource=token no, create pods no, impersonate serviceaccounts no. kubectl 1.35 parses serviceaccounts/token as a ServiceAccount named token, so that form stays yes; the token subresource is the mint check. The admin path is attended warden lane kubernetes-railiance01-admin, which was resolvable before the default path stopped being cluster-admin. The admin file /home/worsch/.kube/config-railiance01 still answers as system:admin. Refusing Pod and Secret kinds remains a code limit in kubernetes_plane as well as an RBAC limit. T06 is done."
enforcement: "src/ops_mason/readiness.py: inspect_readiness and resolve_tier; kubernetes_plane.apply refuses before Kubernetes writes. Source/history verification, explicit whitehat placement, dated policy-nexus transition, and recorded BREAK_GLASS."
- id: bao-session-grant
shape: "5.2"