coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0015-T06: apply as the scoped ops-mason-builder identity

Browse source 
The default path is user ops-mason-builder. Token mint, pod create, and
serviceaccount impersonation are no. Admin stays on the attended warden lane.
Negative-scope verify treats a denied get as the proof, and the CCR test
interpreter can import the platform generator.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a
This commit is contained in:
tegwick 2026-10-22 08:58:21 +02:00
parent ede8aee129
commit 57773aa8a2
8 changed files with 299 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

22
workplans/MASON-WP-0015-construct-grant.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Restore ops-mason as the OpenBao builder: the ops-mason-construct grant"
domain: infotech
repo: ops-mason
status: active
status: finished
owner: claude
topic_slug: netkingdom-security-architecture
created: "2026-10-18"
@ -113,10 +113,8 @@ only. They edit their own files.
```task
id: MASON-WP-0015-T06
status: wait
status: done
priority: medium
blocked_on: message-from:railiance-platform
blocking_reason: "Founder chose MASON-IN-0006 (b) on 2026-10-22, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. railiance-platform installs the scoped kube identity and moves the admin kubeconfig to an attended warden lane. The three can-i checks are still yes."
state_hub_task_id: "feb17422-9490-51f4-a62d-55647a5f6b05"
```
@ -142,8 +140,20 @@ kube identity limited to the kinds `kubernetes_plane` applies. The admin
kubeconfig is reachable only through an attended warden access lane, the same
pattern as the OpenBao platform-admin login. Cluster RBAC is unchanged.
railiance-platform installs that identity. Asked in message
`c3d0dc66-bd52-4d5c-a0a2-2c30cec73ab2`. This task stays `wait` until the
three checks are no.
`c3d0dc66-bd52-4d5c-a0a2-2c30cec73ab2`.
2026-10-22: **done.** User `ops-mason-builder`, context `default`, captured
2026-10-22T06:56:46Z. `create serviceaccounts --subresource=token` **no**,
`create pods` **no**, `impersonate serviceaccounts` **no**. kubectl 1.35
parses `serviceaccounts/token` as a ServiceAccount named `token`, so that
form stays yes; the token subresource is the mint check and is no. Choice
(b) on decision `30d29060-8d14-4a8e-9cde-34aa826eb8d1`. railiance-platform
commits `bd6660a` and `e594350` hold the ClusterRole. The attended lane is
ops-warden `kubernetes-railiance01-admin` (`537d551`), resolvable before the
default path changed. The admin file stays
`/home/worsch/.kube/config-railiance01` and still answers as `system:admin`
through that lane. The default path is the builder. Client certificate
renewal is MASON-IN-0008.
## Submit CCRs from approved plans (RPF-WP-0061)