From c8b3e062cceda58d8f422235511ac22290583a62 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 22 Oct 2026 09:11:50 +0200 Subject: [PATCH] MASON-WP-0015-T06: record the profile builder identity Login shells export KUBECONFIG to the builder file. The 2026-10-22T07:11:18Z login-shell capture is no for token mint, pod create, and impersonation. Assistant: grok Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a --- INTENT.md | 2 +- intakes/intakes.md | 18 ++++++++++-------- workplans/MASON-WP-0015-construct-grant.md | 14 +++++++------- 3 files changed, 18 insertions(+), 16 deletions(-) diff --git a/INTENT.md b/INTENT.md index b67d23e..700d269 100644 --- a/INTENT.md +++ b/INTENT.md @@ -164,7 +164,7 @@ tooling_contacts: until: "2026-12-21" rule: "Direct ADMINISTER under activation=APPROVED, each change recorded as production-tier, until ArgoCD onboarding." relies_on_limits: "One expected namespace per plan; Pod and Secret kinds refused; no data or stringData. Widening them is a new decision." - identity_gap: "2026-10-22: founder choice (b) is installed, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. Context default is user ops-mason-builder. Captured 2026-10-22T06:56:46Z: create serviceaccounts --subresource=token no, create pods no, impersonate serviceaccounts no. kubectl 1.35 parses serviceaccounts/token as a ServiceAccount named token, so that form stays yes; the token subresource is the mint check. The admin path is attended warden lane kubernetes-railiance01-admin, which was resolvable before the default path stopped being cluster-admin. The admin file /home/worsch/.kube/config-railiance01 still answers as system:admin. Refusing Pod and Secret kinds remains a code limit in kubernetes_plane as well as an RBAC limit. T06 is done." + identity_gap: "2026-10-22: founder choice (b) is installed, decision 30d29060-8d14-4a8e-9cde-34aa826eb8d1. Login shells export KUBECONFIG to ~/.kube/config-ops-mason-builder. Captured 2026-10-22T07:11:18Z from bash --login -i with that value left set: user ops-mason-builder, create serviceaccounts --subresource=token no, create pods no, impersonate serviceaccounts no. kubectl 1.35 parses serviceaccounts/token as a ServiceAccount named token, so that form stays yes; the token subresource is the mint check. The admin path is attended warden lane kubernetes-railiance01-admin. The admin file ~/.kube/config-railiance01 still answers as system:admin. Refusing Pod and Secret kinds remains a code limit in kubernetes_plane as well as an RBAC limit. T06 is done." enforcement: "src/ops_mason/readiness.py: inspect_readiness and resolve_tier; kubernetes_plane.apply refuses before Kubernetes writes. Source/history verification, explicit whitehat placement, dated policy-nexus transition, and recorded BREAK_GLASS." - id: bao-session-grant shape: "5.2" diff --git a/intakes/intakes.md b/intakes/intakes.md index 6e290f7..d3c259f 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -259,13 +259,15 @@ description: >- name-only, all namespaces: create serviceaccounts/token yes, create pods yes, impersonate serviceaccounts yes. Still cluster-admin. 2026-10-22: founder Bernd Worsch chose (b), hub decision - 30d29060-8d14-4a8e-9cde-34aa826eb8d1. Installed the same day. Context default - is user ops-mason-builder. Captured 2026-10-22T06:56:46Z: create - serviceaccounts --subresource=token no, create pods no, impersonate - serviceaccounts no. kubectl 1.35 parses serviceaccounts/token as a - ServiceAccount named token, so that form stays yes; the token subresource - is the mint check. The admin path is attended warden lane - kubernetes-railiance01-admin. This is not an open unimplemented + 30d29060-8d14-4a8e-9cde-34aa826eb8d1. Installed the same day. Login shells + export KUBECONFIG to ~/.kube/config-ops-mason-builder. Captured + 2026-10-22T07:11:18Z from bash --login -i with that value left set: user + ops-mason-builder, create serviceaccounts --subresource=token no, create + pods no, impersonate serviceaccounts no. The attended file + ~/.kube/config-railiance01 answers as system:admin. kubectl 1.35 parses + serviceaccounts/token as a ServiceAccount named token, so that form stays + yes; the token subresource is the mint check. The admin path is attended + warden lane kubernetes-railiance01-admin. This is not an open unimplemented cluster-admin gap. Certificate renewal is MASON-IN-0008. Side note: ~/.kube/config-hosteurope points at 127.0.0.1:16443, where nothing is listening, but the railiance-platform runbooks still reference it. @@ -282,7 +284,7 @@ options: >- date. Cluster RBAC and the kubeconfig distribution belong to railiance-platform (and railiance-infra for node credentials); this is a founder decision. -updated: '2026-10-22T06:56:46Z' +updated: '2026-10-22T07:11:18Z' state_hub_intake_id: "01a14ea8-3bd8-7da1-b51e-849067a39aff" ``` diff --git a/workplans/MASON-WP-0015-construct-grant.md b/workplans/MASON-WP-0015-construct-grant.md index d4f4cd0..7b8bf69 100644 --- a/workplans/MASON-WP-0015-construct-grant.md +++ b/workplans/MASON-WP-0015-construct-grant.md @@ -142,18 +142,18 @@ pattern as the OpenBao platform-admin login. Cluster RBAC is unchanged. railiance-platform installs that identity. Asked in message `c3d0dc66-bd52-4d5c-a0a2-2c30cec73ab2`. -2026-10-22: **done.** User `ops-mason-builder`, context `default`, captured -2026-10-22T06:56:46Z. `create serviceaccounts --subresource=token` **no**, -`create pods` **no**, `impersonate serviceaccounts` **no**. kubectl 1.35 +2026-10-22: **done.** Login shells export `KUBECONFIG` to +`~/.kube/config-ops-mason-builder`. Captured 2026-10-22T07:11:18Z from +`bash --login -i` with that value left set: user `ops-mason-builder`, +`create serviceaccounts --subresource=token` **no**, `create pods` **no**, +`impersonate serviceaccounts` **no**. The same shell's attended file +`~/.kube/config-railiance01` answers as `system:admin`. kubectl 1.35 parses `serviceaccounts/token` as a ServiceAccount named `token`, so that form stays yes; the token subresource is the mint check and is no. Choice (b) on decision `30d29060-8d14-4a8e-9cde-34aa826eb8d1`. railiance-platform commits `bd6660a` and `e594350` hold the ClusterRole. The attended lane is ops-warden `kubernetes-railiance01-admin` (`537d551`), resolvable before the -default path changed. The admin file stays -`/home/worsch/.kube/config-railiance01` and still answers as `system:admin` -through that lane. The default path is the builder. Client certificate -renewal is MASON-IN-0008. +default path changed. Client certificate renewal is MASON-IN-0008. ## Submit CCRs from approved plans (RPF-WP-0061)