Name a dedicated reuse-surface hub-writer caller.
CCR-2026-0005 does not name a principal, and the platform-admin entity must not receive the workload policy. Add the draft role, verifier, and plan, drop the retired operators/nextcloud description, and record that tegwick's MFA factor is enrolled. Assistant: grok Assistant-Session: 01a13b2d-5f6d-7a32-b2c9-384625c55ca6
This commit is contained in:
parent
6434877a44
commit
fd2c5a5904
12 changed files with 841 additions and 17 deletions
|
|
@ -0,0 +1,109 @@
|
|||
id: CCR-DRAFT-REUSE-SURFACE-HUB-WRITER
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: Name the dedicated reuse-surface hub-writer caller
|
||||
status: proposed
|
||||
created: '2026-10-14'
|
||||
updated: '2026-10-14'
|
||||
requester:
|
||||
agent: ops-mason
|
||||
reason: 'CUST-WP-0081 / State Hub message 08b254af. CCR-2026-0005 is active and
|
||||
does not name a caller. Entity 4a1f663c-0621-0483-edd0-f852274f4b6b carries
|
||||
default, operator-custody and platform-admin, so its token can reach the data
|
||||
path, the metadata path and siblings. Do not attach workload-kv-read-reuse-surface-runtime
|
||||
to that entity. Bind a new OIDC role to a different principal. No secret value
|
||||
is rotated or read by this request.'
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- reuse-surface-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: reuse
|
||||
workload: reuse-surface
|
||||
environment: production
|
||||
purpose: Attended read of the existing hub writer token by one dedicated caller.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/reuse/reuse-surface/runtime-secrets
|
||||
fields:
|
||||
- REUSE_SURFACE_TOKEN
|
||||
- REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
|
||||
policy_name: workload-kv-read-reuse-surface-runtime
|
||||
policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime.hcl
|
||||
metadata_read: true
|
||||
token_self_lifecycle: true
|
||||
auth:
|
||||
method: oidc
|
||||
mount: netkingdom
|
||||
role: reuse-surface-hub-writer-workload-kv-read
|
||||
allowed_redirect_uris:
|
||||
- http://localhost:8250/oidc/callback
|
||||
- http://127.0.0.1:8250/oidc/callback
|
||||
- http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
|
||||
oidc_scopes:
|
||||
- openid
|
||||
- profile
|
||||
- email
|
||||
- groups
|
||||
user_claim: sub
|
||||
groups_claim: groups
|
||||
bound_claims_type: string
|
||||
bound_claims:
|
||||
groups:
|
||||
- reuse-surface-hub-writers
|
||||
/assurance/level: aal2
|
||||
bound_claims_confirmed: false
|
||||
policies:
|
||||
- workload-kv-read-reuse-surface-runtime
|
||||
ttl: 15m
|
||||
token_max_ttl: 30m
|
||||
token_explicit_max_ttl: 30m
|
||||
token_no_default_policy: true
|
||||
token_type: service
|
||||
access_frontdoor:
|
||||
type: ops-warden
|
||||
catalog_id: reuse-surface-hub-write-token
|
||||
selector: reuse-surface federation hub write bearer token
|
||||
command: 'After a passing member receipt, run warden access reuse-surface-hub-write-token
|
||||
--exec --field REUSE_SURFACE_TOKEN -- <silent helper> with the unprinted lane
|
||||
token. Do not use --fetch.'
|
||||
resolvable: false
|
||||
readiness: pending-review
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- REUSE_SURFACE_TOKEN writes to the production federation hub. This request does
|
||||
not read or rotate it.
|
||||
- The platform-admin entity must not receive this policy. OpenBao merges entity
|
||||
policies into every token for that entity.
|
||||
- The ESO policy workload-kv-read-reuse-surface-runtime-eso stays on its Kubernetes
|
||||
role. This role does not attach it.
|
||||
- bound_claims_confirmed stays false until key-cape confirms group reuse-surface-hub-writers
|
||||
and a member entity other than 4a1f663c-0621-0483-edd0-f852274f4b6b.
|
||||
- Public bao.coulomb.social ingress is not a callback. Use the workstation tunnel.
|
||||
verification:
|
||||
positive:
|
||||
- A member token's policy set is exactly workload-kv-read-reuse-surface-runtime.
|
||||
- That token's capabilities are read on the exact data path and the exact metadata path.
|
||||
negative:
|
||||
- The same token is deny on platform/data/workloads/reuse/reuse-surface, its metadata
|
||||
parent, and platform/data/workloads/issue-core/issue-core/issue-core-runtime.
|
||||
- A principal outside reuse-surface-hub-writers is refused by the role.
|
||||
- Entity 4a1f663c-0621-0483-edd0-f852274f4b6b is not the member token's entity.
|
||||
activation_conditions:
|
||||
- platform-operator and reuse-surface-owner approve this caller binding.
|
||||
- key-cape confirms the group and that the member entity has no platform-admin or
|
||||
operator-custody identity policy.
|
||||
- Founder applies policy and role through the delegated applier. No KV write.
|
||||
- scripts/verify-reuse-surface-hub-writer.py member and non-member both pass.
|
||||
Receipts stay mode 0600 and contain no token or field value.
|
||||
lifecycle:
|
||||
deactivate: delete auth/netkingdom/role/reuse-surface-hub-writer-workload-kv-read.
|
||||
Leave the KV path, the ESO role, and CCR-2026-0005 delivery in place.
|
||||
rotate: unchanged from CCR-2026-0005. This request does not rotate field values.
|
||||
compromised: detach the role, revoke outstanding tokens for the role, and follow
|
||||
the CCR-2026-0005 compromise procedure if a field value was exposed.
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"role_type": "oidc",
|
||||
"allowed_redirect_uris": [
|
||||
"http://localhost:8250/oidc/callback",
|
||||
"http://127.0.0.1:8250/oidc/callback",
|
||||
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
|
||||
],
|
||||
"oidc_scopes": ["openid", "profile", "email", "groups"],
|
||||
"user_claim": "sub",
|
||||
"groups_claim": "groups",
|
||||
"bound_claims_type": "string",
|
||||
"bound_claims": {
|
||||
"groups": ["reuse-surface-hub-writers"],
|
||||
"/assurance/level": "aal2"
|
||||
},
|
||||
"token_policies": ["workload-kv-read-reuse-surface-runtime"],
|
||||
"token_no_default_policy": true,
|
||||
"token_type": "service",
|
||||
"token_ttl": "15m",
|
||||
"token_max_ttl": "30m",
|
||||
"token_explicit_max_ttl": "30m",
|
||||
"verbose_oidc_logging": false
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
# Caller policy for the reuse-surface hub writer.
|
||||
# Exact data and metadata read. Sibling and parent paths are not granted.
|
||||
# Self lookup and revoke match credential-change.py generated_policy_hcl when
|
||||
# metadata_read and token_self_lifecycle are true. No capabilities-self grant:
|
||||
# the attended verifier queries sys/capabilities with the operator token.
|
||||
# Do not attach this policy to entity 4a1f663c-0621-0483-edd0-f852274f4b6b.
|
||||
|
||||
path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/lookup-self" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/revoke-self" {
|
||||
capabilities = ["update"]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue