tegwick
a41312e5a4
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
64 lines
2.4 KiB
JSON
64 lines
2.4 KiB
JSON
{
|
|
"scope": "source-only _ccr target/auth/lifecycle projection; proposed successor public build remains refused",
|
|
"target": {
|
|
"domain": "infotech",
|
|
"tenant": "platform",
|
|
"workload": "forgejo",
|
|
"environment": "production",
|
|
"purpose": "The consuming service reads the same secret. No metadata, list, parent or sibling access."
|
|
},
|
|
"openbao": {
|
|
"mount": "platform",
|
|
"kv_path": "platform/workloads/keycape/forgejo",
|
|
"fields": [
|
|
"CLIENT_SECRET"
|
|
],
|
|
"policy_name": "workload-kv-read-keycape-forgejo-forgejo",
|
|
"policy_file": "openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl",
|
|
"metadata_read": false,
|
|
"token_self_lifecycle": true,
|
|
"auth": {
|
|
"method": "kubernetes",
|
|
"mount": "kubernetes",
|
|
"role": "external-secrets-keycape-forgejo-forgejo",
|
|
"audience": "openbao",
|
|
"ttl": "15m",
|
|
"token_max_ttl": "15m",
|
|
"token_explicit_max_ttl": "15m",
|
|
"token_no_default_policy": true,
|
|
"policies": [
|
|
"workload-kv-read-keycape-forgejo-forgejo"
|
|
],
|
|
"bound_claims": {
|
|
"service_account_names": [
|
|
"forgejo-keycape-forgejo-eso"
|
|
],
|
|
"service_account_namespaces": [
|
|
"forgejo"
|
|
]
|
|
},
|
|
"bound_claims_confirmed": false
|
|
}
|
|
},
|
|
"lifecycle": {
|
|
"deactivate": "Revert the consumer reference first; remove only independently proved case-created delivery objects, role and policy, preserving preexisting-matched and shared objects. Revoke issued reader tokens through owner custody or prove independently verified expiry before declaring deactivation; role/SA/store deletion alone does not revoke tokens. Recovery uses existing owner admission: no new login and no remint. Preserve authenticated creation/ownership/recovery receipts and stop on changed references, UIDs or ownership.",
|
|
"rotate": "roll-forward through the credential broker (mint-secret); never a read of the old value",
|
|
"compromised": "owner incident process; no automatic read, reseed or cleanup"
|
|
},
|
|
"live_apply": false,
|
|
"acceptance_inferred": false,
|
|
"current1.1_output_checks": [
|
|
{
|
|
"policy": "keycape-reader-policy",
|
|
"changed_fields": [],
|
|
"keycape_output_byte_semantics_preserved": true
|
|
},
|
|
{
|
|
"policy": "consumer-reader-policy",
|
|
"changed_fields": [
|
|
"target.workload"
|
|
],
|
|
"keycape_output_byte_semantics_preserved": false
|
|
}
|
|
]
|
|
}
|