tegwick
28386d3b4c
Bundle validates; ESO policy identical to applied CCR-2026-0041. Four fluid-telegram entries drafted from the approved plan; email-connect asked for its new path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 327203@bnt-lap001 Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
36 lines
1.9 KiB
YAML
36 lines
1.9 KiB
YAML
security_case:
|
|
case: forgejo-netkingdom-oidc
|
|
type: oidc-browser-relying-party@1.1
|
|
render_digest: sha256:af1f4f81ef313f5e086e6e3de17197d9112dd40f00b4c20b52b5ca73c7a6d18a
|
|
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
|
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
|
accepted_at: '2026-10-08'
|
|
accepted_by:
|
|
- owner
|
|
- founder
|
|
removes_exactly:
|
|
- kind: catalog_entry
|
|
name: forgejo-keycape-client
|
|
- kind: openbao_role
|
|
name: external-secrets-keycape-forgejo
|
|
- kind: openbao_policy
|
|
name: workload-kv-read-keycape-forgejo-forgejo
|
|
- kind: openbao_policy
|
|
name: workload-kv-read-keycape-forgejo-eso
|
|
- kind: kv_path
|
|
name: platform/workloads/keycape/forgejo
|
|
steps:
|
|
- remove the OIDC source for forgejo from forgejo (owner railiance-apps)
|
|
- keycape-client.py apply --operation remove for forgejo
|
|
- remove env KEYCAPE_FORGEJO_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed
|
|
- delete ExternalSecret sso/keycape-forgejo-client and its target
|
|
- 'covered by client-secret-path: one metadata delete, after deliver-secret is reversed'
|
|
- identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's
|
|
memberships; delete_if_empty only if no other case uses forge-admins,forge-coulomb-owners,forge-coulomb-readers
|
|
- delete metadata and all versions at platform/workloads/keycape/forgejo, after the ExternalSecret is gone (this
|
|
also reverses mint-secret)
|
|
- delete Kubernetes-auth role external-secrets-keycape-forgejo
|
|
- delete policy workload-kv-read-keycape-forgejo-eso, after eso-role
|
|
- delete policy workload-kv-read-keycape-forgejo-forgejo
|
|
- remove catalog entry forgejo-keycape-client
|
|
note: Undo removes only what this case created; shared groups are revoked only if no other case uses them.
|