coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Name access-engine as the only authorization decision point.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
This commit is contained in:
tegwick 2026-09-24 09:56:51 +02:00
parent 7e3e91ec25
commit 3dffe60a58
1 changed files with 10 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

19
INTENT.md
View file

@ -130,14 +130,15 @@ owns one lane and points at the rest:
(secrets-engine `exec`, railiance-platform `credential exec`) ops-warden routes to (secrets-engine `exec`, railiance-platform `credential exec`) ops-warden routes to
the owner's front door — it does not mint tokens or run the owner's tool itself. the owner's front door — it does not mint tokens or run the owner's tool itself.
This is the assist layer, not a universal broker: custody stays in OpenBao / This is the assist layer, not a universal broker: custody stays in OpenBao /
secrets-engine / the platform broker; authorization in flex-auth. secrets-engine / the platform broker; authorization in access-engine
(repository `flex-auth`).
3. **Steward workload security posture conformance.** Author the ops-security slice 3. **Steward workload security posture conformance.** Author the ops-security slice
for environment posture (`dev/test/prod`) and workload maturity (`M0-M3`), then for environment posture (`dev/test/prod`) and workload maturity (`M0-M3`), then
ship descriptors and read-only checks that identify whether a secret-flow blocker ship descriptors and read-only checks that identify whether a secret-flow blocker
is real, owner-routed, or removable with a contract double. Runtime enforcement is real, owner-routed, or removable with a contract double. Runtime enforcement
remains flex-auth; custody remains OpenBao. remains access-engine; custody remains OpenBao.
4. **Align** runbooks, wiki, inventory patterns, and scorecard checks with 4. **Align** runbooks, wiki, inventory patterns, and scorecard checks with
NetKingdom canon as the platform evolves (OpenBao-first, flex-auth policy, NetKingdom canon as the platform evolves (OpenBao-first, access-engine policy,
key-cape IAM Profile, railiance deployment layers). key-cape IAM Profile, railiance deployment layers).
5. **Issue** short-lived SSH certificates for `adm` / `agt` / `atm` actors when 5. **Issue** short-lived SSH certificates for `adm` / `agt` / `atm` actors when
host or ops reachability requires the SSH lane — via `warden sign`, host or ops reachability requires the SSH lane — via `warden sign`,
@ -219,7 +220,7 @@ Canonical references:
| OIDC login, MFA, human identity claims | key-cape / Keycloak (NetKingdom IAM Profile) | | OIDC login, MFA, human identity claims | key-cape / Keycloak (NetKingdom IAM Profile) |
| Security doctrine, invariants, authority model | gate-house | | Security doctrine, invariants, authority model | gate-house |
| Policy decision — may actor X access resource Y | access-engine (`flex-auth`) | | Policy decision — may actor X access resource Y | access-engine (`flex-auth`) |
| API keys, provider secrets, DB creds, object-storage STS | OpenBao (+ flex-auth policy where required) | | API keys, provider secrets, DB creds, object-storage STS | OpenBao (+ access-engine policy where required) |
| Inter-Hub operator keys, LLM provider credentials | OpenBao or approved operator secret store | | Inter-Hub operator keys, LLM provider credentials | OpenBao or approved operator secret store |
| Tunnel lifecycle, port forwarding | ops-bridge | | Tunnel lifecycle, port forwarding | ops-bridge |
| `/etc/ssh/auth_principals/`, host hardening | railiance-infra | | `/etc/ssh/auth_principals/`, host hardening | railiance-infra |
@ -342,7 +343,7 @@ ops-warden (issue SSH; route / assist the rest)
+-- Generic API / DB / provider secret? -> OpenBao path +-- Generic API / DB / provider secret? -> OpenBao path
| (warden access proxies as caller when exec_capable) | (warden access proxies as caller when exec_capable)
| |
+-- Authorization required? ------------> flex-auth decision +-- Authorization required? ------------> access-engine decision
| (caller-side gate on sign + access when policy.enabled) | (caller-side gate on sign + access when policy.enabled)
| |
+-- Identity / MFA required? -------------> key-cape / Keycloak path +-- Identity / MFA required? -------------> key-cape / Keycloak path
@ -371,7 +372,7 @@ for one security lane plus operational guidance.
ops-warden should appear in NetKingdom responsibility and pattern material as ops-warden should appear in NetKingdom responsibility and pattern material as
the **operational SSH credential authority**, not as a replacement for the **operational SSH credential authority**, not as a replacement for
OpenBao or flex-auth. OpenBao or access-engine.
--- ---
@ -398,8 +399,8 @@ ops-warden is succeeding when:
## Non-goals ## Non-goals
- Universal credential broker for all secret types - Universal credential broker for all secret types
- Runtime enforcement of the workload secret-flow lattice (flex-auth owns that) - Runtime enforcement of the workload secret-flow lattice (access-engine owns that)
- Replacing OpenBao, flex-auth, key-cape, or railiance deployment ownership - Replacing OpenBao, access-engine, key-cape, or railiance deployment ownership
- Storing Inter-Hub, LLM provider, or other long-lived API keys - Storing Inter-Hub, LLM provider, or other long-lived API keys
- Host-side SSH configuration deployment - Host-side SSH configuration deployment
- **Duplicating or restating another subsystem's procedure** — routing material - **Duplicating or restating another subsystem's procedure** — routing material
@ -416,7 +417,7 @@ ops-warden is succeeding when:
The repository shipped the SSH CA CLI first (WARDEN-WP-0001–0003). The The repository shipped the SSH CA CLI first (WARDEN-WP-0001–0003). The
stewardship and NetKingdom-alignment mission is the **next stratum** — docs, stewardship and NetKingdom-alignment mission is the **next stratum** — docs,
routing canon, inventory standards, production OpenBao SSH engine alignment, routing canon, inventory standards, production OpenBao SSH engine alignment,
flex-auth integration design, and NetKingdom cross-links — without collapsing access-engine integration design, and NetKingdom cross-links — without collapsing
platform boundaries. platform boundaries.
See `wiki/CredentialRouting.md` for worker-facing routing, See `wiki/CredentialRouting.md` for worker-facing routing,