coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Name the verified reuse-surface hub-writer login

Browse source 
CCR-2026-0044 is applied. Member and non-member receipts passed on
2026-10-14: the member token holds only
workload-kv-read-reuse-surface-runtime, and a non-member login is
refused. The catalog auth_method is now that OIDC role. The proxy still
uses the ambient token and does not vend the hub writer value.

Assistant: grok
Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0
This commit is contained in:
tegwick 2026-10-14 22:20:15 +02:00
parent 638cc9233b
commit 402b008986
3 changed files with 21 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

15
registry/routing/catalog.yaml
View file

@ -663,15 +663,12 @@ entries:
# reuse/reuse-surface-runtime SecretSynced to reuse-surface-env on Railiance01;
# positive + negative access verified. Production consumer is ESO; warden access
# proxies reads as the caller and never holds the value.
# Data-plane identity is whichever token the OpenBao CLI resolves
# (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token). That is not the
# flex-auth caller. CCR-2026-0005 does not bind an OIDC role. The only
# live binding is Kubernetes role reuse-surface-runtime-eso.
# CCR-2026-0044 (proposed, railiance-platform) reserves a dedicated
# caller. ops-mason (MASON-WP-0011) says that role stays out of
# auth_method until member and non-member verification both pass.
# platform-admin must not receive the scoped policy. See the playbook.
auth_method: "ambient OpenBao token (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token); dedicated caller unnamed until CCR-2026-0044 is approved and member plus non-member verification pass"
# Dedicated caller: CCR-2026-0044 applied. Group reuse-surface-hub-writers,
# assurance aal2, policy workload-kv-read-reuse-surface-runtime only.
# Member and non-member receipts passed 2026-10-14 (ops-mason). The proxy
# still uses the ambient token after this login. platform-admin must not
# receive the scoped policy. ESO stays on reuse-surface-runtime-eso.
auth_method: "bao login -method=oidc -path=netkingdom role=reuse-surface-hub-writer-workload-kv-read"
path_template: "platform/workloads/reuse/reuse-surface/runtime-secrets"
fetch_command: "bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets"
policy_ref: "flex-auth check secret.read:reuse"