coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

feat: adopt security zones and explicit workload refs
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
This commit is contained in:
tegwick 2026-08-22 15:36:37 +02:00
parent 12c637cbf2
commit 7ce58ae638
52 changed files with 1547 additions and 658 deletions
Download patch file Download diff file Expand all files Collapse all files

51
wiki/OpsWardenConfig.md
View file

@ -36,11 +36,19 @@ ca_key: ~/.ssh/ops-ca-user
inventory_path: ~/.config/warden/inventory.yaml
state_dir: ~/.local/state/warden
# Optional flex-auth gate (default off — see wiki/PolicyGatedSigning.md)
# Zone-aware flex-auth gate. With no URL, the explicit unknown/build profile
# fails open and records that no evaluator decision was available.
policy:
enabled: false
flex_auth_url: http://127.0.0.1:8080
fail_closed: true
zone_registry_path: /path/to/compiled-flex-auth-registry.json
failure_modes:
z0-experimental: fail_open
z1-operational: fail_open
z2-protected: fail_open
z2-continuity: fail_open
z3-critical: fail_closed
unknown: fail_open
not-applicable: fail_closed
```
### Bootstrapping the local CA key
@ -85,11 +93,10 @@ vault:
inventory_path: ~/.config/warden/inventory.yaml
state_dir: ~/.local/state/warden
# Enable after flex-auth ssh-certificate policies are deployed:
# Configure after flex-auth ssh-certificate policies are deployed:
# policy:
# enabled: true
# flex_auth_url: http://flex-auth.flex-auth.svc.cluster.local:8080
# fail_closed: true
# flex_auth_url: http://flex-auth-ops-warden.flex-auth.svc.cluster.local:8080
# zone_registry_path: /etc/warden/production_registry_snapshot.json
```
### Example — in-cluster caller (pod or trusted host)
@ -235,22 +242,36 @@ hosts:
---
## Policy gate (flex-auth, opt-in)
## Policy gate (flex-auth, zone-aware)
When `policy.enabled: true`, `warden sign` and `warden issue` call flex-auth
`POST /v1/check` before signing. Deny or unreachable (with `fail_closed: true`)
blocks issuance. Allowed decisions store `policy_decision_id` in `signatures.log`.
`warden sign` and `warden issue` evaluate flex-auth whenever a URL is configured.
The target resource's compiled `security_zone` selects the local PEP failure
mode. A rendered deny always blocks; evaluator failure blocks or proceeds per
zone. Signing records `policy_decision_id` when present plus `policy_zone`,
`policy_failure_mode`, and `policy_outcome`.
```yaml
policy:
enabled: false # default — no behavior change
flex_auth_url: http://127.0.0.1:8080
fail_closed: true # deny when flex-auth unreachable
zone_registry_path: registry/flex-auth/production_registry_snapshot.json
failure_modes:
z0-experimental: fail_open
z1-operational: fail_open
z2-protected: fail_open
z2-continuity: fail_open
z3-critical: fail_closed
unknown: fail_open
not-applicable: fail_closed
tenant: tenant:platform
subject_env: WARDEN_POLICY_SUBJECT
system: ops-warden
```
`policy.enabled` and the global `policy.fail_closed` are retired; configuration
loading rejects them with a migration error. Stance is owned by flex-auth's
versioned policy package, not this block. The failure-mode map is PEP behavior
for an unavailable or invalid evaluator.
Full request shape and rollout notes: `wiki/PolicyGatedSigning.md`.
---
@ -261,7 +282,7 @@ Full request shape and rollout notes: `wiki/PolicyGatedSigning.md`.
|----------|---------|-------------|
| `WARDEN_CONFIG` | `~/.config/warden/warden.yaml` | Config file path |
| `VAULT_TOKEN` | — | API token for `backend: vault` (OpenBao or Vault; name configurable via `vault.token_env`) |
| `WARDEN_POLICY_SUBJECT` | — | IAM subject id for flex-auth checks (when `policy.enabled`) |
| `WARDEN_POLICY_SUBJECT` | — | IAM subject id for flex-auth checks |
---
@ -284,4 +305,4 @@ tunnels:
`ops-bridge` runs `cert_command` before each SSH launch, captures stdout as the cert,
and passes it alongside the private key via `ssh -i <key> -i <cert>`.
See `wiki/CertCommandInterface.md` for the full contract and
`wiki/playbooks/ops-bridge-tunnel-cert.md` for static-key → cert_command migration.
`wiki/playbooks/ops-bridge-tunnel-cert.md` for static-key → cert_command migration.