coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Show the OpenBao identity warden access evaluates

Browse source 
reuse-surface-hub-write-token does not select a caller. The data plane
uses the ambient token, which can be the coding-agent role denied by
agent-high-risk-boundary while an attended platform-admin lookup still
shows read. Advisory and proxy output now report that entity, role, and
policies without the token. CCR-2026-0005 still has no OIDC binding for
workload-kv-read-reuse-surface-runtime.

Assistant: grok
Assistant-Session: 01a13b2d-0bc1-7a91-ab1d-325bcfb09bf0
This commit is contained in:
tegwick 2026-10-14 18:21:02 +02:00
parent 6e1430073c
commit 8dbf62515a
6 changed files with 367 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
registry/routing/catalog.yaml
View file

@ -663,7 +663,13 @@ entries:
# reuse/reuse-surface-runtime SecretSynced to reuse-surface-env on Railiance01;
# positive + negative access verified. Production consumer is ESO; warden access
# proxies reads as the caller and never holds the value.
auth_method: "caller's own OpenBao token (operator OIDC via key-cape, or a token carrying workload-kv-read-reuse-surface-runtime)"
# Data-plane identity is whichever token the OpenBao CLI resolves
# (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token). That is not the
# flex-auth caller. CCR-2026-0005 does not bind an OIDC role to
# workload-kv-read-reuse-surface-runtime; the only live binding is the
# ESO Kubernetes role reuse-surface-runtime-eso. platform-admin must not
# receive the scoped policy. See the playbook.
auth_method: "ambient OpenBao token (BAO_TOKEN, then VAULT_TOKEN, then ~/.vault-token); no OIDC role binds workload-kv-read-reuse-surface-runtime"
path_template: "platform/workloads/reuse/reuse-surface/runtime-secrets"
fetch_command: "bao kv get -field=REUSE_SURFACE_TOKEN platform/workloads/reuse/reuse-surface/runtime-secrets"
policy_ref: "flex-auth check secret.read:reuse"