tegwick
7ce58ae638
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1
53 lines
2.1 KiB
YAML
53 lines
2.1 KiB
YAML
# Non-secret production template — copy to ~/.config/warden/warden.yaml
|
|
# Never commit tokens or CA private keys. See wiki/OpsWardenConfig.md
|
|
|
|
backend: vault
|
|
|
|
vault:
|
|
addr: https://bao.coulomb.social
|
|
mount: ssh
|
|
role_map:
|
|
adm: adm-role
|
|
agt: agt-role
|
|
atm: atm-role
|
|
token_env: VAULT_TOKEN
|
|
|
|
inventory_path: ~/.config/warden/inventory.yaml
|
|
state_dir: ~/.local/state/warden
|
|
|
|
# Zone-aware flex-auth gate. Missing target membership is the explicit unknown
|
|
# profile; there is no repo-wide enable switch.
|
|
# Registry: registry/flex-auth/production_registry_snapshot.json (build from inventory).
|
|
# See wiki/PolicyGatedSigning.md (operator checklist) and wiki/playbooks/operator-openbao-token-hygiene.md
|
|
policy:
|
|
# The in-cluster pin for ops-warden's signing policy (FLEX-WP-0016). A bare
|
|
# flex-auth.flex-auth.svc Service does not exist. From a workstation, reach it
|
|
# through a port-forward or tunnel and point this at that local address.
|
|
flex_auth_url: http://flex-auth-ops-warden.flex-auth.svc.cluster.local:8080
|
|
zone_registry_path: registry/flex-auth/production_registry_snapshot.json
|
|
failure_modes:
|
|
z0-experimental: fail_open
|
|
z1-operational: fail_open
|
|
z2-protected: fail_open
|
|
z2-continuity: fail_open
|
|
z3-critical: fail_closed
|
|
unknown: fail_open
|
|
not-applicable: fail_closed
|
|
tenant: tenant:platform
|
|
subject_env: WARDEN_POLICY_SUBJECT
|
|
system: ops-warden
|
|
# How ops-warden proves it is ops-warden. flex-auth TokenReviews this bearer
|
|
# token and requires the principal system:serviceaccount:ops-warden:ops-warden
|
|
# for resource.system: ops-warden. Mode none sends no header, which is what
|
|
# holds the pin in warn.
|
|
caller_auth:
|
|
mode: none # none | file | env | command
|
|
# In-cluster PEP — projected ServiceAccount token, audience-bound:
|
|
# mode: file
|
|
# token_path: /var/run/secrets/flex-auth/token
|
|
# Workstation — mint a short-lived bound token per call:
|
|
# mode: command
|
|
# command: kubectl create token ops-warden -n ops-warden
|
|
# --audience flex-auth --duration 10m
|
|
token_env: WARDEN_POLICY_CALLER_TOKEN
|
|
audience: flex-auth
|