tegwick
0a331413a2
flex-auth's flex-auth-ops-warden pin (FLEX-WP-0016) TokenReviews the caller and binds resource.system: ops-warden to system:serviceaccount:ops-warden:ops-warden. policy.py posted /v1/check with no Authorization header, so the pin logs "caller authentication warning" and can only run callerAuth.mode: warn — which, under ADHOC-2026-08-17-T01, is exactly what blocks policy.enabled: true. - policy.caller_auth (none | file | env | command) + src/warden/caller_identity.py: token resolved per call, never cached, written, or logged (ADR-0002) - both check_sign_policy and check_fetch_policy attach the bearer header; an unobtainable token fails closed rather than retrying anonymously - scripts/check_policy_caller_identity.py: read-only gate, prints length and a truncated fingerprint only, distinguishes 401 (audience/binding) from 403 - example config: caller_auth block, and flex_auth_url corrected — it pointed at flex-auth.flex-auth.svc, a Service that does not exist - WARDEN-WP-0031, PolicyGatedSigning caller-identity section and flip sequence Default stays mode: none, so behaviour is unchanged until an operator opts in. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
47 lines
No EOL
1.9 KiB
YAML
47 lines
No EOL
1.9 KiB
YAML
# Non-secret production template — copy to ~/.config/warden/warden.yaml
|
|
# Never commit tokens or CA private keys. See wiki/OpsWardenConfig.md
|
|
|
|
backend: vault
|
|
|
|
vault:
|
|
addr: https://bao.coulomb.social
|
|
mount: ssh
|
|
role_map:
|
|
adm: adm-role
|
|
agt: agt-role
|
|
atm: atm-role
|
|
token_env: VAULT_TOKEN
|
|
|
|
inventory_path: ~/.config/warden/inventory.yaml
|
|
state_dir: ~/.local/state/warden
|
|
|
|
# Opt-in flex-auth gate — enable only when flex-auth is reachable at flex_auth_url.
|
|
# Registry: registry/flex-auth/production_registry_snapshot.json (build from inventory).
|
|
# See wiki/PolicyGatedSigning.md (operator checklist) and wiki/playbooks/operator-openbao-token-hygiene.md
|
|
policy:
|
|
# Keep false until the flex-auth ops-warden pin runs callerAuth.mode: enforce.
|
|
# Gate: python scripts/check_policy_caller_identity.py (WARDEN-WP-0031)
|
|
enabled: false
|
|
# The in-cluster pin for ops-warden's signing policy (FLEX-WP-0016). A bare
|
|
# flex-auth.flex-auth.svc Service does not exist. From a workstation, reach it
|
|
# through a port-forward or tunnel and point this at that local address.
|
|
flex_auth_url: http://flex-auth-ops-warden.flex-auth.svc.cluster.local:8080
|
|
fail_closed: true
|
|
tenant: tenant:platform
|
|
subject_env: WARDEN_POLICY_SUBJECT
|
|
system: ops-warden
|
|
# How ops-warden proves it is ops-warden. flex-auth TokenReviews this bearer
|
|
# token and requires the principal system:serviceaccount:ops-warden:ops-warden
|
|
# for resource.system: ops-warden. Mode none sends no header, which is what
|
|
# holds the pin in warn.
|
|
caller_auth:
|
|
mode: none # none | file | env | command
|
|
# In-cluster PEP — projected ServiceAccount token, audience-bound:
|
|
# mode: file
|
|
# token_path: /var/run/secrets/flex-auth/token
|
|
# Workstation — mint a short-lived bound token per call:
|
|
# mode: command
|
|
# command: kubectl create token ops-warden -n ops-warden
|
|
# --audience flex-auth --duration 10m
|
|
token_env: WARDEN_POLICY_CALLER_TOKEN
|
|
audience: flex-auth |