Review exact native signer custody and manual Argo plan
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
codex
parent
84c529f239
commit
08c1f036f2
4 changed files with 644 additions and 1 deletions
|
|
@ -19,7 +19,10 @@ review:
|
|||
- access-engine-owner
|
||||
- secrets-engine-owner
|
||||
- cluster-runtime-storage-owner
|
||||
comments: []
|
||||
comments:
|
||||
- reviewer: railiance-platform-owner (agent railiance-platform, codex)
|
||||
decision: approved
|
||||
comment: "INTENT Secure Custody/Stable Interfaces/Operable and Observable; RPF-WP-0035-T12. Approved Platform source/plan review only for frozen P4 manifest sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3 and R2 manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59; own bounded review artifact docs/evidence/2026-10-16-flex-auth-native-plan-review.json; sanitized supplement sha256:f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c. Exact read policy/role/ESO proposal and one-use CAS0 writer stay separate. Identified manual Applications and recovery gates are mandatory. No founder decision, native execution, confirmed bindings or completed admission assent; current proposed status unchanged."
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
|
|
|
|||
|
|
@ -0,0 +1,328 @@
|
|||
{
|
||||
"applications": {
|
||||
"eso-token-renewer": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76246569",
|
||||
"uid": "b10d1e31-08da-4364-b537-4e166eeeb25e"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "eso-token-renewer-worker-5c86dt7fm7",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "CronJob",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/eso-token-renewer",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"informed-decision": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "informed-decision",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76247431",
|
||||
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-c81577741a09",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-workload-registry",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision-workload",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-lifecycle-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRole",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRoleBinding",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "312ab97e876e17341bf16f9e95397e14c2ac2720"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"openbao-secretstore": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "openbao-secretstore",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76247497",
|
||||
"uid": "f2932505-e649-4b99-b505-4789ed21301f"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "ClusterSecretStore",
|
||||
"name": "openbao",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/openbao-secretstore",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"railiance-apps-root": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"automated_present": false,
|
||||
"metadata": {
|
||||
"name": "railiance-apps-root",
|
||||
"namespace": "argocd",
|
||||
"owners": [],
|
||||
"resource_version": "76247264",
|
||||
"uid": "3078d1f5-07c2-44cc-bff7-c2ee2a2c9e7c"
|
||||
},
|
||||
"operation_phase": "Succeeded",
|
||||
"operation_present": false,
|
||||
"resources": [
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "activity-core",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "bao-notice",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision-requester",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "openbao-secretstore",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "secret-annotation-guard",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "state-hub-memo-dispatch",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "target-revenue",
|
||||
"namespace": "argocd"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/railiance01/applications",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "main"
|
||||
},
|
||||
"sources": []
|
||||
},
|
||||
"stderr_present": false
|
||||
}
|
||||
},
|
||||
"held_fence": false,
|
||||
"objects": {
|
||||
"deployment/flex-auth-secrets-engine": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"conditions": [
|
||||
{
|
||||
"reason": "NewReplicaSetAvailable",
|
||||
"status": "True",
|
||||
"type": "Progressing"
|
||||
},
|
||||
{
|
||||
"reason": "MinimumReplicasAvailable",
|
||||
"status": "True",
|
||||
"type": "Available"
|
||||
}
|
||||
],
|
||||
"field_managers": [
|
||||
{
|
||||
"manager": "helm",
|
||||
"operation": "Update"
|
||||
},
|
||||
{
|
||||
"manager": "k3s",
|
||||
"operation": "Update"
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"namespace": "flex-auth",
|
||||
"owners": [],
|
||||
"resource_version": "75291996",
|
||||
"uid": "f83a5f5c-7dd7-4aac-bc02-d447e423e6ae"
|
||||
}
|
||||
},
|
||||
"stderr_present": false
|
||||
},
|
||||
"externalsecret.external-secrets.io/flex-auth-secrets-engine-envelope-signing": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"persistentvolumeclaim/flex-auth-secrets-engine-outbox": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"secretstore.external-secrets.io/openbao-flex-auth-envelope-signing": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"serviceaccount/flex-auth-envelope-signing-eso": {
|
||||
"exists": false,
|
||||
"ok": true
|
||||
},
|
||||
"serviceaccount/flex-auth-secrets-engine": {
|
||||
"exists": true,
|
||||
"ok": true,
|
||||
"selected": {
|
||||
"conditions": [],
|
||||
"field_managers": [
|
||||
{
|
||||
"manager": "helm",
|
||||
"operation": "Update"
|
||||
}
|
||||
],
|
||||
"metadata": {
|
||||
"name": "flex-auth-secrets-engine",
|
||||
"namespace": "flex-auth",
|
||||
"owners": [],
|
||||
"resource_version": "57721771",
|
||||
"uid": "4fd62828-c7b6-47ce-ac44-11b9fab851c4"
|
||||
}
|
||||
},
|
||||
"stderr_present": false
|
||||
}
|
||||
},
|
||||
"observed_at": "2026-10-16T19:12:36.858755+00:00",
|
||||
"persistent_mutations": false,
|
||||
"schema": "platform-native-plan-public-supplement.v1",
|
||||
"transport": {
|
||||
"exit_code": 0,
|
||||
"stderr_present": false
|
||||
},
|
||||
"collector_sha256": "sha256:151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d",
|
||||
"coordinator_completed_at": "2026-10-16T19:12:36.585389+00:00"
|
||||
}
|
||||
302
docs/evidence/2026-10-16-flex-auth-native-plan-review.json
Normal file
302
docs/evidence/2026-10-16-flex-auth-native-plan-review.json
Normal file
|
|
@ -0,0 +1,302 @@
|
|||
{
|
||||
"schema": "railiance-platform.bounded-native-plan-review.v1",
|
||||
"reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
|
||||
"work_item": "RPF-WP-0035-T12",
|
||||
"decision": "approved",
|
||||
"scope": "Exact P4/R2 Platform custody/read-lane and existing Argo Application manual-sync/freeze execution proposal, contingent on mandatory observed execution gates. Owner plan review only; not founder approval, native execution, CCR approval recording or completed native-admission disposition.",
|
||||
"intent_basis": "INTENT Secure Custody, Stable Interfaces and Operable and Observable; Staff PEP-shaped attended founder-gated effects. SCOPE retains OpenBao custody/policy/delivery acceptance, not workload/Helm, cluster runtime/storage, identity or authorization ownership.",
|
||||
"exact_revisions": {
|
||||
"platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53",
|
||||
"packet_p4_manifest_sha256": "9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3",
|
||||
"rollout_r2_manifest_sha256": "5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
|
||||
"chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
|
||||
"image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
|
||||
"image_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
|
||||
"deployment_projection_sha256": "8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c",
|
||||
"ccr_proposed_sha256": "44bbbf4aff84c3b085afdb14708106fd9a12ac03a0c47774913931a87fb94ada"
|
||||
},
|
||||
"evidence": {
|
||||
"live_preflight_sha256": "7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b",
|
||||
"observed_at": "2026-10-16T18:53:06.325922+00:00",
|
||||
"all_seven_server_dry_runs_accepted": true,
|
||||
"projection_source_matches_server_admitted_stopped_render": true,
|
||||
"held_fence": false,
|
||||
"actual_signer_stopped": false,
|
||||
"application_supplement_sha256": "f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c",
|
||||
"application_supplement_observed_at": "2026-10-16T19:12:36.858755+00:00",
|
||||
"application_collector_sha256": "sha256:151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d"
|
||||
},
|
||||
"platform_read_lane": {
|
||||
"ccr": "CCR-2026-0050",
|
||||
"policy": "workload-kv-read-flex-auth-envelope-signing",
|
||||
"role": "external-secrets-flex-auth-envelope-signing",
|
||||
"sa": "flex-auth/flex-auth-envelope-signing-eso",
|
||||
"audience": "openbao",
|
||||
"ttl_seconds": 900,
|
||||
"max_ttl_seconds": 900,
|
||||
"explicit_max_ttl_seconds": 900,
|
||||
"no_default_policy": true,
|
||||
"permissions": "Exact platform/data/workloads/flex-auth/envelope-signing read plus lookup-self read/revoke-self update; no metadata/list/sibling/write/delete grant. KV document has all three fields; ESO projects only ED25519_PRIVATE_KEY to seed. No field-level authorization claim.",
|
||||
"delivery": "Namespaced SecretStore flex-auth/openbao-flex-auth-envelope-signing and ExternalSecret flex-auth/flex-auth-secrets-engine-envelope-signing; Owner target creation, Retain deletion, 5m refresh; dedicated SA automount false. This proposed namespaced lane does not mutate existing ClusterSecretStore/openbao or legacy ESO token renewer."
|
||||
},
|
||||
"observed_application_scope": [
|
||||
{
|
||||
"name": "railiance-apps-root",
|
||||
"uid": "3078d1f5-07c2-44cc-bff7-c2ee2a2c9e7c",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Parent of existing nine Applications; hold manual sync during ceremony to prevent child source/policy changes.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/railiance01/applications",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "main"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "activity-core",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "bao-notice",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "informed-decision-requester",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "openbao-secretstore",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "secret-annotation-guard",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "state-hub-memo-dispatch",
|
||||
"namespace": "argocd"
|
||||
},
|
||||
{
|
||||
"kind": "Application",
|
||||
"name": "target-revenue",
|
||||
"namespace": "argocd"
|
||||
}
|
||||
],
|
||||
"resource_version": "76247264"
|
||||
},
|
||||
{
|
||||
"name": "informed-decision",
|
||||
"uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Resource inventory includes NetworkPolicies informed-decision-lifecycle-ingress and informed-decision-review-ingress in flex-auth. Hold manual sync affecting those policies; no signer Deployment/ESO resource ownership observed.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "deploy/lifecycle",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
|
||||
"targetRevision": "312ab97e876e17341bf16f9e95397e14c2ac2720"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-6c221878d051",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-runtime-c81577741a09",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "informed-decision-workload-registry",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "PersistentVolumeClaim",
|
||||
"name": "informed-decision-data",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "informed-decision-workload",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "Deployment",
|
||||
"name": "informed-decision",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "approval-engine"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-lifecycle-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review-ingress",
|
||||
"namespace": "flex-auth"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "informed-decision-review",
|
||||
"namespace": "informed-decision"
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRole",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
},
|
||||
{
|
||||
"kind": "ClusterRoleBinding",
|
||||
"name": "informed-decision-tokenreview",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"resource_version": "76247431"
|
||||
},
|
||||
{
|
||||
"name": "openbao-secretstore",
|
||||
"uid": "f2932505-e649-4b99-b505-4789ed21301f",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Owns ClusterSecretStore/openbao only; existing shared delivery controller-adjacent app. No proposed signer namespaced lane ownership observed; preserve existing state and no related manual sync during ceremony.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/openbao-secretstore",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "ClusterSecretStore",
|
||||
"name": "openbao",
|
||||
"namespace": null
|
||||
}
|
||||
],
|
||||
"resource_version": "76247497"
|
||||
},
|
||||
{
|
||||
"name": "eso-token-renewer",
|
||||
"uid": "b10d1e31-08da-4364-b537-4e166eeeb25e",
|
||||
"automated": false,
|
||||
"last_phase": "Succeeded",
|
||||
"relevance": "Owns legacy renewer ConfigMap/SA/CronJob in external-secrets, not new dedicated Kubernetes-auth role. Preserve unchanged; no stop/disable of unrelated shared renewer proposed.",
|
||||
"source": {
|
||||
"chart": null,
|
||||
"path": "argocd/platform-addons/eso-token-renewer",
|
||||
"repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
|
||||
"targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725"
|
||||
},
|
||||
"queued_operation_present": false,
|
||||
"resource_tuples": [
|
||||
{
|
||||
"kind": "ConfigMap",
|
||||
"name": "eso-token-renewer-worker-5c86dt7fm7",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "ServiceAccount",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
},
|
||||
{
|
||||
"kind": "CronJob",
|
||||
"name": "eso-token-renewer",
|
||||
"namespace": "external-secrets"
|
||||
}
|
||||
],
|
||||
"resource_version": "76246569"
|
||||
}
|
||||
],
|
||||
"observed_signer_controller": "No Application in the current complete inventory owns flex-auth-secrets-engine Deployment, signer SecretStore/ExternalSecret or outbox PVC. Helm release revision4 and native Deployment/ReplicaSet controller are actual signer write path; Access owns exact manual/CI/Helm writer freeze. No new signer Argo adoption or controller configuration change is proposed.",
|
||||
"mandatory_execution_gates": [
|
||||
"Initial founder rollout/CCR decision may authorize only its explicitly enumerated read-lane apply and Access stopped-candidate preparation effects under reviewed owner scopes; it does not require those effects to exist before authorization. After that authorization and execution, assemble separately reviewed final one-use custody scope from approved CCR bytes/confirmed native bindings, authenticated founder entity, future absolute UTC expiry, held exclusive-window receipt, stopped native projection/fence and independent consumer baseline. All five dispositions bind this exact completed scope before custody. Actual founder/expiry/CCR/window remain null in frozen P4 preparation; this review fills none.",
|
||||
"Before window refresh exact Application UID/source revision/resource tuples/current operation and manual sync settings for the identified apps and root. Freeze explicit manual sync/CI/Helm actors by founder executor/abort-owner agreement; require no pending/running Argo operation affecting relevant resources. Last Succeeded alone is not proof of no newly queued operation. Preserve before-state metadata; no speculative absence-of-all-possible-writers requirement. The19:12:36 supplement establishes all four selected Applications manual/no queued operation at that time, not a reserved future window.",
|
||||
"Platform approves only source read-lane policy/role/delivery design here. Separate founder CCR decision and reviewed role/policy apply/readback are required; verify exact SA namespace/audience, native policy and all 900s/max/no-default attributes. Native positive/negative ESO login/path tests and safely reduced Ready/SecretSynced/version correspondence are separate evidence; no raw Secret/JWT outputs.",
|
||||
"Access installs exact stopped candidate through reviewed Helm path and authenticates competing workload writers; actual observedGeneration, Deployment/owned ReplicaSets0, no owned/terminating/signer-SA/seed-mount pods and no HPA must hold. Exact native projection must equal8ce375f, independently of successful server dry-run. Secrets owns stopped/failclosed consumer; cluster owns refreshed headroom/storage/PV retention.",
|
||||
"Founder runs only exact approved silent child/source/admission-file hash through attended Warden OIDC. Use private0700 receipt/admission custody,0600 files, trusted dependencies/runtime and explicit same-UID containment assessment. 5<remaining<=120 seconds at child start with fixed2s I/O caps; expired/early/changed scope refuses; no TTL widening/post-login refresh.",
|
||||
"One fixed CAS0 plus metadata setup/readback is distinct from CCR read grant. Fresh exact cluster/backend/entity/source/reader-policy and actual fence checks precede private effects; only durable authenticated public receipt may cross to Secrets. No private seed/credential output, external seed import, standing writer role or agent session.",
|
||||
"Keep signer and consumer fenced after CAS until independent Secrets public key/kid/fingerprint/trust admission, exact ESO/readback and Access mounted-runtime proofs. 120s ready abort and600s founder recovery hold apply to proposed rollout; no success inferred from source/public preparation.",
|
||||
"On any unknown custody/write/readback/fsync, hold fence and original unknown receipt; only independently reviewed R2 read-only recovery binds immutable original receipt and current/original source lineages. No CAS retry/remint, automatic cleanup, private seed restoration or retrospective success.",
|
||||
"Platform restores only captured safe manual Application/sync state under reviewed recovery disposition; never sync root merely to clear OutOfSync or enable automated/prune/selfheal. Access owns workload rollback and outbox preservation; unsigned05a remains failclosed for strict signed consumer. Secrets owns trust withdrawal/restoration; cluster owns PVC/PV retention. Compromise uses separately approved forward-only successor, never old-seed restoration."
|
||||
],
|
||||
"owner_roles": [
|
||||
"access-engine-owner: workload/Helm",
|
||||
"railiance-platform-owner: custody/read-lane/existing Applications",
|
||||
"cluster-runtime-storage-owner: runtime/storage",
|
||||
"secrets-engine-owner: consumer/trust",
|
||||
"founder: exact decision/executor/abort authority"
|
||||
],
|
||||
"cost_and_risk": "Platform preparation/new infrastructure EUR0. No monetary loss/risk ceiling granted. Seed compromise permits lifecycle forgery; controlled outage and node-local evidence loss need explicit founder disposition. Shared ESO/Argo controllers remain installed unchanged; Enablement review only if actual installation/controller configuration delta is later proposed.",
|
||||
"not_authorized": [
|
||||
"live Kubernetes/OpenBao/Argo mutation",
|
||||
"credential or Secret reads/TokenRequest",
|
||||
"native custody/trust/caller admission",
|
||||
"founder decision or completed native scope assent",
|
||||
"other-owner review"
|
||||
],
|
||||
"open_metadata_detail": "Requested sanitized supplement successfully observed all four exact Application sources/revisions/resource tuples and no queued operation; proposed delivery objects/PVC absent. Refresh at authorized ceremony; no broader writer inventory demanded.",
|
||||
"workplan_status": "RPF-WP-0035-T12 remains progress; all native custody/acceptance gates remain open.",
|
||||
"observed_delivery_state": {
|
||||
"proposed_eso_sa_store_external_secret_and_pvc_absent": true,
|
||||
"deployment_field_managers": [
|
||||
"helm",
|
||||
"k3s"
|
||||
],
|
||||
"signer_sa_field_managers": [
|
||||
"helm"
|
||||
],
|
||||
"observations_grant_no_execution": true
|
||||
},
|
||||
"approval_stages": {
|
||||
"initial_rollout_ccr_decision": "Explicit founder scope for read role/policy/delivery apply and stopped Helm/PVC preparation only; source plan owner reviews support this proposal. No custody/public-trust/caller grant inferred.",
|
||||
"later_one_use_custody_assent": "Five exact dispositions bind completed approved CCR/native binding receipt, founder identity, absolute expiry, held window, actual fence/projection, source/image/baseline. Changed expiry changes scope.",
|
||||
"execution_produced_facts_not_initial_human_choices": [
|
||||
"actual stopped Helm revision",
|
||||
"PVC UID/PV UID and Retain readback after WFFC binding",
|
||||
"actual stopped fence/projection receipt",
|
||||
"held-window observation"
|
||||
],
|
||||
"unresolved_human_choices": [
|
||||
"authenticated public founder OpenBao entity UUID (not inferred from hub-writer identity)",
|
||||
"concrete ceremony absolute UTC expiry/window for final exact scope",
|
||||
"accept or constrain proposed high seed-forgery/outage/local-evidence-loss scope; no monetary loss ceiling is established"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -1391,3 +1391,13 @@ No missing-local-declaration waiver, remote placement, actual stopped fence,
|
|||
PV retention, native custody, independent post-key trust or founder/owner
|
||||
approval is inferred. Exact successor source/CCR/plan pins and fresh scoped
|
||||
reviews remain required; T12 native gates and historical T13 outcome unchanged.
|
||||
|
||||
2026-10-16 T12 bounded native plan review: Platform independently approves the
|
||||
exact P4/R2 custody/read-lane and existing manual Argo Application freeze/recovery
|
||||
proposal only, per docs/evidence/2026-10-16-flex-auth-native-plan-review.json.
|
||||
Current observed inventory has no signer Application; root and informed-decision
|
||||
manual sync are held during ceremony, while shared openbao-secretstore and legacy
|
||||
eso-token-renewer stay unchanged. Exact CCR read grant and one-use custody writer
|
||||
remain separate. Actual CCR/founder/entity/expiry/window/fence, native ESO/readback,
|
||||
independent Secrets public trust and Access/cluster runtime proofs remain gates.
|
||||
No authority/admission field changes; T12 remains progress.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue