Finish Core Hub private shadow onboarding
This commit is contained in:
codex
parent
a18d3dea33
commit
1206ed55da
5 changed files with 227 additions and 76 deletions
|
|
@ -3,33 +3,44 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: Core Hub runtime API token lane
|
||||
status: proposed
|
||||
status: verified
|
||||
created: '2026-08-20'
|
||||
updated: '2026-08-20'
|
||||
requester:
|
||||
agent: codex
|
||||
reason: >-
|
||||
CORE-WP-0011 and RAPP-CORE-HUB-WP-0001 relocate Core Hub production to
|
||||
railiance01. The validated package requires CORE_HUB_API_TOKEN, but the
|
||||
value must move through platform custody rather than a copied Kubernetes
|
||||
Secret or Git. This request covers only the standing application token;
|
||||
PostgreSQL credentials remain dynamic database-engine leases.
|
||||
reason: CORE-WP-0011 and RAPP-CORE-HUB-WP-0001 relocate Core Hub production to railiance01.
|
||||
The validated package requires CORE_HUB_API_TOKEN, but the value must move through
|
||||
platform custody rather than a copied Kubernetes Secret or Git. This request covers
|
||||
only the standing application token; PostgreSQL credentials remain dynamic database-engine
|
||||
leases.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
- core-hub-owner
|
||||
comments: []
|
||||
comments:
|
||||
- at: '2026-08-20T22:02:19+00:00'
|
||||
reviewer: platform operator / Core Hub owner (chat approval)
|
||||
decision: approved
|
||||
comment: 'State Hub decision 4f70311b-a4c4-4959-b1a1-cdd1be97d523: approved for
|
||||
the governed private Core Hub relocation; static API-token custody remains separate
|
||||
from dynamic PostgreSQL leases.'
|
||||
- at: '2026-08-20T22:03:00+00:00'
|
||||
reviewer: codex
|
||||
decision: binding_confirmed
|
||||
comment: Railiance01 has ServiceAccount external-secrets/external-secrets and
|
||||
the External Secrets deployment uses that exact identity. The proposed Kubernetes-auth
|
||||
bound claims match the live subject; store use remains independently limited
|
||||
to namespace core-hub.
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: core-hub
|
||||
workload: core-hub
|
||||
rapp: rapp-core-hub
|
||||
environment: production
|
||||
purpose: >-
|
||||
Project the existing Core Hub protected-API token into the private
|
||||
railiance01 runtime through a namespace-limited ExternalSecret while
|
||||
preserving the token across the relocation window.
|
||||
purpose: Project the existing Core Hub protected-API token into the private railiance01
|
||||
runtime through a namespace-limited ExternalSecret while preserving the token
|
||||
across the relocation window.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/core-hub/runtime
|
||||
|
|
@ -46,7 +57,7 @@ openbao:
|
|||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: false
|
||||
bound_claims_confirmed: true
|
||||
policies:
|
||||
- workload-kv-read-core-hub-runtime
|
||||
ttl: 15m
|
||||
|
|
@ -59,60 +70,102 @@ access_frontdoor:
|
|||
readiness: pending-review
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: >-
|
||||
ClusterSecretStore openbao-core-hub-runtime, limited to namespace
|
||||
core-hub, to ExternalSecret core-hub/core-hub-api-token and Secret
|
||||
core-hub-api-token. The rapp package consumes this Secret separately from
|
||||
runtime and migration PostgreSQL lease Secrets.
|
||||
target: ClusterSecretStore openbao-core-hub-runtime, limited to namespace core-hub,
|
||||
to ExternalSecret core-hub/core-hub-api-token and Secret core-hub-api-token. The
|
||||
rapp package consumes this Secret separately from runtime and migration PostgreSQL
|
||||
lease Secrets.
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- The token authorizes protected Core Hub API operations and must not be
|
||||
printed, placed on argv, committed, or recorded in State Hub.
|
||||
- This CCR does not authorize a standing database password or a database URL
|
||||
in KV. Those come from the OpenBao database engine.
|
||||
- Preserve the current token during the relocation so existing protected API
|
||||
consumers do not fail at the same time as the infrastructure move.
|
||||
- Later rotation is coordinated with every protected API consumer because
|
||||
Core Hub currently accepts one token.
|
||||
- The token authorizes protected Core Hub API operations and must not be printed,
|
||||
placed on argv, committed, or recorded in State Hub.
|
||||
- This CCR does not authorize a standing database password or a database URL in
|
||||
KV. Those come from the OpenBao database engine.
|
||||
- Preserve the current token during the relocation so existing protected API consumers
|
||||
do not fail at the same time as the infrastructure move.
|
||||
- Later rotation is coordinated with every protected API consumer because Core Hub
|
||||
currently accepts one token.
|
||||
verification:
|
||||
positive:
|
||||
- An approved core-hub ExternalSecret syncs CORE_HUB_API_TOKEN into Secret
|
||||
core-hub-api-token without printing the value.
|
||||
- Protected API smoke succeeds against the private shadow endpoint using an
|
||||
injected token after the source database has been reconciled.
|
||||
- An approved core-hub ExternalSecret syncs CORE_HUB_API_TOKEN into Secret core-hub-api-token
|
||||
without printing the value.
|
||||
- Protected API smoke succeeds against the private shadow endpoint using an injected
|
||||
token after the source database has been reconciled.
|
||||
negative:
|
||||
- A namespace outside core-hub cannot use openbao-core-hub-runtime.
|
||||
- A token without workload-kv-read-core-hub-runtime cannot read the KV data
|
||||
path.
|
||||
- A token without workload-kv-read-core-hub-runtime cannot read the KV data path.
|
||||
- The Core Hub workload identity cannot write or list sibling workload paths.
|
||||
activation_conditions:
|
||||
- Platform operator and Core Hub owner approve this CCR.
|
||||
- The source token is transferred through attended operator custody without
|
||||
entering logs, chat, Git, or State Hub.
|
||||
- The Kubernetes auth role and policy are applied to railiance01-local
|
||||
OpenBao and the bound service-account claims are verified.
|
||||
- The package consumes the API-token Secret separately from dynamic database
|
||||
lease Secrets.
|
||||
- Positive and negative evidence is recorded with non-secret timestamps or
|
||||
OpenBao audit references.
|
||||
evidence: []
|
||||
- The source token is transferred through attended operator custody without entering
|
||||
logs, chat, Git, or State Hub.
|
||||
- The Kubernetes auth role and policy are applied to railiance01-local OpenBao and
|
||||
the bound service-account claims are verified.
|
||||
- The package consumes the API-token Secret separately from dynamic database lease
|
||||
Secrets.
|
||||
- Positive and negative evidence is recorded with non-secret timestamps or OpenBao
|
||||
audit references.
|
||||
evidence:
|
||||
- at: '2026-08-20T22:07:02+00:00'
|
||||
actor: platform operator / Core Hub owner (chat approval)
|
||||
kind: metadata_apply
|
||||
result: passed
|
||||
details:
|
||||
- OpenBao policy and auth-role metadata apply completed without secret values
|
||||
- at: '2026-08-20T22:11:45+00:00'
|
||||
actor: codex
|
||||
kind: secret_provisioned
|
||||
result: passed
|
||||
details:
|
||||
- Source API token transferred directly from CoulombCore Kubernetes custody to
|
||||
OpenBao KV version 1; value not printed or staged
|
||||
- at: '2026-08-20T22:11:45+00:00'
|
||||
actor: codex
|
||||
kind: positive_verification
|
||||
result: passed
|
||||
details:
|
||||
- Railiance01 stores Valid; API/runtime/migration ExternalSecrets SecretSynced
|
||||
at 2026-08-20T22:07:42Z with expected key names only
|
||||
- at: '2026-08-20T22:11:45+00:00'
|
||||
actor: codex
|
||||
kind: negative_verification
|
||||
result: passed
|
||||
details:
|
||||
- Both stores rejected core-hub-denial-probe with SecretSyncedError and created
|
||||
no target Secret; Kubernetes-auth token had read on exact data/metadata paths
|
||||
and deny on sibling/parent paths
|
||||
- at: '2026-08-20T22:11:46+00:00'
|
||||
actor: codex
|
||||
kind: database_role_separation
|
||||
result: passed
|
||||
details:
|
||||
- Runtime lease connected but CREATE was denied and pg_has_role(core_hub_migrate)=false;
|
||||
migration lease created and dropped bounded probe table; probe pods deleted
|
||||
- at: '2026-08-20T22:45:58+00:00'
|
||||
actor: codex
|
||||
kind: private_shadow_verification
|
||||
result: passed
|
||||
details:
|
||||
- 'Private railiance01 shadow: OpenBao KV and database stores Valid; least-privilege
|
||||
denial and role-separation probes passed; chart 0.3.1 rotated the runtime lease
|
||||
in place with Secret resourceVersion change, child PID change, stable pod UID,
|
||||
container restartCount 0->0, readiness true, and 5m refresh restored; post-rotation
|
||||
authenticated smoke 20260820224419-43dc05 passed all 10 checks; public Ingress
|
||||
remained absent.'
|
||||
lifecycle:
|
||||
deactivate: >-
|
||||
Disable the front door and Kubernetes auth role, remove the ExternalSecret,
|
||||
and delete the materialized Secret only after Core Hub is retired or a
|
||||
reviewed fallback is active.
|
||||
rotate: >-
|
||||
Coordinate a new random token with all protected API consumers, update the
|
||||
OpenBao field through attended custody, wait for ESO sync, roll Core Hub and
|
||||
consumers, verify protected calls, then invalidate the old token.
|
||||
compromised: >-
|
||||
Disable protected writes, replace the token in OpenBao and every consumer,
|
||||
roll the workload, review Core Hub protected-operation logs, and open an
|
||||
incident follow-up.
|
||||
deactivate: Disable the front door and Kubernetes auth role, remove the ExternalSecret,
|
||||
and delete the materialized Secret only after Core Hub is retired or a reviewed
|
||||
fallback is active.
|
||||
rotate: Coordinate a new random token with all protected API consumers, update the
|
||||
OpenBao field through attended custody, wait for ESO sync, roll Core Hub and consumers,
|
||||
verify protected calls, then invalidate the old token.
|
||||
compromised: Disable protected writes, replace the token in OpenBao and every consumer,
|
||||
roll the workload, review Core Hub protected-operation logs, and open an incident
|
||||
follow-up.
|
||||
state_hub:
|
||||
workplan_id: RPF-WP-0021
|
||||
task_id: RPF-WP-0021-T04
|
||||
decision_id: 4f70311b-a4c4-4959-b1a1-cdd1be97d523
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/4f70311b-a4c4-4959-b1a1-cdd1be97d523
|
||||
decision_dashboard_url: http://127.0.0.1:3000/decisions
|
||||
decision_resolved_at: '2026-08-20T22:02:19Z'
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue