From 3b6e647aa06bed88966a4539f9d3cb7ed6792bd4 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 16 Oct 2026 01:37:22 +0200 Subject: [PATCH] security: propose scoped NetKingdom identity backup credentials Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- ...026-0048-net-kingdom-backup-publisher.yaml | 125 ++++++++++++++++++ ...026-0049-net-kingdom-backup-retention.yaml | 125 ++++++++++++++++++ .../net-kingdom-backup-publisher-eso.hcl | 3 + .../net-kingdom-backup-retention-eso.hcl | 3 + 4 files changed, 256 insertions(+) create mode 100644 credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml create mode 100644 credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml create mode 100644 openbao/policies/net-kingdom-backup-publisher-eso.hcl create mode 100644 openbao/policies/net-kingdom-backup-retention-eso.hcl diff --git a/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml new file mode 100644 index 0000000..da81f0d --- /dev/null +++ b/credential-change-requests/CCR-2026-0048-net-kingdom-backup-publisher.yaml @@ -0,0 +1,125 @@ +{ + "id": "CCR-2026-0048", + "kind": "credential-change-request", + "schema_version": 1, + "request_type": "workload-kv-read", + "title": "NetKingdom identity backup publisher delivery", + "status": "proposed", + "created": "2026-10-16", + "updated": "2026-10-16", + "requester": { + "agent": "codex", + "reason": "Operator requested implementation of missing full identity backup coverage under NK-WP-0049." + }, + "review": { + "required": true, + "required_approvers": [ + "platform-owner", + "net-kingdom-owner", + "backup-share-owner" + ], + "comments": [] + }, + "target": { + "domain": "infotech", + "tenant": "platform", + "workload": "net-kingdom-identity-backup", + "environment": "production", + "purpose": "publisher limited to new encrypted identity bundle folder; no age private key or Backup account password" + }, + "openbao": { + "mount": "platform", + "kv_path": "platform/workloads/net-kingdom/identity-backup/publisher", + "fields": [ + "NC_WEBDAV_TOKEN" + ], + "policy_name": "net-kingdom-backup-publisher-eso", + "policy_file": "openbao/policies/net-kingdom-backup-publisher-eso.hcl", + "metadata_read": false, + "token_self_lifecycle": true, + "auth": { + "method": "kubernetes", + "mount": "kubernetes", + "role": "net-kingdom-backup-publisher-eso", + "audience": "openbao", + "ttl": "15m", + "token_max_ttl": "15m", + "token_explicit_max_ttl": "15m", + "token_no_default_policy": true, + "policies": [ + "net-kingdom-backup-publisher-eso" + ], + "bound_claims": { + "service_account_names": [ + "net-kingdom-backup-publisher-eso" + ], + "service_account_namespaces": [ + "sso" + ] + }, + "bound_claims_confirmed": false + } + }, + "provider": { + "host": "nx4069.your-storageshare.de", + "account_owner": "Backup", + "folder": "/railiance-backups/net-kingdom-identity", + "share_type": 3, + "share_permissions": 5, + "label": "net-kingdom-identity-publisher", + "age_private_key_delivered": false, + "backup_account_password_delivered": false + }, + "delivery": { + "surface": "ESO-managed Secret", + "namespace": "sso", + "secret": "net-kingdom-backup-publisher", + "key": "token", + "service_account": "net-kingdom-backup-publisher-eso", + "reader": "owner-controlled root backup publisher process on railiance01; no agent credential delivery", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786" + }, + "risk": { + "classification": "high", + "notes": [ + "Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.", + "Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.", + "Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.", + "Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.", + "KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares." + ] + }, + "verification": { + "positive": [ + "Exact share path/permissions and bounded KV/ESO role readback", + "Ciphertext create/readback/hash and exact runtime token delivery", + "Retention protects recovered point/newest/seven daily/two weekly and uses ETag-conditional deletion" + ], + "negative": [ + "Publisher overwrite/delete denied; retention create/overwrite denied", + "Sibling namespace/path/audience and KV write/metadata access denied", + "Unapproved or changed CCR/source, wrong cluster, resource drift and malformed archive refuse execution" + ], + "activation_conditions": [ + "Explicit platform, NetKingdom and Backup-share owner approval of this exact request and source packet.", + "Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.", + "First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.", + "Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups." + ] + }, + "state_hub": { + "workplan_id": "NK-WP-0049", + "task_id": "NK-WP-0049-T03" + }, + "access_frontdoor": { + "type": "platform-owner", + "catalog_id": "net-kingdom-identity-backup-publisher", + "readiness": "pending-review", + "resolvable": false + }, + "lifecycle": { + "deactivate": "Stop the corresponding timer, withdraw only this reader and disable its dedicated share under owner control; retain archives and recovery keys.", + "rotate": "Separate owner-approved share replacement and KV CAS rotation, preserved old access until new readback and recovery pass; no silent replacement by this setup tool.", + "compromised": "Fence this executor and revoke its dedicated share/reader. Treat retention-token compromise as possible loss of this folder; preserve independent recovery points and rotate only under incident authority." + } +} diff --git a/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml new file mode 100644 index 0000000..3b2d3c5 --- /dev/null +++ b/credential-change-requests/CCR-2026-0049-net-kingdom-backup-retention.yaml @@ -0,0 +1,125 @@ +{ + "id": "CCR-2026-0049", + "kind": "credential-change-request", + "schema_version": 1, + "request_type": "workload-kv-read", + "title": "NetKingdom identity backup retention delivery", + "status": "proposed", + "created": "2026-10-16", + "updated": "2026-10-16", + "requester": { + "agent": "codex", + "reason": "Operator requested implementation of missing full identity backup coverage under NK-WP-0049." + }, + "review": { + "required": true, + "required_approvers": [ + "platform-owner", + "net-kingdom-owner", + "backup-share-owner" + ], + "comments": [] + }, + "target": { + "domain": "infotech", + "tenant": "platform", + "workload": "net-kingdom-identity-backup", + "environment": "production", + "purpose": "retention limited to new encrypted identity bundle folder; no age private key or Backup account password" + }, + "openbao": { + "mount": "platform", + "kv_path": "platform/workloads/net-kingdom/identity-backup/retention", + "fields": [ + "NC_WEBDAV_TOKEN" + ], + "policy_name": "net-kingdom-backup-retention-eso", + "policy_file": "openbao/policies/net-kingdom-backup-retention-eso.hcl", + "metadata_read": false, + "token_self_lifecycle": true, + "auth": { + "method": "kubernetes", + "mount": "kubernetes", + "role": "net-kingdom-backup-retention-eso", + "audience": "openbao", + "ttl": "15m", + "token_max_ttl": "15m", + "token_explicit_max_ttl": "15m", + "token_no_default_policy": true, + "policies": [ + "net-kingdom-backup-retention-eso" + ], + "bound_claims": { + "service_account_names": [ + "net-kingdom-backup-retention-eso" + ], + "service_account_namespaces": [ + "sso" + ] + }, + "bound_claims_confirmed": false + } + }, + "provider": { + "host": "nx4069.your-storageshare.de", + "account_owner": "Backup", + "folder": "/railiance-backups/net-kingdom-identity", + "share_type": 3, + "share_permissions": 9, + "label": "net-kingdom-identity-retention", + "age_private_key_delivered": false, + "backup_account_password_delivered": false + }, + "delivery": { + "surface": "ESO-managed Secret", + "namespace": "sso", + "secret": "net-kingdom-backup-retention", + "key": "token", + "service_account": "net-kingdom-backup-retention-eso", + "reader": "owner-controlled root backup retention process on railiance01; no agent credential delivery", + "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786" + }, + "risk": { + "classification": "high", + "notes": [ + "Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.", + "Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.", + "Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.", + "Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.", + "KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares." + ] + }, + "verification": { + "positive": [ + "Exact share path/permissions and bounded KV/ESO role readback", + "Ciphertext create/readback/hash and exact runtime token delivery", + "Retention protects recovered point/newest/seven daily/two weekly and uses ETag-conditional deletion" + ], + "negative": [ + "Publisher overwrite/delete denied; retention create/overwrite denied", + "Sibling namespace/path/audience and KV write/metadata access denied", + "Unapproved or changed CCR/source, wrong cluster, resource drift and malformed archive refuse execution" + ], + "activation_conditions": [ + "Explicit platform, NetKingdom and Backup-share owner approval of this exact request and source packet.", + "Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.", + "First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.", + "Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups." + ] + }, + "state_hub": { + "workplan_id": "NK-WP-0049", + "task_id": "NK-WP-0049-T03" + }, + "access_frontdoor": { + "type": "platform-owner", + "catalog_id": "net-kingdom-identity-backup-retention", + "readiness": "pending-review", + "resolvable": false + }, + "lifecycle": { + "deactivate": "Stop the corresponding timer, withdraw only this reader and disable its dedicated share under owner control; retain archives and recovery keys.", + "rotate": "Separate owner-approved share replacement and KV CAS rotation, preserved old access until new readback and recovery pass; no silent replacement by this setup tool.", + "compromised": "Fence this executor and revoke its dedicated share/reader. Treat retention-token compromise as possible loss of this folder; preserve independent recovery points and rotate only under incident authority." + } +} diff --git a/openbao/policies/net-kingdom-backup-publisher-eso.hcl b/openbao/policies/net-kingdom-backup-publisher-eso.hcl new file mode 100644 index 0000000..3c01c2a --- /dev/null +++ b/openbao/policies/net-kingdom-backup-publisher-eso.hcl @@ -0,0 +1,3 @@ +path "platform/data/workloads/net-kingdom/identity-backup/publisher" { capabilities = ["read"] } +path "auth/token/lookup-self" { capabilities = ["read"] } +path "auth/token/revoke-self" { capabilities = ["update"] } diff --git a/openbao/policies/net-kingdom-backup-retention-eso.hcl b/openbao/policies/net-kingdom-backup-retention-eso.hcl new file mode 100644 index 0000000..9c348e3 --- /dev/null +++ b/openbao/policies/net-kingdom-backup-retention-eso.hcl @@ -0,0 +1,3 @@ +path "platform/data/workloads/net-kingdom/identity-backup/retention" { capabilities = ["read"] } +path "auth/token/lookup-self" { capabilities = ["read"] } +path "auth/token/revoke-self" { capabilities = ["update"] }