security: propose scoped NetKingdom identity backup credentials
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
codex
parent
6e24b09eaa
commit
3b6e647aa0
4 changed files with 256 additions and 0 deletions
|
|
@ -0,0 +1,125 @@
|
|||
{
|
||||
"id": "CCR-2026-0048",
|
||||
"kind": "credential-change-request",
|
||||
"schema_version": 1,
|
||||
"request_type": "workload-kv-read",
|
||||
"title": "NetKingdom identity backup publisher delivery",
|
||||
"status": "proposed",
|
||||
"created": "2026-10-16",
|
||||
"updated": "2026-10-16",
|
||||
"requester": {
|
||||
"agent": "codex",
|
||||
"reason": "Operator requested implementation of missing full identity backup coverage under NK-WP-0049."
|
||||
},
|
||||
"review": {
|
||||
"required": true,
|
||||
"required_approvers": [
|
||||
"platform-owner",
|
||||
"net-kingdom-owner",
|
||||
"backup-share-owner"
|
||||
],
|
||||
"comments": []
|
||||
},
|
||||
"target": {
|
||||
"domain": "infotech",
|
||||
"tenant": "platform",
|
||||
"workload": "net-kingdom-identity-backup",
|
||||
"environment": "production",
|
||||
"purpose": "publisher limited to new encrypted identity bundle folder; no age private key or Backup account password"
|
||||
},
|
||||
"openbao": {
|
||||
"mount": "platform",
|
||||
"kv_path": "platform/workloads/net-kingdom/identity-backup/publisher",
|
||||
"fields": [
|
||||
"NC_WEBDAV_TOKEN"
|
||||
],
|
||||
"policy_name": "net-kingdom-backup-publisher-eso",
|
||||
"policy_file": "openbao/policies/net-kingdom-backup-publisher-eso.hcl",
|
||||
"metadata_read": false,
|
||||
"token_self_lifecycle": true,
|
||||
"auth": {
|
||||
"method": "kubernetes",
|
||||
"mount": "kubernetes",
|
||||
"role": "net-kingdom-backup-publisher-eso",
|
||||
"audience": "openbao",
|
||||
"ttl": "15m",
|
||||
"token_max_ttl": "15m",
|
||||
"token_explicit_max_ttl": "15m",
|
||||
"token_no_default_policy": true,
|
||||
"policies": [
|
||||
"net-kingdom-backup-publisher-eso"
|
||||
],
|
||||
"bound_claims": {
|
||||
"service_account_names": [
|
||||
"net-kingdom-backup-publisher-eso"
|
||||
],
|
||||
"service_account_namespaces": [
|
||||
"sso"
|
||||
]
|
||||
},
|
||||
"bound_claims_confirmed": false
|
||||
}
|
||||
},
|
||||
"provider": {
|
||||
"host": "nx4069.your-storageshare.de",
|
||||
"account_owner": "Backup",
|
||||
"folder": "/railiance-backups/net-kingdom-identity",
|
||||
"share_type": 3,
|
||||
"share_permissions": 5,
|
||||
"label": "net-kingdom-identity-publisher",
|
||||
"age_private_key_delivered": false,
|
||||
"backup_account_password_delivered": false
|
||||
},
|
||||
"delivery": {
|
||||
"surface": "ESO-managed Secret",
|
||||
"namespace": "sso",
|
||||
"secret": "net-kingdom-backup-publisher",
|
||||
"key": "token",
|
||||
"service_account": "net-kingdom-backup-publisher-eso",
|
||||
"reader": "owner-controlled root backup publisher process on railiance01; no agent credential delivery",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786"
|
||||
},
|
||||
"risk": {
|
||||
"classification": "high",
|
||||
"notes": [
|
||||
"Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.",
|
||||
"Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.",
|
||||
"Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.",
|
||||
"Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.",
|
||||
"KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares."
|
||||
]
|
||||
},
|
||||
"verification": {
|
||||
"positive": [
|
||||
"Exact share path/permissions and bounded KV/ESO role readback",
|
||||
"Ciphertext create/readback/hash and exact runtime token delivery",
|
||||
"Retention protects recovered point/newest/seven daily/two weekly and uses ETag-conditional deletion"
|
||||
],
|
||||
"negative": [
|
||||
"Publisher overwrite/delete denied; retention create/overwrite denied",
|
||||
"Sibling namespace/path/audience and KV write/metadata access denied",
|
||||
"Unapproved or changed CCR/source, wrong cluster, resource drift and malformed archive refuse execution"
|
||||
],
|
||||
"activation_conditions": [
|
||||
"Explicit platform, NetKingdom and Backup-share owner approval of this exact request and source packet.",
|
||||
"Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.",
|
||||
"First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.",
|
||||
"Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups."
|
||||
]
|
||||
},
|
||||
"state_hub": {
|
||||
"workplan_id": "NK-WP-0049",
|
||||
"task_id": "NK-WP-0049-T03"
|
||||
},
|
||||
"access_frontdoor": {
|
||||
"type": "platform-owner",
|
||||
"catalog_id": "net-kingdom-identity-backup-publisher",
|
||||
"readiness": "pending-review",
|
||||
"resolvable": false
|
||||
},
|
||||
"lifecycle": {
|
||||
"deactivate": "Stop the corresponding timer, withdraw only this reader and disable its dedicated share under owner control; retain archives and recovery keys.",
|
||||
"rotate": "Separate owner-approved share replacement and KV CAS rotation, preserved old access until new readback and recovery pass; no silent replacement by this setup tool.",
|
||||
"compromised": "Fence this executor and revoke its dedicated share/reader. Treat retention-token compromise as possible loss of this folder; preserve independent recovery points and rotate only under incident authority."
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,125 @@
|
|||
{
|
||||
"id": "CCR-2026-0049",
|
||||
"kind": "credential-change-request",
|
||||
"schema_version": 1,
|
||||
"request_type": "workload-kv-read",
|
||||
"title": "NetKingdom identity backup retention delivery",
|
||||
"status": "proposed",
|
||||
"created": "2026-10-16",
|
||||
"updated": "2026-10-16",
|
||||
"requester": {
|
||||
"agent": "codex",
|
||||
"reason": "Operator requested implementation of missing full identity backup coverage under NK-WP-0049."
|
||||
},
|
||||
"review": {
|
||||
"required": true,
|
||||
"required_approvers": [
|
||||
"platform-owner",
|
||||
"net-kingdom-owner",
|
||||
"backup-share-owner"
|
||||
],
|
||||
"comments": []
|
||||
},
|
||||
"target": {
|
||||
"domain": "infotech",
|
||||
"tenant": "platform",
|
||||
"workload": "net-kingdom-identity-backup",
|
||||
"environment": "production",
|
||||
"purpose": "retention limited to new encrypted identity bundle folder; no age private key or Backup account password"
|
||||
},
|
||||
"openbao": {
|
||||
"mount": "platform",
|
||||
"kv_path": "platform/workloads/net-kingdom/identity-backup/retention",
|
||||
"fields": [
|
||||
"NC_WEBDAV_TOKEN"
|
||||
],
|
||||
"policy_name": "net-kingdom-backup-retention-eso",
|
||||
"policy_file": "openbao/policies/net-kingdom-backup-retention-eso.hcl",
|
||||
"metadata_read": false,
|
||||
"token_self_lifecycle": true,
|
||||
"auth": {
|
||||
"method": "kubernetes",
|
||||
"mount": "kubernetes",
|
||||
"role": "net-kingdom-backup-retention-eso",
|
||||
"audience": "openbao",
|
||||
"ttl": "15m",
|
||||
"token_max_ttl": "15m",
|
||||
"token_explicit_max_ttl": "15m",
|
||||
"token_no_default_policy": true,
|
||||
"policies": [
|
||||
"net-kingdom-backup-retention-eso"
|
||||
],
|
||||
"bound_claims": {
|
||||
"service_account_names": [
|
||||
"net-kingdom-backup-retention-eso"
|
||||
],
|
||||
"service_account_namespaces": [
|
||||
"sso"
|
||||
]
|
||||
},
|
||||
"bound_claims_confirmed": false
|
||||
}
|
||||
},
|
||||
"provider": {
|
||||
"host": "nx4069.your-storageshare.de",
|
||||
"account_owner": "Backup",
|
||||
"folder": "/railiance-backups/net-kingdom-identity",
|
||||
"share_type": 3,
|
||||
"share_permissions": 9,
|
||||
"label": "net-kingdom-identity-retention",
|
||||
"age_private_key_delivered": false,
|
||||
"backup_account_password_delivered": false
|
||||
},
|
||||
"delivery": {
|
||||
"surface": "ESO-managed Secret",
|
||||
"namespace": "sso",
|
||||
"secret": "net-kingdom-backup-retention",
|
||||
"key": "token",
|
||||
"service_account": "net-kingdom-backup-retention-eso",
|
||||
"reader": "owner-controlled root backup retention process on railiance01; no agent credential delivery",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786"
|
||||
},
|
||||
"risk": {
|
||||
"classification": "high",
|
||||
"notes": [
|
||||
"Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.",
|
||||
"Publisher can read/create in only this folder; retention can read/delete in only this folder. Neither grants update, reshare, other folders or account administration.",
|
||||
"Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.",
|
||||
"Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.",
|
||||
"KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares."
|
||||
]
|
||||
},
|
||||
"verification": {
|
||||
"positive": [
|
||||
"Exact share path/permissions and bounded KV/ESO role readback",
|
||||
"Ciphertext create/readback/hash and exact runtime token delivery",
|
||||
"Retention protects recovered point/newest/seven daily/two weekly and uses ETag-conditional deletion"
|
||||
],
|
||||
"negative": [
|
||||
"Publisher overwrite/delete denied; retention create/overwrite denied",
|
||||
"Sibling namespace/path/audience and KV write/metadata access denied",
|
||||
"Unapproved or changed CCR/source, wrong cluster, resource drift and malformed archive refuse execution"
|
||||
],
|
||||
"activation_conditions": [
|
||||
"Explicit platform, NetKingdom and Backup-share owner approval of this exact request and source packet.",
|
||||
"Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.",
|
||||
"First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.",
|
||||
"Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups."
|
||||
]
|
||||
},
|
||||
"state_hub": {
|
||||
"workplan_id": "NK-WP-0049",
|
||||
"task_id": "NK-WP-0049-T03"
|
||||
},
|
||||
"access_frontdoor": {
|
||||
"type": "platform-owner",
|
||||
"catalog_id": "net-kingdom-identity-backup-retention",
|
||||
"readiness": "pending-review",
|
||||
"resolvable": false
|
||||
},
|
||||
"lifecycle": {
|
||||
"deactivate": "Stop the corresponding timer, withdraw only this reader and disable its dedicated share under owner control; retain archives and recovery keys.",
|
||||
"rotate": "Separate owner-approved share replacement and KV CAS rotation, preserved old access until new readback and recovery pass; no silent replacement by this setup tool.",
|
||||
"compromised": "Fence this executor and revoke its dedicated share/reader. Treat retention-token compromise as possible loss of this folder; preserve independent recovery points and rotate only under incident authority."
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue