Prepare reviewed Forgejo consumer ESO scope and truthful recovery records
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
c771a17269
commit
5b9c8262be
8 changed files with 276 additions and 0 deletions
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-FORGEJO-ESO-R1",
|
||||
"work_record": "RPF-IN-0006",
|
||||
"reviewer_role": "railiance-platform technical owner only",
|
||||
"status": "changes-required",
|
||||
"exact_manifest_sha256": "271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279",
|
||||
"reviewed_paths": 17,
|
||||
"all_source_hashes_match": true,
|
||||
"primary_eso_source_sha256": "e53f43c0748e43f408b5a7c5323c12c0fb5fb4299a33718181f6d70945112071",
|
||||
"primary_eso_source_url": "https://raw.githubusercontent.com/external-secrets/external-secrets/v0.16.1/pkg/provider/vault/auth_kubernetes.go",
|
||||
"platform_ccr_validation": "passes with expected unconfirmed-bound-claim apply-block warning",
|
||||
"sound_preparation": [
|
||||
"Dedicated forgejo namespace reader SA and audience openbao, exact role and one data path plus existing token self lifecycle; no default policy or parent/sibling/list permission.",
|
||||
"Installed CRD supports referenced SA/audiences; retained native RBAC confirms common controller TokenRequest/Secret authority. Independently fetched installed-version provider source confirms600second TokenRequest, namespace-local SA and legacy-token fallback.",
|
||||
"Proposal explicitly discloses common-controller trust, HTTP custody and no cryptographic isolation; new SA legacy token refs must be absent, with no static fallback or manual secret seeding.",
|
||||
"Original acknowledged1.1/acceptedcase/history unchanged; proposed1.2 adds sixth object and requires new exact acknowledgment and native provenance before structural/materialized claims.",
|
||||
"Manual proposed CCR42 and owner design correctly require created-only rollback, consumer reference reversal, issued-reader-token revocation or independently verified expiry before declaring deactivation."
|
||||
],
|
||||
"required_changes": [
|
||||
{
|
||||
"id": "RPF-FORGEJO-ESO-01",
|
||||
"source": "ops-mason/src/ops_mason/case_build.py::_ccr",
|
||||
"finding": "Generated consumer CCR target.workload is keycape, while dedicated consumer role is Forgejo and proposed CCR42 target.workload is forgejo.",
|
||||
"required": "Derive consumer workload from consuming_service for consumer-reader-policy, preserving KeyCape ESO reader target; regression must distinguish both generated CCR targets."
|
||||
},
|
||||
{
|
||||
"id": "RPF-FORGEJO-ESO-02",
|
||||
"source": "ops-mason/src/ops_mason/case_build.py::_ccr",
|
||||
"finding": "Generated lifecycle.deactivate only says delete role then policy; deletion does not revoke issued OpenBao tokens and omits created/preexisting distinction.",
|
||||
"required": "Generated successor consumer CCR must retain owner-native created-only/custody rollback and revoke issued reader tokens or verify expiry before deactivation; no new login or remint allowed during recovery. Preserve existing historical source and add meaningful output regression."
|
||||
}
|
||||
],
|
||||
"native_preconditions": [
|
||||
"Fresh exact ESO runtime identity/CRD/RBAC and dedicated SA absence of legacy token refs. Tag observation is compatibility preparation, not cryptographic image identity proof.",
|
||||
"Exact founder/type/case1.2 acknowledgment plus platform CCR approval/bound claims confirmed and authenticated per-owner structural/custody receipts before native apply or credential mint.",
|
||||
"Future consumer Helm secret consumption/group enforcement/break-glass/browser/MFA handover remains separately incomplete.",
|
||||
"Ready status/metadata never substitute for native authorization, issued-token revocation, key rotation or cross-owner completion."
|
||||
],
|
||||
"limits": {
|
||||
"native_changes": false,
|
||||
"credential_mint": false,
|
||||
"secret_read": false,
|
||||
"founder_acknowledgment": false,
|
||||
"other_owner_role_review": false,
|
||||
"first_case_completion": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-FORGEJO-ESO-R1-FINAL",
|
||||
"work_record": "RPF-IN-0006",
|
||||
"reviewer_role": "railiance-platform technical owner only",
|
||||
"status": "technical-agreement",
|
||||
"exact_manifest_sha256": "5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"reviewed_paths": 19,
|
||||
"candidate_builder_sha256": "c2b140f380407779ce5478ca57c97eb0e6375d6a9cad4591b0b29ddd177db686",
|
||||
"initial_conditional_manifest_sha256": "9e4967bfff57694ceb12883f522edc405ef3fa316e46b88c9bdad47205a180b4",
|
||||
"initial_proposal_manifest_sha256": "271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279",
|
||||
"all_manifest_hashes_match": true,
|
||||
"independently_rerun_focused_tests": 44,
|
||||
"resolved": [
|
||||
"Generated consumer-reader target.workload derives consuming_service=forgejo, KeyCape ESO reader remains keycape, generated request identities remain distinct.",
|
||||
"Generated role-backed consumer deactivation includes authenticated created-only custody, preserving shared/preexisting resources, issued-token revocation or independently verified expiry, no-new-login/no-remint recovery, and refusal on changed references/UID/ownership."
|
||||
],
|
||||
"independent_generated_source_probe": "refined-generated-ccr-probe.json",
|
||||
"retained_preconditions": [
|
||||
"Fresh owner/founder exact type/case1.2 acknowledgment required for sixth structural role/runtime delivery; accepted1.1 does not transfer.",
|
||||
"CCR42 reconciliation retains prior body/history; actual bound claims unconfirmed, source-only role/policy/delivery objects not applied.",
|
||||
"Future exact ESO runtime/CRD/RBAC and no-legacy-token SA admission, authenticated created/preexisting ownership/capability receipts and approved contained owner changes remain required; common controller trust and existing HTTP custody are disclosed.",
|
||||
"No deletion-alone revocation claim; revoke issued OpenBao tokens or independently verify expiry before deactivation, with old consumer references reverted and unknown outcomes retained.",
|
||||
"Consumer Helm secret consumption/group enforcement, break-glass/MFA/browser checks and Warden descriptor/native per-owner session proof remain distinct unfinished gates."
|
||||
],
|
||||
"scope": "Technical agreement on source proposal and platform CCR semantics only. No other owner role acceptance or native activation.",
|
||||
"limits": {
|
||||
"founder_acknowledgment": false,
|
||||
"native_apply": false,
|
||||
"credential_mint": false,
|
||||
"secret_read": false,
|
||||
"structural_materialization": false,
|
||||
"first_case_complete": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"synthetic_source_only": true,
|
||||
"native_action": false,
|
||||
"generated_target_workload": "keycape",
|
||||
"manual_ccr_target_workload": "forgejo",
|
||||
"generated_deactivate": "delete the role, then policy workload-kv-read-keycape-forgejo-forgejo (case rollback)",
|
||||
"generated_bound_claims_confirmed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"synthetic_source_only": true,
|
||||
"native_action": false,
|
||||
"consumer_target": "forgejo",
|
||||
"keycape_reader_target": "keycape",
|
||||
"generated_ids_distinct": true,
|
||||
"bound_claims_remain_false": true,
|
||||
"lifecycle_terms": {
|
||||
"case-created": true,
|
||||
"preexisting-matched": true,
|
||||
"shared": true,
|
||||
"revoke issued reader tokens": true,
|
||||
"independently verified expiry": true,
|
||||
"deletion alone does not revoke": true,
|
||||
"no new login": true,
|
||||
"no remint": true,
|
||||
"stop on changed": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
id: CCR-2026-0042
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: 'forgejo-netkingdom-oidc: proposed dedicated consumer ESO reader (oidc-browser-relying-party@1.2)'
|
||||
status: proposed
|
||||
created: '2026-10-09'
|
||||
updated: '2026-10-11'
|
||||
requester:
|
||||
agent: ops-mason
|
||||
reason: Source-only owner refinement of existing CCR-2026-0042. Proposed type/case1.2 and full run source require
|
||||
new exact acknowledgment; original approvals do not authorize this reader role or native delivery. Historical
|
||||
body retained by exact file hash and provenance below.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: forgejo
|
||||
environment: production
|
||||
purpose: Dedicated namespace-local ESO reference identity delivers CLIENT_SECRET to Forgejo; the Forgejo workload/default
|
||||
SA does not authenticate directly to OpenBao.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/keycape/forgejo
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-keycape-forgejo-forgejo
|
||||
policy_file: openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
|
||||
metadata_read: false
|
||||
token_self_lifecycle: true
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-keycape-forgejo-forgejo
|
||||
audience: openbao
|
||||
ttl: 15m
|
||||
token_max_ttl: 15m
|
||||
token_explicit_max_ttl: 15m
|
||||
token_no_default_policy: true
|
||||
policies:
|
||||
- workload-kv-read-keycape-forgejo-forgejo
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- forgejo-keycape-forgejo-eso
|
||||
service_account_namespaces:
|
||||
- forgejo
|
||||
bound_claims_confirmed: false
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: forgejo-keycape-client
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Rendered from proposed SecurityCaseType/case 1.2 source, not an acknowledged successor. Retained read-only native
|
||||
ESO image/CRD/RBAC and Forgejo identity observations support preparation only; bound claims remain unconfirmed
|
||||
and apply blocked. The new sixth consumer role/auth path requires fresh informed-decision acknowledgment under
|
||||
SecurityCaseTypes canon section 6; acknowledged type 1.1 and accepted case 1.1 do not authorize it.
|
||||
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
||||
- Dedicated reference identity separates consumer and KeyCape role bindings, but common ESO controller already
|
||||
has clusterwide TokenRequest and Secret permissions; no controller compromise isolation is claimed.
|
||||
- ESO v0.16.1 TokenRequest expiry is 600 seconds and its fallback reads legacy SA token references; proposed dedicated
|
||||
SA has no legacy tokens and automount false.
|
||||
- Native publication requires exact1.2 acknowledgment and independent owner changes/created-only receipts; no
|
||||
live grant is issued by this draft.
|
||||
verification:
|
||||
positive:
|
||||
- policy workload-kv-read-keycape-forgejo-forgejo grants read on platform/data/workloads/keycape/forgejo only
|
||||
(capabilities check)
|
||||
negative:
|
||||
- a default-only identity has no read capability on the path
|
||||
- sibling GET and parent LIST are denied
|
||||
activation_conditions:
|
||||
- case acceptance present
|
||||
- bound claims confirmed by the platform owner
|
||||
lifecycle:
|
||||
deactivate: First revert consumer reference and remove only proved-created target/delivery objects; revoke issued
|
||||
reader tokens or await verified expiry, then delete created role and finally policy. Preserve shared/matched
|
||||
objects.
|
||||
rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
|
||||
compromised: owner incident process; no automatic read, reseed or cleanup
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.2
|
||||
render_digest: sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35
|
||||
acceptance_record: PENDING exact proposed1.2 owner/founder acknowledgment; original1.1 acceptance is not transferred
|
||||
accepted_at: null
|
||||
accepted_by: []
|
||||
historical_request:
|
||||
path: credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml
|
||||
sha256: a36ab567839c12660c8ca468c8e4c6a67e367c92ae2ae51851b8e34c35a277f3
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.0
|
||||
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
||||
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
||||
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
||||
accepted_at: '2026-10-08'
|
||||
accepted_by:
|
||||
- owner
|
||||
- founder
|
||||
proposed_refinement_readiness:
|
||||
owner: railiance-apps
|
||||
blocking_reason: Concrete identity and supported ESO design are prepared; native metadata apply/delivery remains
|
||||
unapproved. Existing ORGREF-WP-0002 coordinates consumer handover and break-glass gates.
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"bound_service_account_names": [
|
||||
"forgejo-keycape-forgejo-eso"
|
||||
],
|
||||
"bound_service_account_namespaces": [
|
||||
"forgejo"
|
||||
],
|
||||
"audience": "openbao",
|
||||
"token_policies": [
|
||||
"workload-kv-read-keycape-forgejo-forgejo"
|
||||
],
|
||||
"token_no_default_policy": true,
|
||||
"token_ttl": 900,
|
||||
"token_max_ttl": 900,
|
||||
"token_explicit_max_ttl": 900
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# workload-kv-read-keycape-forgejo-forgejo: CCR-2026-0042, from ops-mason SecurityCase forgejo-netkingdom-oidc
|
||||
# (oidc-browser-relying-party@1.0, render sha256:fb8b114d...). Platform-generated from the CCR:
|
||||
# the case render omitted the token self-lifecycle stanzas that token_self_lifecycle requires.
|
||||
|
||||
path "platform/data/workloads/keycape/forgejo" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/lookup-self" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/revoke-self" {
|
||||
capabilities = ["update"]
|
||||
}
|
||||
27
intakes/RPF-IN-0006-forgejo-consumer-eso-review.md
Normal file
27
intakes/RPF-IN-0006-forgejo-consumer-eso-review.md
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
---
|
||||
id: RPF-IN-0006
|
||||
kind: intake
|
||||
type: intake
|
||||
title: "Platform review of proposed Forgejo ESO consumer reader"
|
||||
repo: railiance-platform
|
||||
lane: supervised
|
||||
status: closed
|
||||
owner: railiance-platform
|
||||
requested_by: the-custodian
|
||||
origin: handoff
|
||||
origin_ref: CCR-2026-0042
|
||||
priority: high
|
||||
created: "2026-10-11"
|
||||
updated: "2026-10-11"
|
||||
tags: [security, cross-owner, review]
|
||||
---
|
||||
|
||||
Owner review of exact source manifest `271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279`, proposed dedicated ESO consumer-reader CCR/body, custody, binding, installed-controller compatibility, revocation and exact new type/case acknowledgment boundary. This source work record precedes the formal review. No other owner role, native apply, token mint, secret read or human acknowledgment is asserted. Final review disposition will close this record; native dependencies remain in the existing case/CCR driver.
|
||||
|
||||
## Completed source review
|
||||
|
||||
Absorbed into platform technical review `RPF-REVIEW-20261011-FORGEJO-ESO-R1`: exact17-path source reviewed; generated consumer CCR must identify Forgejo workload and preserve issued-token revocation/expiry plus created-only rollback terms. Conditional review complete; implementation refinement remains with ORGREF-WP-0002/CCR-2026-0042, and fresh proposed1.2 acknowledgment/native owner gates are unfulfilled. The completed source work record precedes the formal review entry.
|
||||
|
||||
## Final exact review
|
||||
|
||||
Final technical agreement `RPF-REVIEW-20261011-FORGEJO-ESO-R1-FINAL` covers only refined19-path manifest `5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431`. Both generated-CCR defects resolved;44 independently rerun focused tests pass. Initial conditional review and counterexample remain historical evidence. This completed source review is not new type/case1.2 acknowledgment, native apply, credential mint, structural materialization, consumer Helm handover or first-case completion. Existing ORGREF-WP-0002/CCR42 carry those remaining gates.
|
||||
Loading…
Add table
Add a link
Reference in a new issue