Prepare reviewed Forgejo consumer ESO scope and truthful recovery records
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
codex
parent
c771a17269
commit
5b9c8262be
8 changed files with 276 additions and 0 deletions
|
|
@ -0,0 +1,47 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-FORGEJO-ESO-R1",
|
||||
"work_record": "RPF-IN-0006",
|
||||
"reviewer_role": "railiance-platform technical owner only",
|
||||
"status": "changes-required",
|
||||
"exact_manifest_sha256": "271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279",
|
||||
"reviewed_paths": 17,
|
||||
"all_source_hashes_match": true,
|
||||
"primary_eso_source_sha256": "e53f43c0748e43f408b5a7c5323c12c0fb5fb4299a33718181f6d70945112071",
|
||||
"primary_eso_source_url": "https://raw.githubusercontent.com/external-secrets/external-secrets/v0.16.1/pkg/provider/vault/auth_kubernetes.go",
|
||||
"platform_ccr_validation": "passes with expected unconfirmed-bound-claim apply-block warning",
|
||||
"sound_preparation": [
|
||||
"Dedicated forgejo namespace reader SA and audience openbao, exact role and one data path plus existing token self lifecycle; no default policy or parent/sibling/list permission.",
|
||||
"Installed CRD supports referenced SA/audiences; retained native RBAC confirms common controller TokenRequest/Secret authority. Independently fetched installed-version provider source confirms600second TokenRequest, namespace-local SA and legacy-token fallback.",
|
||||
"Proposal explicitly discloses common-controller trust, HTTP custody and no cryptographic isolation; new SA legacy token refs must be absent, with no static fallback or manual secret seeding.",
|
||||
"Original acknowledged1.1/acceptedcase/history unchanged; proposed1.2 adds sixth object and requires new exact acknowledgment and native provenance before structural/materialized claims.",
|
||||
"Manual proposed CCR42 and owner design correctly require created-only rollback, consumer reference reversal, issued-reader-token revocation or independently verified expiry before declaring deactivation."
|
||||
],
|
||||
"required_changes": [
|
||||
{
|
||||
"id": "RPF-FORGEJO-ESO-01",
|
||||
"source": "ops-mason/src/ops_mason/case_build.py::_ccr",
|
||||
"finding": "Generated consumer CCR target.workload is keycape, while dedicated consumer role is Forgejo and proposed CCR42 target.workload is forgejo.",
|
||||
"required": "Derive consumer workload from consuming_service for consumer-reader-policy, preserving KeyCape ESO reader target; regression must distinguish both generated CCR targets."
|
||||
},
|
||||
{
|
||||
"id": "RPF-FORGEJO-ESO-02",
|
||||
"source": "ops-mason/src/ops_mason/case_build.py::_ccr",
|
||||
"finding": "Generated lifecycle.deactivate only says delete role then policy; deletion does not revoke issued OpenBao tokens and omits created/preexisting distinction.",
|
||||
"required": "Generated successor consumer CCR must retain owner-native created-only/custody rollback and revoke issued reader tokens or verify expiry before deactivation; no new login or remint allowed during recovery. Preserve existing historical source and add meaningful output regression."
|
||||
}
|
||||
],
|
||||
"native_preconditions": [
|
||||
"Fresh exact ESO runtime identity/CRD/RBAC and dedicated SA absence of legacy token refs. Tag observation is compatibility preparation, not cryptographic image identity proof.",
|
||||
"Exact founder/type/case1.2 acknowledgment plus platform CCR approval/bound claims confirmed and authenticated per-owner structural/custody receipts before native apply or credential mint.",
|
||||
"Future consumer Helm secret consumption/group enforcement/break-glass/browser/MFA handover remains separately incomplete.",
|
||||
"Ready status/metadata never substitute for native authorization, issued-token revocation, key rotation or cross-owner completion."
|
||||
],
|
||||
"limits": {
|
||||
"native_changes": false,
|
||||
"credential_mint": false,
|
||||
"secret_read": false,
|
||||
"founder_acknowledgment": false,
|
||||
"other_owner_role_review": false,
|
||||
"first_case_completion": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"review_id": "RPF-REVIEW-20261011-FORGEJO-ESO-R1-FINAL",
|
||||
"work_record": "RPF-IN-0006",
|
||||
"reviewer_role": "railiance-platform technical owner only",
|
||||
"status": "technical-agreement",
|
||||
"exact_manifest_sha256": "5dbd04cf96d73a2604cbf113073d618c03434fc87508ba614cbe3820a1a0e431",
|
||||
"reviewed_paths": 19,
|
||||
"candidate_builder_sha256": "c2b140f380407779ce5478ca57c97eb0e6375d6a9cad4591b0b29ddd177db686",
|
||||
"initial_conditional_manifest_sha256": "9e4967bfff57694ceb12883f522edc405ef3fa316e46b88c9bdad47205a180b4",
|
||||
"initial_proposal_manifest_sha256": "271afd04512b3dac642b3385013cac03d28afde22ff97bcca8d0e262ab3d9279",
|
||||
"all_manifest_hashes_match": true,
|
||||
"independently_rerun_focused_tests": 44,
|
||||
"resolved": [
|
||||
"Generated consumer-reader target.workload derives consuming_service=forgejo, KeyCape ESO reader remains keycape, generated request identities remain distinct.",
|
||||
"Generated role-backed consumer deactivation includes authenticated created-only custody, preserving shared/preexisting resources, issued-token revocation or independently verified expiry, no-new-login/no-remint recovery, and refusal on changed references/UID/ownership."
|
||||
],
|
||||
"independent_generated_source_probe": "refined-generated-ccr-probe.json",
|
||||
"retained_preconditions": [
|
||||
"Fresh owner/founder exact type/case1.2 acknowledgment required for sixth structural role/runtime delivery; accepted1.1 does not transfer.",
|
||||
"CCR42 reconciliation retains prior body/history; actual bound claims unconfirmed, source-only role/policy/delivery objects not applied.",
|
||||
"Future exact ESO runtime/CRD/RBAC and no-legacy-token SA admission, authenticated created/preexisting ownership/capability receipts and approved contained owner changes remain required; common controller trust and existing HTTP custody are disclosed.",
|
||||
"No deletion-alone revocation claim; revoke issued OpenBao tokens or independently verify expiry before deactivation, with old consumer references reverted and unknown outcomes retained.",
|
||||
"Consumer Helm secret consumption/group enforcement, break-glass/MFA/browser checks and Warden descriptor/native per-owner session proof remain distinct unfinished gates."
|
||||
],
|
||||
"scope": "Technical agreement on source proposal and platform CCR semantics only. No other owner role acceptance or native activation.",
|
||||
"limits": {
|
||||
"founder_acknowledgment": false,
|
||||
"native_apply": false,
|
||||
"credential_mint": false,
|
||||
"secret_read": false,
|
||||
"structural_materialization": false,
|
||||
"first_case_complete": false
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"synthetic_source_only": true,
|
||||
"native_action": false,
|
||||
"generated_target_workload": "keycape",
|
||||
"manual_ccr_target_workload": "forgejo",
|
||||
"generated_deactivate": "delete the role, then policy workload-kv-read-keycape-forgejo-forgejo (case rollback)",
|
||||
"generated_bound_claims_confirmed": false
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"synthetic_source_only": true,
|
||||
"native_action": false,
|
||||
"consumer_target": "forgejo",
|
||||
"keycape_reader_target": "keycape",
|
||||
"generated_ids_distinct": true,
|
||||
"bound_claims_remain_false": true,
|
||||
"lifecycle_terms": {
|
||||
"case-created": true,
|
||||
"preexisting-matched": true,
|
||||
"shared": true,
|
||||
"revoke issued reader tokens": true,
|
||||
"independently verified expiry": true,
|
||||
"deletion alone does not revoke": true,
|
||||
"no new login": true,
|
||||
"no remint": true,
|
||||
"stop on changed": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
id: CCR-2026-0042
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: 'forgejo-netkingdom-oidc: proposed dedicated consumer ESO reader (oidc-browser-relying-party@1.2)'
|
||||
status: proposed
|
||||
created: '2026-10-09'
|
||||
updated: '2026-10-11'
|
||||
requester:
|
||||
agent: ops-mason
|
||||
reason: Source-only owner refinement of existing CCR-2026-0042. Proposed type/case1.2 and full run source require
|
||||
new exact acknowledgment; original approvals do not authorize this reader role or native delivery. Historical
|
||||
body retained by exact file hash and provenance below.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: forgejo
|
||||
environment: production
|
||||
purpose: Dedicated namespace-local ESO reference identity delivers CLIENT_SECRET to Forgejo; the Forgejo workload/default
|
||||
SA does not authenticate directly to OpenBao.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/keycape/forgejo
|
||||
fields:
|
||||
- CLIENT_SECRET
|
||||
policy_name: workload-kv-read-keycape-forgejo-forgejo
|
||||
policy_file: openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
|
||||
metadata_read: false
|
||||
token_self_lifecycle: true
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-keycape-forgejo-forgejo
|
||||
audience: openbao
|
||||
ttl: 15m
|
||||
token_max_ttl: 15m
|
||||
token_explicit_max_ttl: 15m
|
||||
token_no_default_policy: true
|
||||
policies:
|
||||
- workload-kv-read-keycape-forgejo-forgejo
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- forgejo-keycape-forgejo-eso
|
||||
service_account_namespaces:
|
||||
- forgejo
|
||||
bound_claims_confirmed: false
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: forgejo-keycape-client
|
||||
readiness: pending-review
|
||||
resolvable: false
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Rendered from proposed SecurityCaseType/case 1.2 source, not an acknowledged successor. Retained read-only native
|
||||
ESO image/CRD/RBAC and Forgejo identity observations support preparation only; bound claims remain unconfirmed
|
||||
and apply blocked. The new sixth consumer role/auth path requires fresh informed-decision acknowledgment under
|
||||
SecurityCaseTypes canon section 6; acknowledged type 1.1 and accepted case 1.1 do not authorize it.
|
||||
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
||||
- Dedicated reference identity separates consumer and KeyCape role bindings, but common ESO controller already
|
||||
has clusterwide TokenRequest and Secret permissions; no controller compromise isolation is claimed.
|
||||
- ESO v0.16.1 TokenRequest expiry is 600 seconds and its fallback reads legacy SA token references; proposed dedicated
|
||||
SA has no legacy tokens and automount false.
|
||||
- Native publication requires exact1.2 acknowledgment and independent owner changes/created-only receipts; no
|
||||
live grant is issued by this draft.
|
||||
verification:
|
||||
positive:
|
||||
- policy workload-kv-read-keycape-forgejo-forgejo grants read on platform/data/workloads/keycape/forgejo only
|
||||
(capabilities check)
|
||||
negative:
|
||||
- a default-only identity has no read capability on the path
|
||||
- sibling GET and parent LIST are denied
|
||||
activation_conditions:
|
||||
- case acceptance present
|
||||
- bound claims confirmed by the platform owner
|
||||
lifecycle:
|
||||
deactivate: First revert consumer reference and remove only proved-created target/delivery objects; revoke issued
|
||||
reader tokens or await verified expiry, then delete created role and finally policy. Preserve shared/matched
|
||||
objects.
|
||||
rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
|
||||
compromised: owner incident process; no automatic read, reseed or cleanup
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.2
|
||||
render_digest: sha256:c0afd5576cdae0cbc807eccb2b9fa87ac668f15e32ec7cf79d295bdb23c75b35
|
||||
acceptance_record: PENDING exact proposed1.2 owner/founder acknowledgment; original1.1 acceptance is not transferred
|
||||
accepted_at: null
|
||||
accepted_by: []
|
||||
historical_request:
|
||||
path: credential-change-requests/CCR-2026-0042-forgejo-netkingdom-oidc-consumer-reader.yaml
|
||||
sha256: a36ab567839c12660c8ca468c8e4c6a67e367c92ae2ae51851b8e34c35a277f3
|
||||
security_case:
|
||||
case: forgejo-netkingdom-oidc
|
||||
type: oidc-browser-relying-party@1.0
|
||||
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
||||
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
||||
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
||||
accepted_at: '2026-10-08'
|
||||
accepted_by:
|
||||
- owner
|
||||
- founder
|
||||
proposed_refinement_readiness:
|
||||
owner: railiance-apps
|
||||
blocking_reason: Concrete identity and supported ESO design are prepared; native metadata apply/delivery remains
|
||||
unapproved. Existing ORGREF-WP-0002 coordinates consumer handover and break-glass gates.
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"bound_service_account_names": [
|
||||
"forgejo-keycape-forgejo-eso"
|
||||
],
|
||||
"bound_service_account_namespaces": [
|
||||
"forgejo"
|
||||
],
|
||||
"audience": "openbao",
|
||||
"token_policies": [
|
||||
"workload-kv-read-keycape-forgejo-forgejo"
|
||||
],
|
||||
"token_no_default_policy": true,
|
||||
"token_ttl": 900,
|
||||
"token_max_ttl": 900,
|
||||
"token_explicit_max_ttl": 900
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# workload-kv-read-keycape-forgejo-forgejo: CCR-2026-0042, from ops-mason SecurityCase forgejo-netkingdom-oidc
|
||||
# (oidc-browser-relying-party@1.0, render sha256:fb8b114d...). Platform-generated from the CCR:
|
||||
# the case render omitted the token self-lifecycle stanzas that token_self_lifecycle requires.
|
||||
|
||||
path "platform/data/workloads/keycape/forgejo" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/lookup-self" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
|
||||
path "auth/token/revoke-self" {
|
||||
capabilities = ["update"]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue