Complete live State Hub signing activation and rotation acceptance
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex
parent
ae27a42b18
commit
5d6d8724b4
7 changed files with 167 additions and 9 deletions
|
|
@ -35,7 +35,7 @@ cross-namespace store references. Coding-agent data AND metadata are denied.
|
|||
```sh
|
||||
warden access openbao-platform-admin-login --exec -- \
|
||||
/usr/bin/python3 /home/worsch/railiance-platform/scripts/state_hub_preflight_lane.py \
|
||||
provision --expected-version 0 --kubeconfig /home/worsch/.kube/config \
|
||||
provision --expected-version 0 --kubeconfig /home/worsch/.kube/config-railiance01 \
|
||||
--receipt /tmp/statehub-preflight-provision.json --confirm 'APPLY CCR-2026-0015'
|
||||
```
|
||||
|
||||
|
|
@ -107,3 +107,25 @@ preserving every unrelated live rule. It does not deploy the pending Policy
|
|||
Nexus source-only change as part of this lane. The global source policy retains
|
||||
its desired rules; live parity for that other lane remains a platform assurance
|
||||
observation, not an acceptance claim here.
|
||||
|
||||
|
||||
## Accepted activation — 2026-09-05
|
||||
|
||||
T04 completed; CCR-2026-0015 is active. Version 1 was generated with CAS zero,
|
||||
then version 2 was generated with CAS 1 during the all-API-replicas outage.
|
||||
Both custody receipts passed exact read and scope/identity denials. ESO is Ready;
|
||||
Helm revision 59 enabled the API-only binding with the existing image. The
|
||||
post-rotation API probe passed key equality, primary health, new signed preflight
|
||||
and predecessor signature rejection. No repository rename was executed.
|
||||
|
||||
ESO v0.16.1 required token self-validation and cleanup despite the deliberate
|
||||
absence of the default policy. The exact read policy now additionally permits
|
||||
`auth/token/lookup-self` read and `auth/token/revoke-self` update. It adds no KV
|
||||
metadata, parent list or secret write. Source evidence:
|
||||
https://github.com/external-secrets/external-secrets/blob/v0.16.1/pkg/provider/vault/auth.go
|
||||
The bounded `repair-policy` action refuses drift and does not regenerate a key.
|
||||
|
||||
Use the dedicated kubeconfig above, whose port-forward endpoint is 16444;
|
||||
the default config's 16443 listener was unavailable. Always verify the pinned
|
||||
cluster UID. Protected predecessor fixture was removed after acceptance.
|
||||
Receipts: `docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json`.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
# State Hub repository-rename preflight signing lane
|
||||
|
||||
Status: implementation staged, not provisioned. Owner: railiance-platform, RPF-WP-0035-T04.
|
||||
Status: active; accepted 2026-09-05. Owner: railiance-platform, RPF-WP-0035-T04.
|
||||
CCR-2026-0015 is active at key version 2. See
|
||||
`state-hub-preflight-activation.md` for the accepted implementation and evidence.
|
||||
Demand: State Hub message `cd52ba10-de41-46ce-aa8b-9b44050da8f7`,
|
||||
STATE-WP-0085-T09. Provisioning this lane does not authorize any repository rename.
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,79 @@
|
|||
{
|
||||
"schema": "platform.statehub-preflight-activation.v1",
|
||||
"date": "2026-09-05",
|
||||
"task": "RPF-WP-0035-T04",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"helm_revision": 59,
|
||||
"chart_commit": "49e3182332cd46bd66ea51d77c97a97f65c48001",
|
||||
"image": "main-cdff3b7",
|
||||
"final_kv_version": 2,
|
||||
"repository_rename_performed": false,
|
||||
"receipts": {
|
||||
"provision": {
|
||||
"schema": "platform.statehub-preflight-custody.v1",
|
||||
"status": "custody_verified_pending_eso_and_api_acceptance",
|
||||
"action": "provision",
|
||||
"kv_version": 1,
|
||||
"key_generation": "CSPRNG-32-bytes-CAS",
|
||||
"exact_read_and_scope_denials": true,
|
||||
"wrong_sa": true,
|
||||
"wrong_namespace": true,
|
||||
"wrong_audience": true,
|
||||
"coding_agent_deny_wins": true
|
||||
},
|
||||
"eso_policy_repair": {
|
||||
"schema": "platform.statehub-preflight-custody.v1",
|
||||
"status": "custody_verified_pending_eso_and_api_acceptance",
|
||||
"action": "repair-policy",
|
||||
"exact_read_and_scope_denials": true,
|
||||
"wrong_sa": true,
|
||||
"wrong_namespace": true,
|
||||
"wrong_audience": true,
|
||||
"coding_agent_deny_wins": true
|
||||
},
|
||||
"before_rotation": {
|
||||
"schema": "platform.statehub-preflight-api-acceptance.v1",
|
||||
"status": "passed",
|
||||
"api_only": true,
|
||||
"replicas": 1,
|
||||
"secret_resource_version": "57218196",
|
||||
"results": [
|
||||
{
|
||||
"key_matches": true,
|
||||
"signed_preflight_valid": true,
|
||||
"old_token_rejected": null,
|
||||
"blockers": [],
|
||||
"health": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"rotation": {
|
||||
"schema": "platform.statehub-preflight-custody.v1",
|
||||
"status": "custody_verified_pending_eso_and_api_acceptance",
|
||||
"action": "rotate",
|
||||
"kv_version": 2,
|
||||
"key_generation": "CSPRNG-32-bytes-CAS",
|
||||
"exact_read_and_scope_denials": true,
|
||||
"wrong_sa": true,
|
||||
"wrong_namespace": true,
|
||||
"wrong_audience": true,
|
||||
"coding_agent_deny_wins": true
|
||||
},
|
||||
"after_rotation": {
|
||||
"schema": "platform.statehub-preflight-api-acceptance.v1",
|
||||
"status": "passed",
|
||||
"api_only": true,
|
||||
"replicas": 1,
|
||||
"secret_resource_version": "57239554",
|
||||
"results": [
|
||||
{
|
||||
"key_matches": true,
|
||||
"signed_preflight_valid": true,
|
||||
"old_token_rejected": true,
|
||||
"blockers": [],
|
||||
"health": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue