From 7d498c854705520f5fbebd88e246e65d36826db5 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 9 Oct 2026 20:09:55 +0200 Subject: [PATCH] CCR-2026-0041: record founder apply of the Forgejo case ESO reader Policy workload-kv-read-keycape-forgejo-eso and Kubernetes role external-secrets-keycape-forgejo applied 2026-10-09T18:09Z. Inert until mint-secret creates platform/workloads/keycape/forgejo (RPF-WP-0054). Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9 --- ...jo-netkingdom-oidc-keycape-eso-reader.yaml | 57 +++++++++++++------ 1 file changed, 41 insertions(+), 16 deletions(-) diff --git a/credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml b/credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml index de7aafc..2a4eb1c 100644 --- a/credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml +++ b/credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml @@ -3,27 +3,38 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.0)' -status: proposed +status: applied created: '2026-10-09' updated: '2026-10-09' requester: agent: ops-mason - reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render - sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08: - key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged - via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance - replaces a fresh executive summary.' + reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), + render sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. + Accepted by owner, founder on 2026-10-08: key-cape docs/forgejo-oidc-client-request.yaml + (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision + memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The + case acceptance replaces a fresh executive summary.' review: required: true required_approvers: - platform-owner - comments: [] + comments: + - at: '2026-10-09T18:09:10+00:00' + reviewer: platform-owner (founder Bernd Worsch) + decision: approved + comment: Approve ESO reader for SecurityCase forgejo-netkingdom-oidc (accepted + 2026-10-08). + - at: '2026-10-09T18:09:10+00:00' + reviewer: founder + decision: binding_confirmed + comment: Bound to external-secrets/external-secrets, mirrors CCR-2026-0033. target: domain: infotech tenant: platform workload: keycape environment: production - purpose: KeyCape reads its client secret only through ESO. No metadata, list, parent or sibling access. + purpose: KeyCape reads its client secret only through ESO. No metadata, list, parent + or sibling access. openbao: mount: platform kv_path: platform/workloads/keycape/forgejo @@ -49,7 +60,7 @@ openbao: - external-secrets service_account_namespaces: - external-secrets - bound_claims_confirmed: false + bound_claims_confirmed: true access_frontdoor: type: external-secrets catalog_id: forgejo-keycape-client @@ -58,28 +69,42 @@ access_frontdoor: risk: classification: high notes: - - Rendered from an acknowledged SecurityCaseType; shape reviewed with the type, names checked against live structure. + - Rendered from an acknowledged SecurityCaseType; shape reviewed with the type, + names checked against live structure. - Exact read on one KV path; no metadata, list, parent or sibling access. verification: positive: - - policy workload-kv-read-keycape-forgejo-eso grants read on platform/data/workloads/keycape/forgejo only (capabilities - check) + - policy workload-kv-read-keycape-forgejo-eso grants read on platform/data/workloads/keycape/forgejo + only (capabilities check) negative: - a default-only identity has no read capability on the path - sibling GET and parent LIST are denied activation_conditions: - case acceptance present - bound claims confirmed by the platform owner + evidence: + - at: '2026-10-09T18:09:18+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-forgejo-eso' + - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-forgejo' + - No secret values were read, written, printed, or accepted in argv. lifecycle: - deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-eso (case rollback) - rotate: roll-forward through the credential broker (mint-secret); never a read of the old value + deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-eso (case + rollback) + rotate: roll-forward through the credential broker (mint-secret); never a read of + the old value compromised: owner incident process; no automatic read, reseed or cleanup security_case: case: forgejo-netkingdom-oidc type: oidc-browser-relying-party@1.0 render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23 - acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); - type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e + acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, + KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, + hub decision e418263e accepted_at: '2026-10-08' accepted_by: - owner