coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0041: record founder apply of the Forgejo case ESO reader
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Policy workload-kv-read-keycape-forgejo-eso and Kubernetes role
external-secrets-keycape-forgejo applied 2026-10-09T18:09Z. Inert until
mint-secret creates platform/workloads/keycape/forgejo (RPF-WP-0054).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469992@bnt-lap001
Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
This commit is contained in:
codex 2026-10-09 20:09:55 +02:00
parent 87234a2c04
commit 7d498c8547
1 changed files with 41 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

57
credential-change-requests/CCR-2026-0041-forgejo-netkingdom-oidc-keycape-eso-reader.yaml
View file

@ -3,27 +3,38 @@ kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.0)'
status: proposed
status: applied
created: '2026-10-09'
updated: '2026-10-09'
requester:
agent: ops-mason
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render
sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08:
key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged
via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance
replaces a fresh executive summary.'
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0),
render sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23.
Accepted by owner, founder on 2026-10-08: key-cape docs/forgejo-oidc-client-request.yaml
(status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision
memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The
case acceptance replaces a fresh executive summary.'
review:
required: true
required_approvers:
- platform-owner
comments: []
comments:
- at: '2026-10-09T18:09:10+00:00'
reviewer: platform-owner (founder Bernd Worsch)
decision: approved
comment: Approve ESO reader for SecurityCase forgejo-netkingdom-oidc (accepted
2026-10-08).
- at: '2026-10-09T18:09:10+00:00'
reviewer: founder
decision: binding_confirmed
comment: Bound to external-secrets/external-secrets, mirrors CCR-2026-0033.
target:
domain: infotech
tenant: platform
workload: keycape
environment: production
purpose: KeyCape reads its client secret only through ESO. No metadata, list, parent or sibling access.
purpose: KeyCape reads its client secret only through ESO. No metadata, list, parent
or sibling access.
openbao:
mount: platform
kv_path: platform/workloads/keycape/forgejo
@ -49,7 +60,7 @@ openbao:
- external-secrets
service_account_namespaces:
- external-secrets
bound_claims_confirmed: false
bound_claims_confirmed: true
access_frontdoor:
type: external-secrets
catalog_id: forgejo-keycape-client
@ -58,28 +69,42 @@ access_frontdoor:
risk:
classification: high
notes:
- Rendered from an acknowledged SecurityCaseType; shape reviewed with the type, names checked against live structure.
- Rendered from an acknowledged SecurityCaseType; shape reviewed with the type,
names checked against live structure.
- Exact read on one KV path; no metadata, list, parent or sibling access.
verification:
positive:
- policy workload-kv-read-keycape-forgejo-eso grants read on platform/data/workloads/keycape/forgejo only (capabilities
check)
- policy workload-kv-read-keycape-forgejo-eso grants read on platform/data/workloads/keycape/forgejo
only (capabilities check)
negative:
- a default-only identity has no read capability on the path
- sibling GET and parent LIST are denied
activation_conditions:
- case acceptance present
- bound claims confirmed by the platform owner
evidence:
- at: '2026-10-09T18:09:18+00:00'
actor: founder
kind: delegated_metadata_apply
result: passed
details:
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-forgejo-eso'
- 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-forgejo'
- No secret values were read, written, printed, or accepted in argv.
lifecycle:
deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-eso (case rollback)
rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-eso (case
rollback)
rotate: roll-forward through the credential broker (mint-secret); never a read of
the old value
compromised: owner incident process; no automatic read, reseed or cleanup
security_case:
case: forgejo-netkingdom-oidc
type: oidc-browser-relying-party@1.0
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08,
KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4,
hub decision e418263e
accepted_at: '2026-10-08'
accepted_by:
- owner