Separate signer runtime storage review from GitOps ownership
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
codex
parent
a3e8eb64ba
commit
84c529f239
6 changed files with 79 additions and 15 deletions
|
|
@ -18,7 +18,7 @@ review:
|
|||
- railiance-platform-owner
|
||||
- access-engine-owner
|
||||
- secrets-engine-owner
|
||||
- cluster-gitops-owner
|
||||
- cluster-runtime-storage-owner
|
||||
comments: []
|
||||
target:
|
||||
domain: infotech
|
||||
|
|
@ -77,8 +77,10 @@ risk:
|
|||
only private field is projected. Signer and Secrets consumer have no KV read role.'
|
||||
- No parent/list/metadata/write/delete capability on ESO role. No token/Secret read
|
||||
or ExternalSecret mutation granted to signer/consumer.
|
||||
- Dedicated role is new scope; founder approval required. No workload rapp tuple
|
||||
invented; absent managed package declaration remains explicit migration debt.
|
||||
- Dedicated role is new scope; founder approval required. Canonical local draft
|
||||
rapp-flex-auth-secrets-engine declaration committed d52f811ed5ec0be27c9c367e71d476125b3228be
|
||||
(tree d4fbad71bdc8ef870603526ccd1f53195d0322af) resolves locally. Remote publication,
|
||||
placement and actual runtime/package join remain open; no missing-declaration waiver.
|
||||
- Controlled outage fence stops every signer pod and disables autoscaling before
|
||||
creation/rotation. Recreate single writer and retained PVC remain Access-owned
|
||||
review gates.
|
||||
|
|
@ -102,10 +104,15 @@ verification:
|
|||
activation_conditions:
|
||||
- All five required approvers independently dispose the exact CCR and native writer/fence
|
||||
proposal; founder exact new custody scope approved.
|
||||
- Current retained identity919ce25, immutable published producer image and explicit
|
||||
new flex-auth-secrets-engine-outbox PVC1Gi/local-path, retention/reclaim and bounded-runtime
|
||||
plan reviewed by Access; missing managed package migration debt explicitly accepted
|
||||
for this retained workload only.
|
||||
- Exact proposed candidate source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0 and immutable
|
||||
OCI reference forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f
|
||||
published by successful ordinary CI402; source OS-lock/64MiB/startup hardening present.
|
||||
Access reviews exact workload/Helm image/mount/outbox source and actual stopped fence;
|
||||
Platform reviews existing GitOps Application sync/freeze; cluster reviews runtime,
|
||||
headroom and new PVC1Gi/local-path actual PV retention. Local draft package d52
|
||||
remains source2b/current05a, not candidate84 adoption; remote placement/runtime join
|
||||
and native mounted-runtime acceptance remain open. Enablement only if separately
|
||||
proposed ArgoCD installation/controller configuration changes; none granted here.
|
||||
- Exact native bound claims verified without printing JWT/Secret; read grant policy
|
||||
and role native readback match source.
|
||||
- Protected child source pinned, silent attended OIDC context verified, target cluster/backend
|
||||
|
|
|
|||
|
|
@ -185,3 +185,21 @@ refresh after OIDC, reinterpret expiry as start-only, widen120seconds, skip
|
|||
reviews or start a general window-grant service. An alternative authority/window
|
||||
contract would itself require separate owner/founder design and is not supplied
|
||||
by R2. Current native admission remains unapproved.
|
||||
|
||||
## R3 precise owner review boundary
|
||||
|
||||
The native review slot is now `cluster-runtime-storage-owner`, held by
|
||||
railiance-cluster for runtime/storage/headroom only. The previous
|
||||
`cluster-gitops-owner` slot conflated separate authorities and is rejected;
|
||||
no historic review is reinterpreted as a combined assent. Platform's existing
|
||||
review covers its custody/read lane and existing GitOps Applications/freeze
|
||||
integration. Access retains workload/release/Helm-values and signer/outbox
|
||||
ownership. Enablement review is needed only when the action actually changes
|
||||
ArgoCD installation/controller configuration; this action does not authorize
|
||||
that. Changed scope requires a separate exact revision and any affected owner.
|
||||
|
||||
This is a source-schema correction, not a new approval. Existing R1/R2 source
|
||||
reviews and P1/P2 packets remain frozen. A successor packet must pin the new
|
||||
executor/source-bundle/plan/CCR hashes and collect five exact fresh dispositions
|
||||
under the corrected role set. Admission-file digest approval and CCR
|
||||
approved/binding-confirmed status/native checks remain unchanged.
|
||||
|
|
|
|||
|
|
@ -67,11 +67,11 @@
|
|||
"Verify deployment spec replicas0, observed generation caught up, no live or terminating owned ReplicaSet/pods, no matching signer-SA pods and no HPA targeting deployment.",
|
||||
"Reject a differing/previously existing KV entry at bootstrap. Hold exclusive owner action receipt lock and recheck fence immediately before CAS."
|
||||
],
|
||||
"after_cas": "Keep consumers/signer stopped until independent public admission and exact ESO/readback/source/image verification. Recreate1 is Access-owned; any drift or uncertain outcome keeps fence closed. Access reports current outbox lacks OS process lock, byte ceiling and bounded startup/compaction; Recreate1 alone is not bounded durable acceptance. Keep protected acceptance closed until reviewed source hardening or explicit bounded attended fixture disposition.",
|
||||
"concurrency": "Single attended owner window/exclusive receipt; GitOps/Helm autosync/other writers must be paused by Access/cluster owner under distinct reviewed action. Plan is not a Kubernetes atomic fence or same-UID isolation."
|
||||
"after_cas": "Keep consumers/signer stopped until independent public admission and exact ESO/readback/source/image verification. Access published source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0 with OS process lock,64MiB capacity/startup bounds and ordinary CI402 success, immutable OCI reference forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f. This supplies reviewed-source/publication evidence, not native mounted-runtime/durable-record acceptance. Access owns Recreate1 activation; actual stopped fence, single writer, PV retention and protected consumer acceptance remain open.",
|
||||
"concurrency": "Single attended owner window/exclusive receipt; Access owns workload/Helm release and freeze of competing workload writers; Platform owns existing GitOps Applications and sync/freeze integration; cluster owner reviews runtime/storage/headroom only. Enablement reviews actual ArgoCD installation/controller configuration changes only, which this action excludes. Actual competing creator IDs/revisions and stopped signer fence need separately reviewed authenticated observations. Plan is not a Kubernetes atomic fence or same-UID isolation."
|
||||
},
|
||||
"protected_adapter": {
|
||||
"state": "implementation/independent tests still required before executable approval; fixture code must never be promoted by removing its dev-process check",
|
||||
"state": "Native adapter bootstrap/phase-aware read-only recovery source implemented and tested at published Platform a3e8eb64bae110393ba0aeab043de03a92b8421a; owner-boundary source R3/R4 is a successor exact review revision, not a native execution approval. Exact source/CCR, distinct owner/founder dispositions, entity/window/expiry and actual backend/fence remain mandatory. Fixture dev-process gate remains preserved.",
|
||||
"reuse": [
|
||||
"scripts/state_hub_preflight_lane.py attended silent child/cluster/platform-admin/fencing patterns",
|
||||
"scripts/flex_auth_signer_custody.py protected Ed25519 CAS/readback and receipt state machine",
|
||||
|
|
@ -115,9 +115,9 @@
|
|||
"requested_scope": {
|
||||
"read_lane": "Exact CCR0050 policy/role/delivery source only after separate founder review. No extra ESO RBAC permitted.",
|
||||
"custody_writer": "One attended exact-target CAS0 plus fixed KV metadata setup/readback; no standing writer grant or broker role. This authority is separate from read CCR.",
|
||||
"kubernetes": "Metadata-only fence observations by child; Access/cluster separately approve stop/restart/delivery manifests and sync control.",
|
||||
"kubernetes": "Metadata-only fence observations by child; Access separately reviews workload/Helm stop/restart/delivery; Platform owns GitOps Application sync/freeze integration; cluster owner reviews runtime/storage/headroom/PV retention; no ArgoCD installation/controller configuration mutation included.",
|
||||
"new_infrastructure_spend_eur": 0,
|
||||
"new_resources": "Platform creates no storage resources. Access reports zero flex-auth PVCs; Access proposes separate exact new flex-auth-secrets-engine-outbox1Gi local-path Helmkeep. Provisioning, PV reclaim/Delete/WaitForFirstConsumer retention and runtime log bounds require separate founder/cluster/Access review; no durable outbox acceptance yet.",
|
||||
"new_resources": "Platform creates no storage resources. Access proposes separate exact new flex-auth-secrets-engine-outbox1Gi local-path Helmkeep. Actual provisioning/PV identity, StorageClass Delete/WaitForFirstConsumer to reviewed PV Retain disposition and native bounded-runtime evidence remain open. Source lock/64MiB/startup bounds are published in candidate84, not evidence of native mounted-runtime acceptance.",
|
||||
"risk_bound": "Controlled loss of retained PDP availability during explicit attended fence; seed compromise can forge lifecycle decisions until independent public trust withdrawal; founder must approve this concrete high-risk scope."
|
||||
},
|
||||
"reviews_required": [
|
||||
|
|
@ -134,7 +134,7 @@
|
|||
"disposition": "pending exact source/artifact review; no approval recorded"
|
||||
},
|
||||
{
|
||||
"role": "cluster-gitops-owner",
|
||||
"role": "cluster-runtime-storage-owner",
|
||||
"disposition": "pending exact source/artifact review; no approval recorded"
|
||||
},
|
||||
{
|
||||
|
|
@ -147,6 +147,12 @@
|
|||
"supersedes_unadmitted_R3_role": "external-secrets-flex-auth-envelope-signing replaces flex-auth-envelope-signing-eso to fit existing delegated-applier role convention; dedicated SA unchanged",
|
||||
"read_ccr_field_projection": "Only ED25519_PRIVATE_KEY is delivered; public sibling fields remain visible to dedicated document-reader identity but never become consumer trust discovery",
|
||||
"projection_source": "docs/credential-lane-designs/flex-auth-envelope-signing-native-projection.yaml.proposed",
|
||||
"managed_declaration": "Missing rapp declaration remains migration debt; retain actual Access919ce25 workload identity, do not create package tuple"
|
||||
"managed_declaration": "Canonical local rapp-flex-auth-secrets-engine declaration committed d52f811ed5ec0be27c9c367e71d476125b3228be, exact13file tree d4fbad71bdc8ef870603526ccd1f53195d0322af; tuple rapp-flex-auth-secrets-engine/flex-auth-secrets-engine/flex-auth-secrets-engine resolves locally as draft. Frozen source2b/current05a package baseline does not adopt candidate84/signing. Remote publication/placement and actual runtime/package join remain open. No missing-declaration claim or migration-debt waiver is applicable to the established local declaration."
|
||||
},
|
||||
"owner_review_scope": {
|
||||
"railiance-platform-owner": "OpenBao custody/read lane; existing GitOps Applications and their sync/freeze/controller ownership; covers explicitly identified workload/Helm competing-writer integration with Access, not Access workload semantic ownership.",
|
||||
"access-engine-owner": "Retained workload/release source, Helm values, candidate image, signer delivery/mount and process/outbox fencing/rollback.",
|
||||
"cluster-runtime-storage-owner": "railiance-cluster: cluster identity/runtime/storage/headroom, local-path provisioning and actual PV retention; excludes workload and GitOps Application ownership.",
|
||||
"enablement_condition": "railiance-enablement additional exact review required only if proposed action changes ArgoCD installation/controller configuration; this fixed custody action authorizes no such change. Changed scope needs a separately reviewed exact revision rather than blanket extra reviewer."
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ NAME='flex-auth-secrets-engine'
|
|||
SECRET='flex-auth-secrets-engine-envelope-signing'
|
||||
ROLE='external-secrets-flex-auth-envelope-signing'
|
||||
LIFECYCLE='sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4'
|
||||
REVIEWS={'founder','railiance-platform-owner','access-engine-owner','secrets-engine-owner','cluster-gitops-owner'}
|
||||
REVIEWS={'founder','railiance-platform-owner','access-engine-owner','secrets-engine-owner','cluster-runtime-storage-owner'}
|
||||
SOURCE_FILES={'scripts/flex_auth_signer_native.py','scripts/flex_auth_signer_custody.py','scripts/task_execution_native_fixture.py','scripts/task_execution_journal.py','scripts/task_execution_recovery.py','scripts/credential-change.py'}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -316,3 +316,20 @@ def test_generated_but_unstored_seed_phase_recovers_without_public_admission(nat
|
|||
assert result['public_key'] is None and result['public_fingerprint'] is None
|
||||
assert old.read_bytes()==raw
|
||||
assert not any(x[0]=='http' and x[1]=='POST' for x in io.calls)
|
||||
|
||||
|
||||
def test_exact_runtime_storage_owner_slot_replaces_conflated_role(native):
|
||||
c,io,directory,call,approve,source=native
|
||||
assert m.REVIEWS=={'founder','railiance-platform-owner','access-engine-owner','secrets-engine-owner','cluster-runtime-storage-owner'}
|
||||
assert m.validate_admission(c)>5
|
||||
old=deepcopy(c)
|
||||
old['owner_reviews']['cluster-gitops-owner']=old['owner_reviews'].pop('cluster-runtime-storage-owner')
|
||||
with pytest.raises(Refused,match='distinct owner reviews'):
|
||||
m.validate_admission(old)
|
||||
missing=deepcopy(c);missing['owner_reviews'].pop('cluster-runtime-storage-owner')
|
||||
with pytest.raises(Refused,match='distinct owner reviews'):
|
||||
m.validate_admission(missing)
|
||||
extra=deepcopy(c);extra['owner_reviews']['railiance-enablement-owner']=next(iter(extra['owner_reviews'].values()))
|
||||
with pytest.raises(Refused,match='distinct owner reviews'):
|
||||
m.validate_admission(extra)
|
||||
assert io.calls==[]
|
||||
|
|
|
|||
|
|
@ -1375,3 +1375,19 @@ metadata-loss and denied/ambiguous tests added.120second expiry is unchanged;
|
|||
external reviews and unbounded OIDC require a pre-reviewed exact scheduled
|
||||
window, otherwise refuse/new explicit revision. No native or owner approval
|
||||
inferred; no live action.
|
||||
|
||||
|
||||
2026-10-16 T13 bounded source-review preparation note (no status/scope closure):
|
||||
Native signer owner-boundary R3/R4 preparation replaces conflated
|
||||
cluster-gitops-owner with cluster-runtime-storage-owner. Platform retains
|
||||
OpenBao and existing GitOps Applications/sync-freeze integration; Access owns
|
||||
workload/Helm release semantics; cluster reviews runtime/storage/headroom;
|
||||
Enablement participates only for actual ArgoCD installation/controller changes.
|
||||
Source facts reconcile implemented/tested native adapter a3e8eb64, canonical
|
||||
local draft package d52f811/tree d4fbad7 (frozen source2b/current05a) and
|
||||
ordinary CI402 published candidate84c78e0/image09a83b with OS lock/64MiB/startup
|
||||
hardening. Prior R1/R2/R3 and packetP1/P2 reviews/failures remain frozen.
|
||||
No missing-local-declaration waiver, remote placement, actual stopped fence,
|
||||
PV retention, native custody, independent post-key trust or founder/owner
|
||||
approval is inferred. Exact successor source/CCR/plan pins and fresh scoped
|
||||
reviews remain required; T12 native gates and historical T13 outcome unchanged.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue