From 8c44256699a25e441a484538ea7157e3a0ab436f Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 3 Oct 2026 00:16:49 +0200 Subject: [PATCH] RPF-IN-0002: declare tenant-engine audit-core sender ESO policy, role apply script, test Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 292700@bnt-lap001 Assistant-Session: 42de6b79-9019-4cfd-b49a-6db3bbfe9341 --- intakes/intakes.md | 23 +++++++++ ...ad-tenant-engine-audit-core-sender-eso.hcl | 16 +++++++ ...t-engine-audit-core-sender-eso-attended.sh | 47 +++++++++++++++++++ ...est_tenant_engine_audit_core_sender_eso.py | 30 ++++++++++++ 4 files changed, 116 insertions(+) create mode 100644 openbao/policies/workload-kv-read-tenant-engine-audit-core-sender-eso.hcl create mode 100755 scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh create mode 100644 tests/test_tenant_engine_audit_core_sender_eso.py diff --git a/intakes/intakes.md b/intakes/intakes.md index e944893..d6cfb0a 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -26,3 +26,26 @@ resolution: >- Repointed the one live coordinate (scripts/create-t03-approval-requests.py, /home/worsch/flex-auth/examples -> /home/worsch/access-engine/examples), commit d32baa9; file verified present. Runtime/product vocabulary retained. state_hub_intake_id: "01a0f26d-0c87-791e-8cc6-8d09cd794160" ``` + +## RPF-IN-0002 — tenant-engine audit-core sender token: ESO Kubernetes-auth policy and role + +```yaml +id: RPF-IN-0002 +kind: intake +title: "tenant-engine audit-core sender token: ESO Kubernetes-auth policy and role" +status: open +origin: cross-repo +origin_ref: TEN-IN-0005 +priority: medium +owner: railiance-platform +requested_by: tenant-engine +description: >- + Declared 2026-10-03 (founder-approved ops-mason plan + tenant-engine-audit-core-sender-projection, rows 2-3): + openbao/policies/workload-kv-read-tenant-engine-audit-core-sender-eso.hcl and + the attended apply script scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh + (policy + role tenant-engine-audit-core-sender-eso; SA tenant-engine/tenant-engine-eso, + audience openbao, 15m ttl/max/explicit max, no default policy). Not applied. + Open: attended apply, then the founder-attended KV seed (plan row 7). + No RBAC change needed here (see message). +``` diff --git a/openbao/policies/workload-kv-read-tenant-engine-audit-core-sender-eso.hcl b/openbao/policies/workload-kv-read-tenant-engine-audit-core-sender-eso.hcl new file mode 100644 index 0000000..13bad20 --- /dev/null +++ b/openbao/policies/workload-kv-read-tenant-engine-audit-core-sender-eso.hcl @@ -0,0 +1,16 @@ +# RPF-IN-0002 (tenant-engine TEN-IN-0005): ESO delivery for ClusterSecretStore +# openbao-tenant-engine-audit-core-sender via Kubernetes auth role +# tenant-engine-audit-core-sender-eso (SA tenant-engine/tenant-engine-eso). +# One exact KV data read. + +path "platform/data/workloads/tenant-engine/audit-core-sender" { + capabilities = ["read"] +} + +path "auth/token/lookup-self" { + capabilities = ["read"] +} + +path "auth/token/revoke-self" { + capabilities = ["update"] +} diff --git a/scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh b/scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh new file mode 100755 index 0000000..ba21de3 --- /dev/null +++ b/scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh @@ -0,0 +1,47 @@ +#!/bin/sh +# RPF-IN-0002: write policy + Kubernetes-auth role for tenant-engine's audit-core +# sender ESO lane. Attended, silent, idempotent. Run from a checkout at the +# reviewed commit: +# BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \ +# warden access openbao-platform-admin-login --exec -- \ +# sh scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh +# Prints nothing (warden fails closed on child output). Exit codes: +# 0 ok / already present and identical; 3 existing object differs; +# 4 write failed; 5 verify failed. Does not read or write any KV value. +exec >/dev/null 2>&1 +set -u +P=workload-kv-read-tenant-engine-audit-core-sender-eso +R=tenant-engine-audit-core-sender-eso +F="$(dirname "$0")/../openbao/policies/$P.hcl" + +cur=$(bao policy read "$P" 2>/dev/null) || cur="" +if [ -n "$cur" ]; then + [ "$cur" = "$(cat "$F")" ] || exit 3 +else + bao policy write "$P" "$F" || exit 4 +fi + +if bao read -format=json "auth/kubernetes/role/$R" >/tmp/.te-role.$$ 2>/dev/null; then + python3 - /tmp/.te-role.$$ "$P" <<'PY' || { rm -f /tmp/.te-role.$$; exit 3; } +import json,sys +d=json.load(open(sys.argv[1]))['data'] +ok=(d.get('bound_service_account_names')==['tenant-engine-eso'] + and d.get('bound_service_account_namespaces')==['tenant-engine'] + and d.get('audience')=='openbao' and d.get('token_policies')==[sys.argv[2]] + and d.get('token_ttl')==900 and d.get('token_max_ttl')==900 + and d.get('token_explicit_max_ttl')==900 and d.get('token_no_default_policy') is True) +sys.exit(0 if ok else 1) +PY +else + bao write "auth/kubernetes/role/$R" \ + bound_service_account_names=tenant-engine-eso \ + bound_service_account_namespaces=tenant-engine \ + audience=openbao token_policies="$P" \ + token_ttl=15m token_max_ttl=15m token_explicit_max_ttl=15m \ + token_no_default_policy=true || exit 4 +fi +rm -f /tmp/.te-role.$$ + +[ "$(bao policy read "$P")" = "$(cat "$F")" ] || exit 5 +bao read "auth/kubernetes/role/$R" || exit 5 +exit 0 diff --git a/tests/test_tenant_engine_audit_core_sender_eso.py b/tests/test_tenant_engine_audit_core_sender_eso.py new file mode 100644 index 0000000..0f7074e --- /dev/null +++ b/tests/test_tenant_engine_audit_core_sender_eso.py @@ -0,0 +1,30 @@ +from pathlib import Path +import unittest + +ROOT = Path(__file__).resolve().parents[1] +NAME = 'workload-kv-read-tenant-engine-audit-core-sender-eso' + + +class TenantEngineSenderPolicyTests(unittest.TestCase): + def test_policy_is_one_exact_read_plus_token_self(self): + text = (ROOT / 'openbao/policies' / (NAME + '.hcl')).read_text() + self.assertEqual(text.count('path "'), 3) + for bad in ('*', '/metadata/', '"list"', '"create"', '"delete"', 'senders'): + self.assertNotIn(bad, text) + self.assertIn('path "platform/data/workloads/tenant-engine/audit-core-sender"', text) + self.assertIn('path "auth/token/lookup-self"', text) + self.assertIn('path "auth/token/revoke-self"', text) + + def test_attended_script_is_silent_and_binds_one_identity(self): + s = (ROOT / 'scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh').read_text() + self.assertIn('exec >/dev/null 2>&1', s) + for frag in ('bound_service_account_names=tenant-engine-eso', + 'bound_service_account_namespaces=tenant-engine', + 'audience=openbao', 'token_explicit_max_ttl=15m', + 'token_no_default_policy=true'): + self.assertIn(frag, s) + self.assertNotIn('kv put', s) + + +if __name__ == '__main__': + unittest.main()