CCR-2026-0060/0061/0063: founder approvals and binding confirmations (NK-WP-0056-T06)
This commit is contained in:
codex
parent
09cf1900f5
commit
8c57aa9acc
3 changed files with 154 additions and 104 deletions
|
|
@ -3,28 +3,38 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: 'nk-bind-executor-approval: keycape-reader-policy and eso-role (oidc-service-client@0.2)'
|
||||
status: proposed
|
||||
status: approved
|
||||
created: '2026-10-31'
|
||||
updated: '2026-11-04'
|
||||
requester:
|
||||
agent: railiance-platform
|
||||
reason: 'NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom
|
||||
reason: NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom
|
||||
9ce0d60, acknowledged 2026-11-01; hub decision f8044f81; memo nk-wp-0056-t14-oidc-service-client-r2).
|
||||
Drafted by the platform owner in its review (docs/credential-lane-designs/oidc-service-client-review.md,
|
||||
R6). KeyCape reads the client secret of nk-bind-executor-approval only through ESO, as
|
||||
CCR-2026-0041 for the browser type. Not approved.'
|
||||
R6). KeyCape reads the client secret of nk-bind-executor-approval only through
|
||||
ESO, as CCR-2026-0041 for the browser type. Not approved.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-owner
|
||||
comments: []
|
||||
comments:
|
||||
- at: '2026-11-04T06:21:20+00:00'
|
||||
reviewer: platform-owner
|
||||
decision: approved
|
||||
comment: 'Approved by the founder 2026-11-04: KeyCape ESO reader for SecurityCase
|
||||
nk-bind-executor-approval (oidc-service-client 0.2), NK-WP-0056-T06.'
|
||||
- at: '2026-11-04T06:21:25+00:00'
|
||||
reviewer: platform-owner
|
||||
decision: binding_confirmed
|
||||
comment: 'Binding confirmed: external-secrets/external-secrets, audience openbao,
|
||||
as CCR-2026-0033/0041.'
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: keycape
|
||||
environment: production
|
||||
purpose: KeyCape reads the nk-bind-executor-approval client secret only through ESO. No metadata,
|
||||
list, parent or sibling access.
|
||||
purpose: KeyCape reads the nk-bind-executor-approval client secret only through
|
||||
ESO. No metadata, list, parent or sibling access.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/keycape/nk-bind-executor-approval
|
||||
|
|
@ -50,15 +60,15 @@ openbao:
|
|||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: false
|
||||
bound_claims_confirmed: true
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
namespace: sso
|
||||
target: 'ClusterSecretStore openbao-keycape-nk-bind-executor-approval-issuer (rendered
|
||||
target: ClusterSecretStore openbao-keycape-nk-bind-executor-approval-issuer (rendered
|
||||
from manifests/templates/keycape-issuer-eso.yaml; serviceAccountRef external-secrets/external-secrets,
|
||||
audience openbao) restricted to namespace sso; ExternalSecret and Secret sso/keycape-nk-bind-executor-approval-client,
|
||||
key client-secret (type deliver-secret step). KeyCape binds it as env
|
||||
KEYCAPE_NK_BIND_EXECUTOR_APPROVAL_CLIENT_SECRET (net-kingdom bind-env, after Ready=True).'
|
||||
key client-secret (type deliver-secret step). KeyCape binds it as env KEYCAPE_NK_BIND_EXECUTOR_APPROVAL_CLIENT_SECRET
|
||||
(net-kingdom bind-env, after Ready=True).
|
||||
manifest: manifests/nk-bind-executor-eso.yaml
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
|
|
@ -68,44 +78,50 @@ access_frontdoor:
|
|||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Rendered from the acknowledged SecurityCaseType oidc-service-client 0.2 (names and bodies
|
||||
checked against its materialization 2026-11-01); the case is not yet accepted.
|
||||
- Rendered from the acknowledged SecurityCaseType oidc-service-client 0.2 (names
|
||||
and bodies checked against its materialization 2026-11-01); the case is not yet
|
||||
accepted.
|
||||
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
||||
- The value lets its holder obtain approval-engine tokens as service:nk-bind-executor
|
||||
(approval:create/read/consume, tenant:platform).
|
||||
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers are
|
||||
within this boundary (as CCR-2026-0033/0041).
|
||||
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers
|
||||
are within this boundary (as CCR-2026-0033/0041).
|
||||
verification:
|
||||
positive:
|
||||
- policy workload-kv-read-keycape-nk-bind-executor-approval-eso grants read on
|
||||
platform/data/workloads/keycape/nk-bind-executor-approval only (capabilities check)
|
||||
- ExternalSecret sso/keycape-nk-bind-executor-approval-client reports Ready=True (status
|
||||
only)
|
||||
- policy workload-kv-read-keycape-nk-bind-executor-approval-eso grants read on platform/data/workloads/keycape/nk-bind-executor-approval
|
||||
only (capabilities check)
|
||||
- ExternalSecret sso/keycape-nk-bind-executor-approval-client reports Ready=True
|
||||
(status only)
|
||||
negative:
|
||||
- a default-only identity has no read capability on the path
|
||||
- sibling GET, parent LIST and metadata read are denied
|
||||
- wrong ServiceAccount and wrong audience logins are denied
|
||||
activation_conditions:
|
||||
- oidc-service-client 0.2 acknowledged by the founder (done 2026-11-01, memo r2, hub decision
|
||||
f8044f81).
|
||||
- oidc-service-client 0.2 acknowledged by the founder (done 2026-11-01, memo r2,
|
||||
hub decision f8044f81).
|
||||
- SecurityCase nk-bind-executor-approval accepted by owner and founder.
|
||||
- Custody entry minted at version 1 by keycape-client-secret-generate, by the broker, which admits
|
||||
oidc-service-client@0.2 since RPF-WP-0069-T08. The broker needs the case file at status
|
||||
materialized with acceptance {at, record, by [owner, founder]}.
|
||||
- Coding-agent deny on the data and metadata paths (scripts/nk_bind_executor_custody.py fence)
|
||||
before the role exists.
|
||||
- platform-owner approval of this exact request and bound_claims_confirmed set to true.
|
||||
- Custody entry minted at version 1 by keycape-client-secret-generate, by the broker,
|
||||
which admits oidc-service-client@0.2 since RPF-WP-0069-T08. The broker needs the
|
||||
case file at status materialized with acceptance {at, record, by [owner, founder]}.
|
||||
- Coding-agent deny on the data and metadata paths (scripts/nk_bind_executor_custody.py
|
||||
fence) before the role exists.
|
||||
- platform-owner approval of this exact request and bound_claims_confirmed set to
|
||||
true.
|
||||
lifecycle:
|
||||
deactivate: delete ExternalSecret sso/keycape-nk-bind-executor-approval-client, then role
|
||||
external-secrets-keycape-nk-bind-executor-approval, then the policy (case rollback)
|
||||
rotate: no rotation lane exists yet (RPF-WP-0055 residual); until then a rotation is an
|
||||
attended platform-admin write with CAS=current, an ESO refresh and a KeyCape restart
|
||||
compromised: owner incident process; delete the role first; no automatic read, reseed or
|
||||
cleanup
|
||||
deactivate: delete ExternalSecret sso/keycape-nk-bind-executor-approval-client,
|
||||
then role external-secrets-keycape-nk-bind-executor-approval, then the policy
|
||||
(case rollback)
|
||||
rotate: no rotation lane exists yet (RPF-WP-0055 residual); until then a rotation
|
||||
is an attended platform-admin write with CAS=current, an ESO refresh and a KeyCape
|
||||
restart
|
||||
compromised: owner incident process; delete the role first; no automatic read, reseed
|
||||
or cleanup
|
||||
security_case:
|
||||
case: nk-bind-executor-approval
|
||||
type: oidc-service-client@0.2
|
||||
type_status: acknowledged
|
||||
type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, sha256:cd238693...)
|
||||
type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 on 2026-11-01 (hub decision f8044f81)
|
||||
type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60,
|
||||
sha256:cd238693...)
|
||||
type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2
|
||||
on 2026-11-01 (hub decision f8044f81)
|
||||
acceptance_record: pending
|
||||
|
|
|
|||
|
|
@ -3,36 +3,52 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: 'nk-bind-executor-approval: consumer reader for sso/nk-bind-executor (oidc-service-client@0.2)'
|
||||
status: proposed
|
||||
status: approved
|
||||
created: '2026-10-31'
|
||||
updated: '2026-11-04'
|
||||
requester:
|
||||
agent: railiance-platform
|
||||
reason: 'NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom
|
||||
9ce0d60, acknowledged 2026-11-01; hub decision f8044f81). The bounded executor service:nk-bind-executor
|
||||
reads its approval-engine client secret natively per call to file, read and consume its
|
||||
own approvals. Drafted by the platform owner in its review
|
||||
(docs/credential-lane-designs/oidc-service-client-review.md, R2-R6). Not approved.'
|
||||
reason: NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom
|
||||
9ce0d60, acknowledged 2026-11-01; hub decision f8044f81). The bounded executor
|
||||
service:nk-bind-executor reads its approval-engine client secret natively per
|
||||
call to file, read and consume its own approvals. Drafted by the platform owner
|
||||
in its review (docs/credential-lane-designs/oidc-service-client-review.md, R2-R6).
|
||||
Not approved.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-owner
|
||||
- net-kingdom-owner
|
||||
comments: []
|
||||
comments:
|
||||
- at: '2026-11-04T06:21:31+00:00'
|
||||
reviewer: platform-owner
|
||||
decision: approved
|
||||
comment: 'Approved by the founder 2026-11-04: executor reader of the nk-bind-executor-approval
|
||||
client secret, NK-WP-0056-T06.'
|
||||
- at: '2026-11-04T06:21:40+00:00'
|
||||
reviewer: net-kingdom-owner
|
||||
decision: approved
|
||||
comment: Approved by the founder 2026-11-04 for NK-WP-0056-T06.
|
||||
- at: '2026-11-04T06:21:47+00:00'
|
||||
reviewer: platform-owner
|
||||
decision: binding_confirmed
|
||||
comment: 'Binding confirmed: ServiceAccount nk-bind-executor in namespace sso
|
||||
only (uid bd15569c-8a85-4625-b001-d9f799cb857b), audience openbao, from rapp-bounded-executor.'
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: net-kingdom-bind-executor
|
||||
rapp: rapp-bounded-executor
|
||||
environment: production
|
||||
purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the
|
||||
nk-bind-executor-approval CLIENT_SECRET in memory for its client_credentials exchange;
|
||||
no write, metadata, list, sibling path, Secret copy or other identity
|
||||
purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the nk-bind-executor-approval
|
||||
CLIENT_SECRET in memory for its client_credentials exchange; no write, metadata,
|
||||
list, sibling path, Secret copy or other identity
|
||||
admission:
|
||||
standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
|
||||
executor_identity: service:nk-bind-executor
|
||||
note: The role does not evaluate the admission. It bounds what the ServiceAccount can read
|
||||
to one client secret whose tokens carry approval:create/read/consume at approval-engine.
|
||||
note: The role does not evaluate the admission. It bounds what the ServiceAccount
|
||||
can read to one client secret whose tokens carry approval:create/read/consume
|
||||
at approval-engine.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/keycape/nk-bind-executor-approval
|
||||
|
|
@ -45,8 +61,6 @@ openbao:
|
|||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
# Type 0.2 template keycape-{client_id}-{consuming_service}-workload-kv-read (review R4):
|
||||
# the delegated applier admits it.
|
||||
role: keycape-nk-bind-executor-approval-bounded-executor-workload-kv-read
|
||||
audience: openbao
|
||||
ttl: 15m
|
||||
|
|
@ -60,7 +74,7 @@ openbao:
|
|||
- nk-bind-executor
|
||||
service_account_namespaces:
|
||||
- sso
|
||||
bound_claims_confirmed: false
|
||||
bound_claims_confirmed: true
|
||||
access_frontdoor:
|
||||
type: platform-owner
|
||||
catalog_id: bounded-executor-keycape-nk-bind-executor-approval
|
||||
|
|
@ -69,61 +83,67 @@ access_frontdoor:
|
|||
agent_fence:
|
||||
data_and_metadata_denied: true
|
||||
note: Coding agents are denied data and metadata of platform/workloads/keycape/nk-bind-executor-approval;
|
||||
scripts/nk_bind_executor_custody.py fence adds and proves the deny before the role is created.
|
||||
scripts/nk_bind_executor_custody.py fence adds and proves the deny before the
|
||||
role is created.
|
||||
lifecycle:
|
||||
role_window: Standing, as CCR-2026-0059. The executor exchanges a fresh token per call and
|
||||
keeps neither the secret nor a token beyond the call.
|
||||
deactivate: Delete the role, then the policy. The custody entry and the ESO reader stay
|
||||
under CCR-2026-0060 until the case rollback.
|
||||
rotate: No rotation lane exists yet (RPF-WP-0055 residual). The reader needs no change on
|
||||
rotation because the path stays the same.
|
||||
compromised: Remove client nk-bind-executor-approval from KeyCape (register-client rollback,
|
||||
attended), delete this role, then rotate attended. Approvals already created by the
|
||||
client still need a human entry under human_control.
|
||||
role_window: Standing, as CCR-2026-0059. The executor exchanges a fresh token per
|
||||
call and keeps neither the secret nor a token beyond the call.
|
||||
deactivate: Delete the role, then the policy. The custody entry and the ESO reader
|
||||
stay under CCR-2026-0060 until the case rollback.
|
||||
rotate: No rotation lane exists yet (RPF-WP-0055 residual). The reader needs no
|
||||
change on rotation because the path stays the same.
|
||||
compromised: Remove client nk-bind-executor-approval from KeyCape (register-client
|
||||
rollback, attended), delete this role, then rotate attended. Approvals already
|
||||
created by the client still need a human entry under human_control.
|
||||
delivery:
|
||||
surface: native-workload-login
|
||||
namespace: sso
|
||||
service_account: nk-bind-executor
|
||||
reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
|
||||
logs in with its projected ServiceAccount token, audience openbao, separately from the
|
||||
CCR-2026-0058 and CCR-2026-0059 roles; the value stays in memory and never reaches a
|
||||
Secret, log or receipt
|
||||
logs in with its projected ServiceAccount token, audience openbao, separately
|
||||
from the CCR-2026-0058 and CCR-2026-0059 roles; the value stays in memory and
|
||||
never reaches a Secret, log or receipt
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Reachable value is one confidential client secret; its tokens act as service:nk-bind-executor
|
||||
at approval-engine (create approvals naming itself, read and consume approvals of
|
||||
tenant:platform). Approvals still need a human entry under human_control.
|
||||
- The role is separate from the CCR-2026-0058 write role, the CCR-2026-0059 journey reader
|
||||
and the CCR-2026-0060 ESO reader; policies are never combined in one role.
|
||||
- No Secret copy in namespace sso beyond KeyCape's own ESO target; other workloads in sso
|
||||
without the ServiceAccount cannot log in.
|
||||
at approval-engine (create approvals naming itself, read and consume approvals
|
||||
of tenant:platform). Approvals still need a human entry under human_control.
|
||||
- The role is separate from the CCR-2026-0058 write role, the CCR-2026-0059 journey
|
||||
reader and the CCR-2026-0060 ESO reader; policies are never combined in one role.
|
||||
- No Secret copy in namespace sso beyond KeyCape's own ESO target; other workloads
|
||||
in sso without the ServiceAccount cannot log in.
|
||||
- Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
|
||||
remain inside this credential boundary.
|
||||
verification:
|
||||
positive:
|
||||
- Exact policy and role read back; login as sso/nk-bind-executor (audience openbao) gets
|
||||
only this policy with a lease of at most 15m
|
||||
- Exact policy and role read back; login as sso/nk-bind-executor (audience openbao)
|
||||
gets only this policy with a lease of at most 15m
|
||||
- The executor reports the claims of one client_credentials exchange per scope (sub
|
||||
service:nk-bind-executor, aud approval-engine, tenant:platform, lifetime <= 15m), value-free
|
||||
service:nk-bind-executor, aud approval-engine, tenant:platform, lifetime <= 15m),
|
||||
value-free
|
||||
negative:
|
||||
- Write, metadata read, list, delete and sibling paths (including keycape/secrets-engine-openbao
|
||||
and directory-binds) are refused
|
||||
- Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
|
||||
- Coding-agent boundary denies data and metadata of the path
|
||||
activation_conditions:
|
||||
- oidc-service-client 0.2 acknowledged (done 2026-11-01) and case nk-bind-executor-approval accepted.
|
||||
- Custody entry minted (CCR-2026-0040 lane; broker admits
|
||||
oidc-service-client@0.2 since RPF-WP-0069-T08).
|
||||
- oidc-service-client 0.2 acknowledged (done 2026-11-01) and case nk-bind-executor-approval
|
||||
accepted.
|
||||
- Custody entry minted (CCR-2026-0040 lane; broker admits oidc-service-client@0.2
|
||||
since RPF-WP-0069-T08).
|
||||
- Explicit platform-owner and net-kingdom-owner approval of this exact request.
|
||||
- bound_claims_confirmed set to true by the platform-owner (ServiceAccount sso/nk-bind-executor
|
||||
already exists, uid bd15569c, CCR-2026-0058/0059).
|
||||
- Attended platform-admin (aal2) session or the delegated applier applies policy and role
|
||||
from a reviewed commit; positive and negative results recorded in value-free receipts.
|
||||
- Attended platform-admin (aal2) session or the delegated applier applies policy
|
||||
and role from a reviewed commit; positive and negative results recorded in value-free
|
||||
receipts.
|
||||
security_case:
|
||||
case: nk-bind-executor-approval
|
||||
type: oidc-service-client@0.2
|
||||
type_status: acknowledged
|
||||
type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, sha256:cd238693...)
|
||||
type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 on 2026-11-01 (hub decision f8044f81)
|
||||
type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60,
|
||||
sha256:cd238693...)
|
||||
type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2
|
||||
on 2026-11-01 (hub decision f8044f81)
|
||||
acceptance_record: pending
|
||||
|
|
|
|||
|
|
@ -3,16 +3,16 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: NetKingdom bounded-executor audit sender custody and delivery
|
||||
status: proposed
|
||||
status: approved
|
||||
created: '2026-11-03'
|
||||
updated: '2026-11-04'
|
||||
requester:
|
||||
agent: claude-code
|
||||
reason: RPF-WP-0069-T05 / NK-WP-0056-T15 / NK-WP-0040. Audit-core admitted and named
|
||||
the sender nk-bounded-executor (AUDIT-WP-0018-T02, deploy/senders-scope.json) and
|
||||
asks railiance-platform for custody of its bearer, ESO-projected to sso
|
||||
(audit-core docs/bounded-executor-receipts.md). Drafted by the railiance-platform
|
||||
worker in the CCR-2026-0021/0022 shape; not approved.
|
||||
the sender nk-bounded-executor (AUDIT-WP-0018-T02, deploy/senders-scope.json)
|
||||
and asks railiance-platform for custody of its bearer, ESO-projected to sso (audit-core
|
||||
docs/bounded-executor-receipts.md). Drafted by the railiance-platform worker in
|
||||
the CCR-2026-0021/0022 shape; not approved.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
|
|
@ -23,21 +23,36 @@ review:
|
|||
- at: '2026-11-04T00:00:00+00:00'
|
||||
reviewer: net-kingdom (agent answer relayed by the railiance-platform worker)
|
||||
decision: open_question_answered
|
||||
comment: NetKingdom answers the open question for NK-WP-0056-T15 as ESO, like the
|
||||
other in-cluster senders, not an OpenBao read role for the executor. The executor's
|
||||
audit client reads a token file. This is the net-kingdom repository's answer only;
|
||||
the net-kingdom-owner approval is the founder's and is recorded separately with
|
||||
the approve tool.
|
||||
comment: NetKingdom answers the open question for NK-WP-0056-T15 as ESO, like
|
||||
the other in-cluster senders, not an OpenBao read role for the executor. The
|
||||
executor's audit client reads a token file. This is the net-kingdom repository's
|
||||
answer only; the net-kingdom-owner approval is the founder's and is recorded
|
||||
separately with the approve tool.
|
||||
- at: '2026-11-04T06:21:53+00:00'
|
||||
reviewer: platform-owner
|
||||
decision: approved
|
||||
comment: 'Approved by the founder 2026-11-04: bounded-executor audit sender custody,
|
||||
ESO to sso/bounded-executor-tokens, NK-WP-0056-T15/T06.'
|
||||
- at: '2026-11-04T06:22:00+00:00'
|
||||
reviewer: audit-core-owner
|
||||
decision: approved
|
||||
comment: 'Approved by the founder 2026-11-04: sender nk-bounded-executor as registered
|
||||
in AUDIT-WP-0018-T02.'
|
||||
- at: '2026-11-04T06:22:07+00:00'
|
||||
reviewer: platform-owner
|
||||
decision: binding_confirmed
|
||||
comment: 'Binding confirmed: external-secrets/external-secrets, audience openbao;
|
||||
store restricted to namespace sso.'
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: net-kingdom-bounded-executor
|
||||
environment: production
|
||||
purpose: 'Provide only the audit-core sender nk-bounded-executor with its registry
|
||||
scope as declared by audit-core: source net-kingdom.bounded-executor, tenants [platform],
|
||||
may_write true, may_read false, evidence_kind load-bearing, secret_policy reject,
|
||||
closing class execution.run.started -> execution.attribution.receipt within 7200
|
||||
s. Preserve the existing receiver registry and every other sender.'
|
||||
scope as declared by audit-core: source net-kingdom.bounded-executor, tenants
|
||||
[platform], may_write true, may_read false, evidence_kind load-bearing, secret_policy
|
||||
reject, closing class execution.run.started -> execution.attribution.receipt within
|
||||
7200 s. Preserve the existing receiver registry and every other sender.'
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/net-kingdom/bounded-executor/audit-sender
|
||||
|
|
@ -47,8 +62,6 @@ openbao:
|
|||
policy_name: workload-kv-read-nk-bind-executor-audit
|
||||
policy_file: openbao/policies/workload-kv-read-nk-bind-executor-audit.hcl
|
||||
metadata_read: false
|
||||
# Same reader shape as CCR-2026-0033/0041/0060 (audience openbao, explicit max TTL,
|
||||
# no default policy, token self-lifecycle), not the older CCR-2026-0021/0022 shape.
|
||||
token_self_lifecycle: true
|
||||
auth:
|
||||
method: kubernetes
|
||||
|
|
@ -66,7 +79,7 @@ openbao:
|
|||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: false
|
||||
bound_claims_confirmed: true
|
||||
access_frontdoor:
|
||||
type: external-secrets
|
||||
catalog_id: nk-bind-executor-audit
|
||||
|
|
@ -76,16 +89,17 @@ delivery:
|
|||
surface: external-secrets
|
||||
namespace: sso
|
||||
service_account: nk-bind-executor
|
||||
target: 'ClusterSecretStore openbao-nk-bind-executor-audit (serviceAccountRef
|
||||
external-secrets/external-secrets, audience openbao) restricted to namespace sso;
|
||||
ExternalSecret and Secret sso/bounded-executor-tokens, key audit-core, which the
|
||||
rapp-bounded-executor run Job already mounts at /var/run/secrets/bounded-executor/audit-core
|
||||
(rapp docs/platform-handoffs.md names this delivery as railiance-platform''s). The
|
||||
platform carries the store and ExternalSecret in manifests/nk-bind-executor-eso.yaml,
|
||||
target: ClusterSecretStore openbao-nk-bind-executor-audit (serviceAccountRef external-secrets/external-secrets,
|
||||
audience openbao) restricted to namespace sso; ExternalSecret and Secret sso/bounded-executor-tokens,
|
||||
key audit-core, which the rapp-bounded-executor run Job already mounts at /var/run/secrets/bounded-executor/audit-core
|
||||
(rapp docs/platform-handoffs.md names this delivery as railiance-platform's).
|
||||
The platform carries the store and ExternalSecret in manifests/nk-bind-executor-eso.yaml,
|
||||
as it does for CCR-2026-0021/0022/0047. The executor pod (sso/nk-bind-executor,
|
||||
uid bd15569c) mounts the Secret; the ServiceAccount has no Secret read in sso.'
|
||||
uid bd15569c) mounts the Secret; the ServiceAccount has no Secret read in sso.
|
||||
manifest: manifests/nk-bind-executor-eso.yaml
|
||||
custody_procedure: audit-core scripts/attended-seed-nk-bounded-executor-sender.sh (seed and receiver reload); railiance-platform scripts/nk_bind_executor_custody.py fence and verify
|
||||
custody_procedure: audit-core scripts/attended-seed-nk-bounded-executor-sender.sh
|
||||
(seed and receiver reload); railiance-platform scripts/nk_bind_executor_custody.py
|
||||
fence and verify
|
||||
receiver: POST /v1/events to http://audit-core.audit-core.svc.cluster.local:8080;
|
||||
envelope source equals the sender scope source; Idempotency-Key is the envelope
|
||||
id and correlation_id is the run_id. Ingress audit-core-nk-bounded-executor-ingress
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue