feat: admit and exercise KeyCape verifier custody activation
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
codex
parent
52b24eab9a
commit
b7861de20e
8 changed files with 662 additions and 184 deletions
|
|
@ -3,22 +3,21 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: KeyCape verifier custody for the secrets-engine-approval confidential client
|
||||
status: proposed
|
||||
status: approved
|
||||
created: '2026-09-08'
|
||||
updated: '2026-09-09'
|
||||
updated: '2026-09-08'
|
||||
requester:
|
||||
agent: claude
|
||||
reason: >-
|
||||
KEY-WP-0013-T02 (State Hub message 278a3ebe-b529-49f6-bd1a-e3ebcf318260) asks
|
||||
railiance-platform to admit custody for two confidential client_credentials
|
||||
registrations. This CCR covers the first: client secrets-engine-approval,
|
||||
subject service:secrets-engine, audience approval-engine, tenant:platform per
|
||||
resolved decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6, 15m token lifetime.
|
||||
KeyCape owns the registration and issuance; this request establishes only the
|
||||
custody path and the KeyCape-side delivery of the client secret it must verify
|
||||
presented credentials against. It does not admit the client-side lane by which
|
||||
secrets-engine would read its own copy — that is a separate request with a
|
||||
separate consumer gate.
|
||||
reason: "KEY-WP-0013-T02 (State Hub message 278a3ebe-b529-49f6-bd1a-e3ebcf318260)\
|
||||
\ asks railiance-platform to admit custody for two confidential client_credentials\
|
||||
\ registrations. This CCR covers the first: client secrets-engine-approval, subject\
|
||||
\ service:secrets-engine, audience approval-engine, tenant:platform per resolved\
|
||||
\ decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6, 15m token lifetime. KeyCape owns\
|
||||
\ the registration and issuance; this request establishes only the custody path\
|
||||
\ and the KeyCape-side delivery of the client secret it must verify presented\
|
||||
\ credentials against. It does not admit the client-side lane by which secrets-engine\
|
||||
\ would read its own copy \u2014 that is a separate request with a separate consumer\
|
||||
\ gate."
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
|
|
@ -28,25 +27,36 @@ review:
|
|||
- at: '2026-09-08'
|
||||
reviewer: railiance-platform (codex/claude)
|
||||
decision: paths_confirmed_field_corrected
|
||||
comment: >-
|
||||
KV path platform/workloads/secrets-engine/approval-client is confirmed
|
||||
unchanged: it matches the platform/workloads/<workload>/<lane> convention
|
||||
enforced by scripts/credential-change.py and used by every admitted platform
|
||||
lane. The proposed field name client_secret is corrected to CLIENT_SECRET;
|
||||
KV field names are uppercase by convention (PROVISIONER_TOKEN,
|
||||
CORE_HUB_API_TOKEN) and lowercase names fail FIELD_NAME_RE validation. The
|
||||
Kubernetes Secret key client-secret and the KeyCape environment name are
|
||||
confirmed as proposed.
|
||||
comment: 'KV path platform/workloads/secrets-engine/approval-client is confirmed
|
||||
unchanged: it matches the platform/workloads/<workload>/<lane> convention enforced
|
||||
by scripts/credential-change.py and used by every admitted platform lane. The
|
||||
proposed field name client_secret is corrected to CLIENT_SECRET; KV field names
|
||||
are uppercase by convention (PROVISIONER_TOKEN, CORE_HUB_API_TOKEN) and lowercase
|
||||
names fail FIELD_NAME_RE validation. The Kubernetes Secret key client-secret
|
||||
and the KeyCape environment name are confirmed as proposed.'
|
||||
- at: '2026-09-08T23:05:19+00:00'
|
||||
reviewer: User (platform-operator; explicit session approval)
|
||||
decision: approved
|
||||
comment: User answered "I approve, go on." to the explicit two-CCR approval question
|
||||
naming both required roles. Scope remains verifier-side custody and its attended
|
||||
rollout, as reviewed in docs/credential-lane-designs/keycape-approval-clients-review.md.
|
||||
No client-side read or factory spending grant.
|
||||
- at: '2026-09-08T23:05:19+00:00'
|
||||
reviewer: User (key-cape-owner; explicit session approval)
|
||||
decision: approved
|
||||
comment: User answered "I approve, go on." to the explicit two-CCR approval question
|
||||
naming both required roles. Scope remains verifier-side custody and its attended
|
||||
rollout, as reviewed in docs/credential-lane-designs/keycape-approval-clients-review.md.
|
||||
No client-side read or factory spending grant.
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: secrets-engine
|
||||
environment: production
|
||||
purpose: >-
|
||||
Hold the secrets-engine-approval confidential client secret in platform custody
|
||||
and project it into the KeyCape runtime so KeyCape can verify presented
|
||||
client_credentials without the value living in Git, a chart value, or a
|
||||
hand-created Kubernetes Secret.
|
||||
purpose: Hold the secrets-engine-approval confidential client secret in platform
|
||||
custody and project it into the KeyCape runtime so KeyCape can verify presented
|
||||
client_credentials without the value living in Git, a chart value, or a hand-created
|
||||
Kubernetes Secret.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/secrets-engine/approval-client
|
||||
|
|
@ -76,94 +86,72 @@ access_frontdoor:
|
|||
readiness: pending-review
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: >-
|
||||
ClusterSecretStore openbao-keycape-secrets-engine-approval, limited to
|
||||
target: 'ClusterSecretStore openbao-keycape-secrets-engine-approval, limited to
|
||||
namespace sso, to ExternalSecret sso/keycape-secrets-engine-approval-client and
|
||||
Secret sso/keycape-secrets-engine-approval-client with key client-secret.
|
||||
KeyCape resolves it as KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET through a
|
||||
secretKeyRef, matching the live KEYCAPE_RAPP_QONTO_CLIENT_SECRET shape observed
|
||||
on image main-153258b. Manifests:
|
||||
argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml
|
||||
and keycape-approval-clients.externalsecrets.yaml.
|
||||
Secret sso/keycape-secrets-engine-approval-client with key client-secret. KeyCape
|
||||
resolves it as KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET through a secretKeyRef,
|
||||
matching the live KEYCAPE_RAPP_QONTO_CLIENT_SECRET shape observed on image main-153258b.
|
||||
Manifests: argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml
|
||||
and keycape-approval-clients.externalsecrets.yaml.'
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- >-
|
||||
This is a verifier-side copy. KeyCape holding the client secret lets it
|
||||
authenticate the client; it does not let KeyCape act as the client, but a leak
|
||||
of this value allows anyone to present as secrets-engine for approval:read and
|
||||
approval:consume until the registration is disabled.
|
||||
- >-
|
||||
Custody path is under the client's own workload prefix, not KeyCape's, because
|
||||
the credential belongs to the secrets-engine client identity. The reader
|
||||
admitted here is the External Secrets Operator on behalf of the sso namespace
|
||||
only; a future secrets-engine-side read is a separate lane and separate policy.
|
||||
- >-
|
||||
The existing keycape-rapp-qonto-client Secret is hand-created and not
|
||||
ESO-managed. Do not extend this store or ExternalSecret to adopt it; that is a
|
||||
distinct migration with its own owner.
|
||||
- >-
|
||||
The two approval clients are deliberately kept on separate policies, roles and
|
||||
- This is a verifier-side copy. KeyCape holding the client secret lets it authenticate
|
||||
the client; it does not let KeyCape act as the client, but a leak of this value
|
||||
allows anyone to present as secrets-engine for approval:read and approval:consume
|
||||
until the registration is disabled.
|
||||
- Custody path is under the client's own workload prefix, not KeyCape's, because
|
||||
the credential belongs to the secrets-engine client identity. The reader admitted
|
||||
here is the External Secrets Operator on behalf of the sso namespace only; a future
|
||||
secrets-engine-side read is a separate lane and separate policy.
|
||||
- The existing keycape-rapp-qonto-client Secret is hand-created and not ESO-managed.
|
||||
Do not extend this store or ExternalSecret to adopt it; that is a distinct migration
|
||||
with its own owner.
|
||||
- The two approval clients are deliberately kept on separate policies, roles and
|
||||
stores so the operator client can be revoked without disturbing this one. Their
|
||||
scope sets differ; a shared policy would erase that boundary.
|
||||
- >-
|
||||
Compromise response is KeyCape disabling the client registration plus rotation
|
||||
of this KV version. An OpenBao token expiry does not invalidate an already
|
||||
issued client secret.
|
||||
- Compromise response is KeyCape disabling the client registration plus rotation
|
||||
of this KV version. An OpenBao token expiry does not invalidate an already issued
|
||||
client secret.
|
||||
verification:
|
||||
positive:
|
||||
- >-
|
||||
The ExternalSecret in namespace sso syncs CLIENT_SECRET to Secret key
|
||||
client-secret without printing the value.
|
||||
- >-
|
||||
The KeyCape build that reads KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET
|
||||
starts and issues a token for subject service:secrets-engine with audience
|
||||
approval-engine, tenant:platform, 15m lifetime, verified against live JWKS
|
||||
signature.
|
||||
- The ExternalSecret in namespace sso syncs CLIENT_SECRET to Secret key client-secret
|
||||
without printing the value.
|
||||
- The KeyCape build that reads KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET starts
|
||||
and issues a token for subject service:secrets-engine with audience approval-engine,
|
||||
tenant:platform, 15m lifetime, verified against live JWKS signature.
|
||||
- Exact claim bindings are asserted by KeyCape without any value or token logged.
|
||||
negative:
|
||||
- >-
|
||||
A namespace outside the approved ClusterSecretStore condition cannot use this
|
||||
- A namespace outside the approved ClusterSecretStore condition cannot use this
|
||||
store to read the path.
|
||||
- >-
|
||||
A service account outside external-secrets/external-secrets cannot authenticate
|
||||
- A service account outside external-secrets/external-secrets cannot authenticate
|
||||
through role external-secrets-keycape-secrets-engine-approval.
|
||||
- >-
|
||||
The role cannot read the sibling approval-engine operator-client path, any
|
||||
parent listing, or any other platform workload path.
|
||||
- >-
|
||||
The secrets-engine-approval client is denied scopes outside approval:read and
|
||||
- The role cannot read the sibling approval-engine operator-client path, any parent
|
||||
listing, or any other platform workload path.
|
||||
- The secrets-engine-approval client is denied scopes outside approval:read and
|
||||
approval:consume, and human identities are denied approval:consume.
|
||||
activation_conditions:
|
||||
- >-
|
||||
KeyCape and railiance-platform agree the single attended rollout window in
|
||||
docs/credential-lane-designs/keycape-approval-clients.md; the KeyCape image that
|
||||
reads both environment names is built and pinned but not yet deployed.
|
||||
- >-
|
||||
Attended first provision runs only through the governed
|
||||
openbao-platform-admin-login lane (founder_required, attended OIDC via
|
||||
netkingdom role=platform-admin), with a unique receipt path and no value in
|
||||
chat, command arguments or shell history.
|
||||
- >-
|
||||
Policy, Kubernetes auth role and ClusterSecretStore applied before the
|
||||
ExternalSecret; sync confirmed before the KeyCape image is rolled out.
|
||||
- >-
|
||||
Positive and negative results recorded with non-secret request ids or
|
||||
timestamps.
|
||||
- KeyCape and railiance-platform agree the single attended rollout window in docs/credential-lane-designs/keycape-approval-clients.md;
|
||||
the KeyCape image that reads both environment names is built and pinned but not
|
||||
yet deployed.
|
||||
- Attended first provision runs only through the governed openbao-platform-admin-login
|
||||
lane (founder_required, attended OIDC via netkingdom role=platform-admin), with
|
||||
a unique receipt path and no value in chat, command arguments or shell history.
|
||||
- Policy, Kubernetes auth role and ClusterSecretStore applied before the ExternalSecret;
|
||||
sync confirmed before the KeyCape image is rolled out.
|
||||
- Positive and negative results recorded with non-secret request ids or timestamps.
|
||||
evidence: []
|
||||
lifecycle:
|
||||
deactivate: >-
|
||||
KeyCape disables the secrets-engine-approval registration; platform detaches
|
||||
the policy from role external-secrets-keycape-secrets-engine-approval and
|
||||
removes the ExternalSecret. The KV version is retained until KeyCape confirms
|
||||
deactivate: KeyCape disables the secrets-engine-approval registration; platform
|
||||
detaches the policy from role external-secrets-keycape-secrets-engine-approval
|
||||
and removes the ExternalSecret. The KV version is retained until KeyCape confirms
|
||||
disablement.
|
||||
rotate: >-
|
||||
KeyCape mints a replacement client secret; platform writes the new KV version
|
||||
rotate: KeyCape mints a replacement client secret; platform writes the new KV version
|
||||
under the same attended authority; ESO refresh delivers it and KeyCape restarts
|
||||
or re-reads. Rotation is independent of the operator client.
|
||||
compromised: >-
|
||||
Disable the registration at KeyCape first (that is what stops token issuance),
|
||||
then rotate the KV version and confirm no other namespace consumed the store.
|
||||
compromised: Disable the registration at KeyCape first (that is what stops token
|
||||
issuance), then rotate the KV version and confirm no other namespace consumed
|
||||
the store.
|
||||
state_hub:
|
||||
decision_id: b533a271-b704-4c5c-98a2-9a5951aadfb6
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/b533a271-b704-4c5c-98a2-9a5951aadfb6
|
||||
|
|
|
|||
|
|
@ -3,19 +3,17 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: KeyCape verifier custody for the approval-engine-operator confidential client
|
||||
status: proposed
|
||||
status: approved
|
||||
created: '2026-09-08'
|
||||
updated: '2026-09-09'
|
||||
updated: '2026-09-08'
|
||||
requester:
|
||||
agent: claude
|
||||
reason: >-
|
||||
Second of the two registrations in KEY-WP-0013-T02 (State Hub message
|
||||
278a3ebe-b529-49f6-bd1a-e3ebcf318260): client approval-engine-operator, subject
|
||||
service:approval-engine-operator, audience approval-engine, tenant:platform per
|
||||
resolved decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6, 15m token lifetime.
|
||||
Scopes are approval:create, read, approve, revoke, supersede, observe and emit,
|
||||
explicitly without approval:consume. KeyCape owns registration and issuance;
|
||||
this request establishes only custody and the KeyCape-side delivery.
|
||||
reason: 'Second of the two registrations in KEY-WP-0013-T02 (State Hub message 278a3ebe-b529-49f6-bd1a-e3ebcf318260):
|
||||
client approval-engine-operator, subject service:approval-engine-operator, audience
|
||||
approval-engine, tenant:platform per resolved decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6,
|
||||
15m token lifetime. Scopes are approval:create, read, approve, revoke, supersede,
|
||||
observe and emit, explicitly without approval:consume. KeyCape owns registration
|
||||
and issuance; this request establishes only custody and the KeyCape-side delivery.'
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
|
|
@ -25,20 +23,31 @@ review:
|
|||
- at: '2026-09-08'
|
||||
reviewer: railiance-platform (codex/claude)
|
||||
decision: paths_confirmed_field_corrected
|
||||
comment: >-
|
||||
KV path platform/workloads/approval-engine/operator-client is confirmed
|
||||
unchanged and conforms to the platform/workloads/<workload>/<lane>
|
||||
convention. Field client_secret is corrected to CLIENT_SECRET for the same
|
||||
uppercase convention and validator constraint as CCR-2026-0017. Kubernetes
|
||||
Secret sso/keycape-approval-engine-operator-client with key client-secret and
|
||||
the KeyCape environment name are confirmed as proposed.
|
||||
comment: KV path platform/workloads/approval-engine/operator-client is confirmed
|
||||
unchanged and conforms to the platform/workloads/<workload>/<lane> convention.
|
||||
Field client_secret is corrected to CLIENT_SECRET for the same uppercase convention
|
||||
and validator constraint as CCR-2026-0017. Kubernetes Secret sso/keycape-approval-engine-operator-client
|
||||
with key client-secret and the KeyCape environment name are confirmed as proposed.
|
||||
- at: '2026-09-08T23:05:20+00:00'
|
||||
reviewer: User (platform-operator; explicit session approval)
|
||||
decision: approved
|
||||
comment: User answered "I approve, go on." to the explicit two-CCR approval question
|
||||
naming both required roles. Scope remains verifier-side custody and its attended
|
||||
rollout, as reviewed in docs/credential-lane-designs/keycape-approval-clients-review.md.
|
||||
No client-side read or factory spending grant.
|
||||
- at: '2026-09-08T23:05:20+00:00'
|
||||
reviewer: User (key-cape-owner; explicit session approval)
|
||||
decision: approved
|
||||
comment: User answered "I approve, go on." to the explicit two-CCR approval question
|
||||
naming both required roles. Scope remains verifier-side custody and its attended
|
||||
rollout, as reviewed in docs/credential-lane-designs/keycape-approval-clients-review.md.
|
||||
No client-side read or factory spending grant.
|
||||
target:
|
||||
domain: financials
|
||||
tenant: platform
|
||||
workload: approval-engine
|
||||
environment: production
|
||||
purpose: >-
|
||||
Hold the approval-engine-operator confidential client secret in platform
|
||||
purpose: Hold the approval-engine-operator confidential client secret in platform
|
||||
custody and project it into the KeyCape runtime so KeyCape can verify presented
|
||||
client_credentials for the operator client.
|
||||
openbao:
|
||||
|
|
@ -70,77 +79,58 @@ access_frontdoor:
|
|||
readiness: pending-review
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: >-
|
||||
ClusterSecretStore openbao-keycape-approval-engine-operator, limited to
|
||||
target: 'ClusterSecretStore openbao-keycape-approval-engine-operator, limited to
|
||||
namespace sso, to ExternalSecret sso/keycape-approval-engine-operator-client and
|
||||
Secret sso/keycape-approval-engine-operator-client with key client-secret.
|
||||
KeyCape resolves it as KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET through a
|
||||
secretKeyRef. Manifests:
|
||||
argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml
|
||||
and keycape-approval-clients.externalsecrets.yaml.
|
||||
Secret sso/keycape-approval-engine-operator-client with key client-secret. KeyCape
|
||||
resolves it as KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET through a secretKeyRef.
|
||||
Manifests: argocd/platform-addons/openbao-secretstore/openbao-keycape-approval-clients.clustersecretstore.yaml
|
||||
and keycape-approval-clients.externalsecrets.yaml.'
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- >-
|
||||
This client carries the widest approval scope set in the pair — create,
|
||||
approve, revoke and supersede. A leak allows forging approval lifecycle actions,
|
||||
which is a stronger outcome than the read/consume client in CCR-2026-0017.
|
||||
- >-
|
||||
The absence of approval:consume is a deliberate separation of duties. Any later
|
||||
- "This client carries the widest approval scope set in the pair \u2014 create,\
|
||||
\ approve, revoke and supersede. A leak allows forging approval lifecycle actions,\
|
||||
\ which is a stronger outcome than the read/consume client in CCR-2026-0017."
|
||||
- The absence of approval:consume is a deliberate separation of duties. Any later
|
||||
request to add consume to this client is a new lane decision, not a scope edit.
|
||||
- >-
|
||||
Kept on its own policy, role and store so it can be revoked independently of the
|
||||
- Kept on its own policy, role and store so it can be revoked independently of the
|
||||
secrets-engine-approval client.
|
||||
- >-
|
||||
Compromise response is KeyCape disabling the registration plus rotation of this
|
||||
- Compromise response is KeyCape disabling the registration plus rotation of this
|
||||
KV version; approval actions already emitted are not retracted by rotation and
|
||||
need approval-engine's own audit review.
|
||||
verification:
|
||||
positive:
|
||||
- >-
|
||||
The ExternalSecret in namespace sso syncs CLIENT_SECRET to Secret key
|
||||
client-secret without printing the value.
|
||||
- >-
|
||||
The KeyCape build issues a token for subject service:approval-engine-operator
|
||||
with audience approval-engine, tenant:platform and 15m lifetime, verified
|
||||
against live JWKS signature.
|
||||
- The ExternalSecret in namespace sso syncs CLIENT_SECRET to Secret key client-secret
|
||||
without printing the value.
|
||||
- The KeyCape build issues a token for subject service:approval-engine-operator
|
||||
with audience approval-engine, tenant:platform and 15m lifetime, verified against
|
||||
live JWKS signature.
|
||||
negative:
|
||||
- >-
|
||||
A namespace outside the approved ClusterSecretStore condition cannot use this
|
||||
- A namespace outside the approved ClusterSecretStore condition cannot use this
|
||||
store to read the path.
|
||||
- >-
|
||||
A service account outside external-secrets/external-secrets cannot authenticate
|
||||
- A service account outside external-secrets/external-secrets cannot authenticate
|
||||
through role external-secrets-keycape-approval-engine-operator.
|
||||
- >-
|
||||
The role cannot read the sibling secrets-engine approval-client path, any parent
|
||||
- The role cannot read the sibling secrets-engine approval-client path, any parent
|
||||
listing, or any other platform workload path.
|
||||
- >-
|
||||
The operator client is denied approval:consume, and denial is observed rather
|
||||
- The operator client is denied approval:consume, and denial is observed rather
|
||||
than assumed.
|
||||
activation_conditions:
|
||||
- >-
|
||||
Same single attended rollout window and prepared-but-undeployed KeyCape image as
|
||||
CCR-2026-0017; see docs/credential-lane-designs/keycape-approval-clients.md.
|
||||
- >-
|
||||
Attended first provision only through openbao-platform-admin-login
|
||||
(founder_required, attended OIDC via netkingdom role=platform-admin) with a
|
||||
unique receipt path.
|
||||
- >-
|
||||
Policy, Kubernetes auth role and ClusterSecretStore applied before the
|
||||
ExternalSecret; sync confirmed before the KeyCape rollout.
|
||||
- Same single attended rollout window and prepared-but-undeployed KeyCape image
|
||||
as CCR-2026-0017; see docs/credential-lane-designs/keycape-approval-clients.md.
|
||||
- Attended first provision only through openbao-platform-admin-login (founder_required,
|
||||
attended OIDC via netkingdom role=platform-admin) with a unique receipt path.
|
||||
- Policy, Kubernetes auth role and ClusterSecretStore applied before the ExternalSecret;
|
||||
sync confirmed before the KeyCape rollout.
|
||||
- Positive and negative results recorded with non-secret request ids or timestamps.
|
||||
evidence: []
|
||||
lifecycle:
|
||||
deactivate: >-
|
||||
KeyCape disables the approval-engine-operator registration; platform detaches the
|
||||
policy from role external-secrets-keycape-approval-engine-operator and removes
|
||||
the ExternalSecret.
|
||||
rotate: >-
|
||||
KeyCape mints a replacement client secret; platform writes the new KV version
|
||||
deactivate: KeyCape disables the approval-engine-operator registration; platform
|
||||
detaches the policy from role external-secrets-keycape-approval-engine-operator
|
||||
and removes the ExternalSecret.
|
||||
rotate: KeyCape mints a replacement client secret; platform writes the new KV version
|
||||
under the same attended authority. Rotation is independent of CCR-2026-0017.
|
||||
compromised: >-
|
||||
Disable the registration at KeyCape, rotate the KV version, and refer emitted
|
||||
approval actions to approval-engine for audit review.
|
||||
compromised: Disable the registration at KeyCape, rotate the KV version, and refer
|
||||
emitted approval actions to approval-engine for audit review.
|
||||
state_hub:
|
||||
decision_id: efa90517-0cae-4eb6-a68d-5b0489c84d65
|
||||
decision_api_url: http://127.0.0.1:8000/decisions/efa90517-0cae-4eb6-a68d-5b0489c84d65
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue