diff --git a/credential-change-requests/CCR-2026-0064-nk-bounded-executor-window-watch.yaml b/credential-change-requests/CCR-2026-0064-nk-bounded-executor-window-watch.yaml index 9d14c57..9f643e7 100644 --- a/credential-change-requests/CCR-2026-0064-nk-bounded-executor-window-watch.yaml +++ b/credential-change-requests/CCR-2026-0064-nk-bounded-executor-window-watch.yaml @@ -2,31 +2,53 @@ id: CCR-2026-0064 kind: credential-change-request schema_version: 1 request_type: auth-role-presence-watch -title: 'nk-window-watch: flag the CCR-2026-0058 write role when it outlives its run (read-only)' -status: proposed +title: 'nk-window-watch: flag the CCR-2026-0058 write role when it outlives its run + (read-only)' +status: applied created: '2026-11-06' updated: '2026-11-06' requester: agent: net-kingdom - reason: net-kingdom NK-WP-0058-T06 (contract row O5). On 2026-11-04/05 the window-scoped write role of - CCR-2026-0058 stayed open overnight; T11 confirmed no use. A watcher in sso - (net-kingdom bounded-executor/window_watch.py, rapp-bounded-executor manifests/window-watch.yaml) checks every - 10 minutes whether the role exists while no bounded-executor run Job is active or recent, and flags it. - Drafted by net-kingdom on the founder's instruction (2026-11-06), for platform-owner review. Not approved. + reason: net-kingdom NK-WP-0058-T06 (contract row O5). On 2026-11-04/05 the window-scoped + write role of CCR-2026-0058 stayed open overnight; T11 confirmed no use. A watcher + in sso (net-kingdom bounded-executor/window_watch.py, rapp-bounded-executor manifests/window-watch.yaml) + checks every 10 minutes whether the role exists while no bounded-executor run + Job is active or recent, and flags it. Drafted by net-kingdom on the founder's + instruction (2026-11-06), for platform-owner review. Not approved. review: required: true required_approvers: - platform-owner - net-kingdom-owner - comments: [] + comments: + - at: '2026-11-06T09:15:09+00:00' + reviewer: platform-owner + decision: approved + comment: 'Approved by the founder 2026-11-06: read-only window watch for the CCR-2026-0058 + write role, NK-WP-0058-T06.' + - at: '2026-11-06T09:15:14+00:00' + reviewer: net-kingdom-owner + decision: approved + comment: Approved by the founder 2026-11-06 for NK-WP-0058-T06. + - at: '2026-11-06T09:17:34+00:00' + reviewer: platform-owner + decision: binding_confirmed + comment: 'Binding confirmed: ServiceAccount nk-window-watch in namespace sso only + (uid UID), audience openbao, from rapp-bounded-executor.' + - at: '2026-11-06T09:23:42+00:00' + reviewer: platform-owner + decision: binding_confirmed + comment: 'Binding confirmed (corrects the entry above, which named no uid): ServiceAccount + nk-window-watch in namespace sso only (uid 180a2463-0e44-4d93-b360-2a494d02f0f0), + audience openbao, from rapp-bounded-executor.' target: domain: infotech tenant: platform workload: net-kingdom-bounded-executor-window-watch rapp: rapp-bounded-executor environment: production - purpose: Let only the ServiceAccount sso/nk-window-watch read whether the role - net-kingdom-bind-executor-svc-authelia-write exists; no other path, no list, no write, no value + purpose: Let only the ServiceAccount sso/nk-window-watch read whether the role net-kingdom-bind-executor-svc-authelia-write + exists; no other path, no list, no write, no value openbao: policy_name: net-kingdom-bounded-executor-window-watch policy_file: openbao/policies/net-kingdom-bounded-executor-window-watch.hcl @@ -50,47 +72,63 @@ openbao: - nk-window-watch service_account_namespaces: - sso - bound_claims_confirmed: false + bound_claims_confirmed: true access_frontdoor: type: platform-owner catalog_id: bounded-executor-window-watch readiness: pending-review resolvable: false lifecycle: - role_window: Standing. The watcher logs in once per run (every 10 minutes), reads one role path and revokes its - token at exit. - close_mode: Mode close would add delete on the same single path, so the watcher removes a stale write role - itself. It only ever reduces privilege, but it is an unattended write on an auth role, so it needs its own - founder and platform-owner decision and an amendment of this CCR. + role_window: Standing. The watcher logs in once per run (every 10 minutes), reads + one role path and revokes its token at exit. + close_mode: Mode close would add delete on the same single path, so the watcher + removes a stale write role itself. It only ever reduces privilege, but it is an + unattended write on an auth role, so it needs its own founder and platform-owner + decision and an amendment of this CCR. deactivate: Delete the role, then the policy; remove the CronJob (rapp-bounded-executor). rotate: Nothing to rotate; the login uses the projected ServiceAccount token. - compromised: Delete the role. The reachable information is whether one role exists and its parameters. + compromised: Delete the role. The reachable information is whether one role exists + and its parameters. delivery: surface: native-workload-login namespace: sso service_account: nk-window-watch - reader: The window watch CronJob (net-kingdom bounded-executor/window_watch.py in the pinned executor image, - deployed by rapp-bounded-executor make deploy-window-watch); it prints one value-free line per run + reader: The window watch CronJob (net-kingdom bounded-executor/window_watch.py in + the pinned executor image, deployed by rapp-bounded-executor make deploy-window-watch); + it prints one value-free line per run risk: classification: low notes: - - Reachable data is the parameters of one Kubernetes-auth role (bound ServiceAccount, policies, TTLs), no - secret value and no token. - - The role is separate from the CCR-2026-0058/0059/0061 roles; policies are never combined in one role. - - Node root, cluster admins able to mint tokens for sso/nk-window-watch and platform-admin remain inside this - boundary. + - Reachable data is the parameters of one Kubernetes-auth role (bound ServiceAccount, + policies, TTLs), no secret value and no token. + - The role is separate from the CCR-2026-0058/0059/0061 roles; policies are never + combined in one role. + - Node root, cluster admins able to mint tokens for sso/nk-window-watch and platform-admin + remain inside this boundary. verification: positive: - Exact policy and role read back (credential-change.py applier-apply readback) - - The watch CronJob's next run reports ok (no write role outside a run), visible as a succeeded Job to - sso/nk-agent-status + - The watch CronJob's next run reports ok (no write role outside a run), visible + as a succeeded Job to sso/nk-agent-status negative: - Reading any other auth role, KV path or sys path is refused - Writing or deleting the watched role is refused in mode flag - Wrong ServiceAccount, wrong namespace and wrong audience logins are denied activation_conditions: - Explicit platform-owner and net-kingdom-owner approval of this exact request. - - ServiceAccount sso/nk-window-watch exists (rapp-bounded-executor make deploy-window-watch), then - bound_claims_confirmed set to true by the platform-owner with its uid. - - Attended platform-admin (aal2) session or the delegated applier applies policy and role from a reviewed - commit; results recorded value-free. + - ServiceAccount sso/nk-window-watch exists (rapp-bounded-executor make deploy-window-watch), + then bound_claims_confirmed set to true by the platform-owner with its uid. + - Attended platform-admin (aal2) session or the delegated applier applies policy + and role from a reviewed commit; results recorded value-free. + evidence: + - at: '2026-11-06T09:24:26+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy write: sys/policies/acl/net-kingdom-bounded-executor-window-watch (flag + on auth/kubernetes/role/net-kingdom-bind-executor-svc-authelia-write)' + - 'Kubernetes auth role write: auth/kubernetes/role/net-kingdom-bounded-executor-window-watch' + - Readback matched source for policy and role. + - No secret values were read, written, printed, or accepted in argv.