Record the delegated metadata apply of CCR-2026-0033/0034
Founder-run applier, 2026-10-07T00:03Z, result passed. No secret value read or written. The applier also reflowed the YAML. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
codex
parent
d8e912e526
commit
f437396337
2 changed files with 136 additions and 90 deletions
|
|
@ -3,15 +3,15 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: KeyCape secrets-engine-openbao issuer workload reader and authoritative custody
|
||||
status: approved
|
||||
status: applied
|
||||
created: '2026-10-04'
|
||||
updated: '2026-10-06'
|
||||
updated: '2026-10-07'
|
||||
requester:
|
||||
agent: key-cape
|
||||
reason: 'KEY-WP-0037-T02 owner packet; issuer-side read of the authoritative secrets-engine-openbao
|
||||
client secret. Revised 2026-10-06 per founder direction (the secret lives only in OpenBao)
|
||||
and ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc, MASON-WP-0009):
|
||||
consumer file and secrets-engine D1-D4 removed.'
|
||||
client secret. Revised 2026-10-06 per founder direction (the secret lives only
|
||||
in OpenBao) and ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc,
|
||||
MASON-WP-0009): consumer file and secrets-engine D1-D4 removed.'
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
|
|
@ -22,22 +22,37 @@ review:
|
|||
- at: '2026-10-07'
|
||||
reviewer: platform-owner (founder Bernd Worsch)
|
||||
decision: approved
|
||||
comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as platform-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.'
|
||||
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
||||
approves CCR-2026-0033 as platform-owner. Covers A1 (ops-mason design 658cdbc),
|
||||
A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed)
|
||||
and A3 (exactly one attended custody-child provision run, cas=0, KV version
|
||||
1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the
|
||||
KeyCape registration, the restart or any rotation.
|
||||
- at: '2026-10-07'
|
||||
reviewer: key-cape-owner (founder Bernd Worsch)
|
||||
decision: approved
|
||||
comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as key-cape-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.'
|
||||
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
||||
approves CCR-2026-0033 as key-cape-owner. Covers A1 (ops-mason design 658cdbc),
|
||||
A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed)
|
||||
and A3 (exactly one attended custody-child provision run, cas=0, KV version
|
||||
1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the
|
||||
KeyCape registration, the restart or any rotation.
|
||||
- at: '2026-10-07'
|
||||
reviewer: net-kingdom-owner (founder Bernd Worsch)
|
||||
decision: approved
|
||||
comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as net-kingdom-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.'
|
||||
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
||||
approves CCR-2026-0033 as net-kingdom-owner. Covers A1 (ops-mason design 658cdbc),
|
||||
A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed)
|
||||
and A3 (exactly one attended custody-child provision run, cas=0, KV version
|
||||
1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the
|
||||
KeyCape registration, the restart or any rotation.
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
workload: keycape
|
||||
environment: production
|
||||
purpose: Hold the secrets-engine-openbao client secret authoritatively in platform KV and
|
||||
deliver it to the KeyCape issuer through sso-only ESO
|
||||
purpose: Hold the secrets-engine-openbao client secret authoritatively in platform
|
||||
KV and deliver it to the KeyCape issuer through sso-only ESO
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/keycape/secrets-engine-openbao
|
||||
|
|
@ -85,27 +100,38 @@ risk:
|
|||
classification: high
|
||||
notes:
|
||||
- Reads the whole path holding the secrets-engine-openbao confidential value
|
||||
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers are within
|
||||
this boundary
|
||||
- 'One value, two copies: KV (authoritative) and the sso Secret (issuer delivery). The consumer
|
||||
holds no copy at rest; it reads in memory through CCR-2026-0034.'
|
||||
- 'Must stay on kubernetes auth: a KeyCape-issued identity would make KeyCape startup depend
|
||||
on KeyCape.'
|
||||
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers
|
||||
are within this boundary
|
||||
- 'One value, two copies: KV (authoritative) and the sso Secret (issuer delivery).
|
||||
The consumer holds no copy at rest; it reads in memory through CCR-2026-0034.'
|
||||
- 'Must stay on kubernetes auth: a KeyCape-issued identity would make KeyCape startup
|
||||
depend on KeyCape.'
|
||||
verification:
|
||||
positive:
|
||||
- Owner-reviewed native exact identity and exact path proof required
|
||||
negative:
|
||||
- Owner-reviewed wrong identity, sibling GET and parent LIST denials required
|
||||
- Metadata shows cas_required=true, max_versions=2 and the declared custom_metadata (value-free).
|
||||
- Metadata shows cas_required=true, max_versions=2 and the declared custom_metadata
|
||||
(value-free).
|
||||
activation_conditions:
|
||||
- Exact CCR approval, confirmed identity, attended custody and native receipt acceptance
|
||||
required
|
||||
evidence:
|
||||
- at: '2026-10-07T00:03:08+00:00'
|
||||
actor: founder
|
||||
kind: delegated_metadata_apply
|
||||
result: passed
|
||||
details:
|
||||
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
||||
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso'
|
||||
- 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao'
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
lifecycle:
|
||||
deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback receipt
|
||||
required
|
||||
rotate: 'Roll-forward only: custody child writes a new version with cas=<current> under
|
||||
a standing rotation approval for this CCR (event-driven + 90d); never a read or restore
|
||||
of an old version'
|
||||
deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback
|
||||
receipt required
|
||||
rotate: 'Roll-forward only: custody child writes a new version with cas=<current>
|
||||
under a standing rotation approval for this CCR (event-driven + 90d); never a
|
||||
read or restore of an old version'
|
||||
compromised: Owner incident process; no automatic read, reseed or cleanup
|
||||
scaffold:
|
||||
draft_only: true
|
||||
|
|
@ -119,64 +145,65 @@ state_hub:
|
|||
related_workplan: KEY-WP-0037
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side delivery
|
||||
only
|
||||
target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side
|
||||
delivery only
|
||||
review_bundle: docs/provisioning-windows/2026-10-04-1000/keycape
|
||||
consumer_delivery: none at rest; attended operator OIDC reader CCR-2026-0034 reads into
|
||||
secrets-engine process memory per command
|
||||
consumer_delivery: none at rest; attended operator OIDC reader CCR-2026-0034 reads
|
||||
into secrets-engine process memory per command
|
||||
boundary_decision:
|
||||
id: 632a8893-0d6a-4591-a50b-40bbdb798f32
|
||||
approves: custody boundary only (platform authoritative KV and least-privilege issuer delivery;
|
||||
secrets-engine-owned mode-0600 consumer file outside every worktree)
|
||||
approves: custody boundary only (platform authoritative KV and least-privilege issuer
|
||||
delivery; secrets-engine-owned mode-0600 consumer file outside every worktree)
|
||||
does_not_approve: generation, KV write, fetch, delivery, registration or deployment
|
||||
note: 'The design narrows this boundary: the secrets-engine consumer file it approved is
|
||||
withdrawn (founder direction 2026-10-06).'
|
||||
path_correction: 'Candidate path platform/services/keycape/secrets-engine-openbao from the
|
||||
KeyCape packet is outside the platform-mount applier scope (WARDEN-WP-0028: platform/workloads/
|
||||
only). Corrected to platform/workloads/keycape/secrets-engine-openbao, same field CLIENT_SECRET.
|
||||
The issuer binds to the sso Secret; the operator reader (CCR-2026-0034) reads the exact
|
||||
data path.'
|
||||
note: 'The design narrows this boundary: the secrets-engine consumer file it approved
|
||||
is withdrawn (founder direction 2026-10-06).'
|
||||
path_correction: 'Candidate path platform/services/keycape/secrets-engine-openbao
|
||||
from the KeyCape packet is outside the platform-mount applier scope (WARDEN-WP-0028:
|
||||
platform/workloads/ only). Corrected to platform/workloads/keycape/secrets-engine-openbao,
|
||||
same field CLIENT_SECRET. The issuer binds to the sso Secret; the operator reader
|
||||
(CCR-2026-0034) reads the exact data path.'
|
||||
custody_child:
|
||||
script: scripts/keycape_secrets_engine_openbao_custody.py
|
||||
tests: tests/test_keycape_secrets_engine_openbao_custody.py
|
||||
status: source-only; never executed
|
||||
requires:
|
||||
- --approval-decision <A3-decision-id>; refused when absent, malformed, equal to the boundary
|
||||
decision, or not recorded in an approved review comment of this CCR
|
||||
- this CCR and sibling CCR-2026-0034 approved with platform-owner, key-cape-owner and net-kingdom-owner
|
||||
approvals and bound_claims_confirmed true
|
||||
- --approval-decision <A3-decision-id>; refused when absent, malformed, equal to
|
||||
the boundary decision, or not recorded in an approved review comment of this CCR
|
||||
- this CCR and sibling CCR-2026-0034 approved with platform-owner, key-cape-owner
|
||||
and net-kingdom-owner approvals and bound_claims_confirmed true
|
||||
- attended warden platform-admin envelope; no BAO_TOKEN/VAULT_TOKEN in environment
|
||||
- umask 077, shell tracing off
|
||||
- --rotate for any run after the first (cas=<observed current version>); without it an existing
|
||||
entry is refused
|
||||
generation: one secrets.token_urlsafe(48) value in process memory (64 chars); never in argv,
|
||||
environment, stdout, stderr, logs, Git or the hub
|
||||
authoritative_write: KV-v2 write with options.cas=0 (absent) or cas=<observed current version>
|
||||
(rotation, --rotate); value only in process memory and the bao stdin/HTTP body; metadata-only
|
||||
preflight
|
||||
- --rotate for any run after the first (cas=<observed current version>); without
|
||||
it an existing entry is refused
|
||||
generation: one secrets.token_urlsafe(48) value in process memory (64 chars); never
|
||||
in argv, environment, stdout, stderr, logs, Git or the hub
|
||||
authoritative_write: KV-v2 write with options.cas=0 (absent) or cas=<observed current
|
||||
version> (rotation, --rotate); value only in process memory and the bao stdin/HTTP
|
||||
body; metadata-only preflight
|
||||
receipt: O_EXCL 0600 JSON with booleans, KV version, request id, CAS, metadata applied/unchanged,
|
||||
CCR/decision ids and CCR digest only
|
||||
failure_cleanup: nothing to clean locally; a written KV version is retained and recorded;
|
||||
recovery is a fresh roll-forward run with --rotate (cas=<current>), never a KV read
|
||||
metadata_write: kv metadata put of openbao.kv_metadata, compared before write against a
|
||||
metadata-only read; skipped when equal
|
||||
failure_cleanup: nothing to clean locally; a written KV version is retained and
|
||||
recorded; recovery is a fresh roll-forward run with --rotate (cas=<current>),
|
||||
never a KV read
|
||||
metadata_write: kv metadata put of openbao.kv_metadata, compared before write against
|
||||
a metadata-only read; skipped when equal
|
||||
rotation_revocation:
|
||||
generation_and_authoritative_version: railiance-platform custody child, version-guarded,
|
||||
roll-forward
|
||||
issuer_pickup: 'key-cape / net-kingdom: ESO refresh then KeyCape restart immediately (exchanges
|
||||
fail closed 401 between KV write and restart)'
|
||||
consumer_pickup: 'automatic: the next secrets-engine command reads the latest version in
|
||||
memory (CCR-2026-0034)'
|
||||
disable_on_compromise: key-cape / net-kingdom remove registration first; platform rotates
|
||||
and detaches the CCR-2026-0034 role policy
|
||||
issuer_pickup: 'key-cape / net-kingdom: ESO refresh then KeyCape restart immediately
|
||||
(exchanges fail closed 401 between KV write and restart)'
|
||||
consumer_pickup: 'automatic: the next secrets-engine command reads the latest version
|
||||
in memory (CCR-2026-0034)'
|
||||
disable_on_compromise: key-cape / net-kingdom remove registration first; platform
|
||||
rotates and detaches the CCR-2026-0034 role policy
|
||||
retire_versions: railiance-platform per separate destroy approval
|
||||
live_order:
|
||||
- 0 founder approvals A1 design, A2 this CCR + CCR-2026-0034 (three reviews, bound claims
|
||||
confirmed for both readers), A3 custody-child decision id
|
||||
- 0 founder approvals A1 design, A2 this CCR + CCR-2026-0034 (three reviews, bound
|
||||
claims confirmed for both readers), A3 custody-child decision id
|
||||
- 1 attended custody child (this repo) writes KV v1 and metadata; non-secret receipt
|
||||
- 2 platform applies policies/roles (this CCR and CCR-2026-0034) and the sso-only ClusterSecretStore
|
||||
+ ExternalSecret; Secret sso/keycape-secrets-engine-openbao-client exists (metadata receipt
|
||||
only)
|
||||
- 2 platform applies policies/roles (this CCR and CCR-2026-0034) and the sso-only
|
||||
ClusterSecretStore + ExternalSecret; Secret sso/keycape-secrets-engine-openbao-client
|
||||
exists (metadata receipt only)
|
||||
- 3 net-kingdom env patch secrets-engine-openbao-client.proposed.patch.yaml (NK-WP-0046)
|
||||
- 4 KeyCape registration merge (KEY-WP-0037-T03)
|
||||
- 5 KeyCape restart immediately after step 4
|
||||
|
|
@ -184,19 +211,19 @@ live_order:
|
|||
- 7 platform OpenBao JWT role/policy secrets-engine-openbao and login proof (RPF-WP-0035-T02)
|
||||
rollback:
|
||||
before_step_3: delete the CCR-2026-0034 OIDC role, then its policy; delete ExternalSecret
|
||||
(uid precondition), then the ESO role/policy; KV entry retained pending separate destroy
|
||||
approval
|
||||
after_step_3: net-kingdom rollout helper restores prior config/Deployment first, then the
|
||||
before_step_3 sequence
|
||||
cleanup_receipts: native, value-free, per step owner; a failed cleanup is recorded as open
|
||||
evidence
|
||||
(uid precondition), then the ESO role/policy; KV entry retained pending separate
|
||||
destroy approval
|
||||
after_step_3: net-kingdom rollout helper restores prior config/Deployment first,
|
||||
then the before_step_3 sequence
|
||||
cleanup_receipts: native, value-free, per step owner; a failed cleanup is recorded
|
||||
as open evidence
|
||||
founder_confirmation_items:
|
||||
- 'bound_claims_confirmed stays false until the founder confirms BOTH readers: this CCR (kubernetes,
|
||||
external-secrets/external-secrets, audience openbao) and sibling CCR-2026-0034 (OIDC, groups=net-kingdom-admins
|
||||
and /assurance/level=aal2).'
|
||||
- 'Approvals: A1 ops-mason design; A2 this CCR plus CCR-2026-0034 with platform-owner, key-cape-owner
|
||||
and net-kingdom-owner reviews; A3 the exact custody-child decision id (must differ from
|
||||
boundary decision 632a8893-0d6a-4591-a50b-40bbdb798f32).'
|
||||
- 'bound_claims_confirmed stays false until the founder confirms BOTH readers: this
|
||||
CCR (kubernetes, external-secrets/external-secrets, audience openbao) and sibling
|
||||
CCR-2026-0034 (OIDC, groups=net-kingdom-admins and /assurance/level=aal2).'
|
||||
- 'Approvals: A1 ops-mason design; A2 this CCR plus CCR-2026-0034 with platform-owner,
|
||||
key-cape-owner and net-kingdom-owner reviews; A3 the exact custody-child decision
|
||||
id (must differ from boundary decision 632a8893-0d6a-4591-a50b-40bbdb798f32).'
|
||||
runbook: docs/provisioning-windows/2026-10-04-1000/keycape/founder-runbook.md
|
||||
related:
|
||||
sibling_ccr: CCR-2026-0034
|
||||
|
|
|
|||
|
|
@ -3,16 +3,16 @@ kind: credential-change-request
|
|||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: KeyCape secrets-engine-openbao attended operator reader (in-memory, per command)
|
||||
status: approved
|
||||
status: applied
|
||||
created: '2026-10-06'
|
||||
updated: '2026-10-06'
|
||||
updated: '2026-10-07'
|
||||
requester:
|
||||
agent: railiance-platform
|
||||
reason: Founder direction 2026-10-06 - the secrets-engine-openbao client secret lives
|
||||
only in OpenBao; ops-mason plan keycape-secrets-engine-openbao-client-custody
|
||||
reason: Founder direction 2026-10-06 - the secrets-engine-openbao client secret
|
||||
lives only in OpenBao; ops-mason plan keycape-secrets-engine-openbao-client-custody
|
||||
(658cdbc, MASON-WP-0009) section 3.3. Sibling of CCR-2026-0033 (issuer ESO reader);
|
||||
one auth role per CCR is this repo's convention (cf. CCR-2026-0019). Replaces the
|
||||
superseded secrets-engine consumer file (SECRETS-WP-0012-T02 D1-D4).
|
||||
one auth role per CCR is this repo's convention (cf. CCR-2026-0019). Replaces
|
||||
the superseded secrets-engine consumer file (SECRETS-WP-0012-T02 D1-D4).
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
|
|
@ -23,24 +23,33 @@ review:
|
|||
- at: '2026-10-06'
|
||||
reviewer: key-cape (owner packet, key-cape 7d96ee4)
|
||||
decision: claim_shape_reported
|
||||
comment: 'KeyCape reports the groups claim is always emitted, so groups_claim groups
|
||||
bound to net-kingdom-admins works as in CCR-2026-0019. MFA is not pinned on the
|
||||
openbao-admin client; it holds only through the provider default requireForAll.
|
||||
KeyCape asks that the role also bind the assurance claim (/assurance/level = aal2,
|
||||
issued only after a verified factor). This is an owner report, not an approval
|
||||
and not the founder confirmation of bound claims.'
|
||||
comment: KeyCape reports the groups claim is always emitted, so groups_claim groups
|
||||
bound to net-kingdom-admins works as in CCR-2026-0019. MFA is not pinned on
|
||||
the openbao-admin client; it holds only through the provider default requireForAll.
|
||||
KeyCape asks that the role also bind the assurance claim (/assurance/level =
|
||||
aal2, issued only after a verified factor). This is an owner report, not an
|
||||
approval and not the founder confirmation of bound claims.
|
||||
- at: '2026-10-07'
|
||||
reviewer: platform-owner (founder Bernd Worsch)
|
||||
decision: approved
|
||||
comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as platform-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.'
|
||||
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
||||
approves CCR-2026-0034 as platform-owner. Covers A2 for this operator OIDC reader
|
||||
(groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the
|
||||
role and policy needs its own go.
|
||||
- at: '2026-10-07'
|
||||
reviewer: key-cape-owner (founder Bernd Worsch)
|
||||
decision: approved
|
||||
comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as key-cape-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.'
|
||||
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
||||
approves CCR-2026-0034 as key-cape-owner. Covers A2 for this operator OIDC reader
|
||||
(groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the
|
||||
role and policy needs its own go.
|
||||
- at: '2026-10-07'
|
||||
reviewer: net-kingdom-owner (founder Bernd Worsch)
|
||||
decision: approved
|
||||
comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as net-kingdom-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.'
|
||||
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
||||
approves CCR-2026-0034 as net-kingdom-owner. Covers A2 for this operator OIDC
|
||||
reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying
|
||||
the role and policy needs its own go.
|
||||
target:
|
||||
domain: infotech
|
||||
tenant: platform
|
||||
|
|
@ -90,8 +99,8 @@ openbao:
|
|||
founder_confirmation_items:
|
||||
- bound_claims_confirmed stays false until the founder confirms BOTH readers' bindings
|
||||
(this role's groups=net-kingdom-admins plus /assurance/level=aal2, and CCR-2026-0033's
|
||||
external-secrets/external-secrets ServiceAccount). An unconfirmed binding blocks the
|
||||
applier (applier-dry-run refuses).
|
||||
external-secrets/external-secrets ServiceAccount). An unconfirmed binding blocks
|
||||
the applier (applier-dry-run refuses).
|
||||
- The aal2 binding is the only MFA guarantee on this lane; the openbao-admin client
|
||||
itself does not pin MFA (KeyCape 7d96ee4).
|
||||
access_frontdoor:
|
||||
|
|
@ -131,6 +140,16 @@ verification:
|
|||
- Founder approvals A1 (ops-mason design), A2 (this CCR and CCR-2026-0033 with three
|
||||
reviews and bound_claims_confirmed true) and a completed CCR-2026-0033 custody
|
||||
run (A3).
|
||||
evidence:
|
||||
- at: '2026-10-07T00:03:24+00:00'
|
||||
actor: founder
|
||||
kind: delegated_metadata_apply
|
||||
result: passed
|
||||
details:
|
||||
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
||||
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator'
|
||||
- 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read'
|
||||
- No secret values were read, written, printed, or accepted in argv.
|
||||
lifecycle:
|
||||
deactivate: Delete the OIDC role first, then the policy; value-free receipt.
|
||||
rotate: Not applicable to the reader; the value rotates through the CCR-2026-0033
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue