diff --git a/credential-change-requests/CCR-2026-0033.yaml b/credential-change-requests/CCR-2026-0033.yaml index d9ea2cc..7f317d8 100644 --- a/credential-change-requests/CCR-2026-0033.yaml +++ b/credential-change-requests/CCR-2026-0033.yaml @@ -3,15 +3,15 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: KeyCape secrets-engine-openbao issuer workload reader and authoritative custody -status: approved +status: applied created: '2026-10-04' -updated: '2026-10-06' +updated: '2026-10-07' requester: agent: key-cape reason: 'KEY-WP-0037-T02 owner packet; issuer-side read of the authoritative secrets-engine-openbao - client secret. Revised 2026-10-06 per founder direction (the secret lives only in OpenBao) - and ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc, MASON-WP-0009): - consumer file and secrets-engine D1-D4 removed.' + client secret. Revised 2026-10-06 per founder direction (the secret lives only + in OpenBao) and ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc, + MASON-WP-0009): consumer file and secrets-engine D1-D4 removed.' review: required: true required_approvers: @@ -22,22 +22,37 @@ review: - at: '2026-10-07' reviewer: platform-owner (founder Bernd Worsch) decision: approved - comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as platform-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.' + comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) + approves CCR-2026-0033 as platform-owner. Covers A1 (ops-mason design 658cdbc), + A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) + and A3 (exactly one attended custody-child provision run, cas=0, KV version + 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the + KeyCape registration, the restart or any rotation. - at: '2026-10-07' reviewer: key-cape-owner (founder Bernd Worsch) decision: approved - comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as key-cape-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.' + comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) + approves CCR-2026-0033 as key-cape-owner. Covers A1 (ops-mason design 658cdbc), + A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) + and A3 (exactly one attended custody-child provision run, cas=0, KV version + 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the + KeyCape registration, the restart or any rotation. - at: '2026-10-07' reviewer: net-kingdom-owner (founder Bernd Worsch) decision: approved - comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0033 as net-kingdom-owner. Covers A1 (ops-mason design 658cdbc), A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) and A3 (exactly one attended custody-child provision run, cas=0, KV version 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the KeyCape registration, the restart or any rotation.' + comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) + approves CCR-2026-0033 as net-kingdom-owner. Covers A1 (ops-mason design 658cdbc), + A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed) + and A3 (exactly one attended custody-child provision run, cas=0, KV version + 1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the + KeyCape registration, the restart or any rotation. target: domain: infotech tenant: platform workload: keycape environment: production - purpose: Hold the secrets-engine-openbao client secret authoritatively in platform KV and - deliver it to the KeyCape issuer through sso-only ESO + purpose: Hold the secrets-engine-openbao client secret authoritatively in platform + KV and deliver it to the KeyCape issuer through sso-only ESO openbao: mount: platform kv_path: platform/workloads/keycape/secrets-engine-openbao @@ -85,27 +100,38 @@ risk: classification: high notes: - Reads the whole path holding the secrets-engine-openbao confidential value - - Only ExternalSecrets in namespace sso may use the store; sso namespace writers are within - this boundary - - 'One value, two copies: KV (authoritative) and the sso Secret (issuer delivery). The consumer - holds no copy at rest; it reads in memory through CCR-2026-0034.' - - 'Must stay on kubernetes auth: a KeyCape-issued identity would make KeyCape startup depend - on KeyCape.' + - Only ExternalSecrets in namespace sso may use the store; sso namespace writers + are within this boundary + - 'One value, two copies: KV (authoritative) and the sso Secret (issuer delivery). + The consumer holds no copy at rest; it reads in memory through CCR-2026-0034.' + - 'Must stay on kubernetes auth: a KeyCape-issued identity would make KeyCape startup + depend on KeyCape.' verification: positive: - Owner-reviewed native exact identity and exact path proof required negative: - Owner-reviewed wrong identity, sibling GET and parent LIST denials required - - Metadata shows cas_required=true, max_versions=2 and the declared custom_metadata (value-free). + - Metadata shows cas_required=true, max_versions=2 and the declared custom_metadata + (value-free). activation_conditions: - Exact CCR approval, confirmed identity, attended custody and native receipt acceptance required + evidence: + - at: '2026-10-07T00:03:08+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso' + - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao' + - No secret values were read, written, printed, or accepted in argv. lifecycle: - deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback receipt - required - rotate: 'Roll-forward only: custody child writes a new version with cas= under - a standing rotation approval for this CCR (event-driven + 90d); never a read or restore - of an old version' + deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback + receipt required + rotate: 'Roll-forward only: custody child writes a new version with cas= + under a standing rotation approval for this CCR (event-driven + 90d); never a + read or restore of an old version' compromised: Owner incident process; no automatic read, reseed or cleanup scaffold: draft_only: true @@ -119,64 +145,65 @@ state_hub: related_workplan: KEY-WP-0037 delivery: surface: external-secrets - target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side delivery - only + target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side + delivery only review_bundle: docs/provisioning-windows/2026-10-04-1000/keycape - consumer_delivery: none at rest; attended operator OIDC reader CCR-2026-0034 reads into - secrets-engine process memory per command + consumer_delivery: none at rest; attended operator OIDC reader CCR-2026-0034 reads + into secrets-engine process memory per command boundary_decision: id: 632a8893-0d6a-4591-a50b-40bbdb798f32 - approves: custody boundary only (platform authoritative KV and least-privilege issuer delivery; - secrets-engine-owned mode-0600 consumer file outside every worktree) + approves: custody boundary only (platform authoritative KV and least-privilege issuer + delivery; secrets-engine-owned mode-0600 consumer file outside every worktree) does_not_approve: generation, KV write, fetch, delivery, registration or deployment - note: 'The design narrows this boundary: the secrets-engine consumer file it approved is - withdrawn (founder direction 2026-10-06).' -path_correction: 'Candidate path platform/services/keycape/secrets-engine-openbao from the - KeyCape packet is outside the platform-mount applier scope (WARDEN-WP-0028: platform/workloads/ - only). Corrected to platform/workloads/keycape/secrets-engine-openbao, same field CLIENT_SECRET. - The issuer binds to the sso Secret; the operator reader (CCR-2026-0034) reads the exact - data path.' + note: 'The design narrows this boundary: the secrets-engine consumer file it approved + is withdrawn (founder direction 2026-10-06).' +path_correction: 'Candidate path platform/services/keycape/secrets-engine-openbao + from the KeyCape packet is outside the platform-mount applier scope (WARDEN-WP-0028: + platform/workloads/ only). Corrected to platform/workloads/keycape/secrets-engine-openbao, + same field CLIENT_SECRET. The issuer binds to the sso Secret; the operator reader + (CCR-2026-0034) reads the exact data path.' custody_child: script: scripts/keycape_secrets_engine_openbao_custody.py tests: tests/test_keycape_secrets_engine_openbao_custody.py status: source-only; never executed requires: - - --approval-decision ; refused when absent, malformed, equal to the boundary - decision, or not recorded in an approved review comment of this CCR - - this CCR and sibling CCR-2026-0034 approved with platform-owner, key-cape-owner and net-kingdom-owner - approvals and bound_claims_confirmed true + - --approval-decision ; refused when absent, malformed, equal to + the boundary decision, or not recorded in an approved review comment of this CCR + - this CCR and sibling CCR-2026-0034 approved with platform-owner, key-cape-owner + and net-kingdom-owner approvals and bound_claims_confirmed true - attended warden platform-admin envelope; no BAO_TOKEN/VAULT_TOKEN in environment - umask 077, shell tracing off - - --rotate for any run after the first (cas=); without it an existing - entry is refused - generation: one secrets.token_urlsafe(48) value in process memory (64 chars); never in argv, - environment, stdout, stderr, logs, Git or the hub - authoritative_write: KV-v2 write with options.cas=0 (absent) or cas= - (rotation, --rotate); value only in process memory and the bao stdin/HTTP body; metadata-only - preflight + - --rotate for any run after the first (cas=); without + it an existing entry is refused + generation: one secrets.token_urlsafe(48) value in process memory (64 chars); never + in argv, environment, stdout, stderr, logs, Git or the hub + authoritative_write: KV-v2 write with options.cas=0 (absent) or cas= (rotation, --rotate); value only in process memory and the bao stdin/HTTP + body; metadata-only preflight receipt: O_EXCL 0600 JSON with booleans, KV version, request id, CAS, metadata applied/unchanged, CCR/decision ids and CCR digest only - failure_cleanup: nothing to clean locally; a written KV version is retained and recorded; - recovery is a fresh roll-forward run with --rotate (cas=), never a KV read - metadata_write: kv metadata put of openbao.kv_metadata, compared before write against a - metadata-only read; skipped when equal + failure_cleanup: nothing to clean locally; a written KV version is retained and + recorded; recovery is a fresh roll-forward run with --rotate (cas=), + never a KV read + metadata_write: kv metadata put of openbao.kv_metadata, compared before write against + a metadata-only read; skipped when equal rotation_revocation: generation_and_authoritative_version: railiance-platform custody child, version-guarded, roll-forward - issuer_pickup: 'key-cape / net-kingdom: ESO refresh then KeyCape restart immediately (exchanges - fail closed 401 between KV write and restart)' - consumer_pickup: 'automatic: the next secrets-engine command reads the latest version in - memory (CCR-2026-0034)' - disable_on_compromise: key-cape / net-kingdom remove registration first; platform rotates - and detaches the CCR-2026-0034 role policy + issuer_pickup: 'key-cape / net-kingdom: ESO refresh then KeyCape restart immediately + (exchanges fail closed 401 between KV write and restart)' + consumer_pickup: 'automatic: the next secrets-engine command reads the latest version + in memory (CCR-2026-0034)' + disable_on_compromise: key-cape / net-kingdom remove registration first; platform + rotates and detaches the CCR-2026-0034 role policy retire_versions: railiance-platform per separate destroy approval live_order: -- 0 founder approvals A1 design, A2 this CCR + CCR-2026-0034 (three reviews, bound claims - confirmed for both readers), A3 custody-child decision id +- 0 founder approvals A1 design, A2 this CCR + CCR-2026-0034 (three reviews, bound + claims confirmed for both readers), A3 custody-child decision id - 1 attended custody child (this repo) writes KV v1 and metadata; non-secret receipt -- 2 platform applies policies/roles (this CCR and CCR-2026-0034) and the sso-only ClusterSecretStore - + ExternalSecret; Secret sso/keycape-secrets-engine-openbao-client exists (metadata receipt - only) +- 2 platform applies policies/roles (this CCR and CCR-2026-0034) and the sso-only + ClusterSecretStore + ExternalSecret; Secret sso/keycape-secrets-engine-openbao-client + exists (metadata receipt only) - 3 net-kingdom env patch secrets-engine-openbao-client.proposed.patch.yaml (NK-WP-0046) - 4 KeyCape registration merge (KEY-WP-0037-T03) - 5 KeyCape restart immediately after step 4 @@ -184,19 +211,19 @@ live_order: - 7 platform OpenBao JWT role/policy secrets-engine-openbao and login proof (RPF-WP-0035-T02) rollback: before_step_3: delete the CCR-2026-0034 OIDC role, then its policy; delete ExternalSecret - (uid precondition), then the ESO role/policy; KV entry retained pending separate destroy - approval - after_step_3: net-kingdom rollout helper restores prior config/Deployment first, then the - before_step_3 sequence - cleanup_receipts: native, value-free, per step owner; a failed cleanup is recorded as open - evidence + (uid precondition), then the ESO role/policy; KV entry retained pending separate + destroy approval + after_step_3: net-kingdom rollout helper restores prior config/Deployment first, + then the before_step_3 sequence + cleanup_receipts: native, value-free, per step owner; a failed cleanup is recorded + as open evidence founder_confirmation_items: -- 'bound_claims_confirmed stays false until the founder confirms BOTH readers: this CCR (kubernetes, - external-secrets/external-secrets, audience openbao) and sibling CCR-2026-0034 (OIDC, groups=net-kingdom-admins - and /assurance/level=aal2).' -- 'Approvals: A1 ops-mason design; A2 this CCR plus CCR-2026-0034 with platform-owner, key-cape-owner - and net-kingdom-owner reviews; A3 the exact custody-child decision id (must differ from - boundary decision 632a8893-0d6a-4591-a50b-40bbdb798f32).' +- 'bound_claims_confirmed stays false until the founder confirms BOTH readers: this + CCR (kubernetes, external-secrets/external-secrets, audience openbao) and sibling + CCR-2026-0034 (OIDC, groups=net-kingdom-admins and /assurance/level=aal2).' +- 'Approvals: A1 ops-mason design; A2 this CCR plus CCR-2026-0034 with platform-owner, + key-cape-owner and net-kingdom-owner reviews; A3 the exact custody-child decision + id (must differ from boundary decision 632a8893-0d6a-4591-a50b-40bbdb798f32).' runbook: docs/provisioning-windows/2026-10-04-1000/keycape/founder-runbook.md related: sibling_ccr: CCR-2026-0034 diff --git a/credential-change-requests/CCR-2026-0034.yaml b/credential-change-requests/CCR-2026-0034.yaml index 768af6a..5d3e89c 100644 --- a/credential-change-requests/CCR-2026-0034.yaml +++ b/credential-change-requests/CCR-2026-0034.yaml @@ -3,16 +3,16 @@ kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: KeyCape secrets-engine-openbao attended operator reader (in-memory, per command) -status: approved +status: applied created: '2026-10-06' -updated: '2026-10-06' +updated: '2026-10-07' requester: agent: railiance-platform - reason: Founder direction 2026-10-06 - the secrets-engine-openbao client secret lives - only in OpenBao; ops-mason plan keycape-secrets-engine-openbao-client-custody + reason: Founder direction 2026-10-06 - the secrets-engine-openbao client secret + lives only in OpenBao; ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc, MASON-WP-0009) section 3.3. Sibling of CCR-2026-0033 (issuer ESO reader); - one auth role per CCR is this repo's convention (cf. CCR-2026-0019). Replaces the - superseded secrets-engine consumer file (SECRETS-WP-0012-T02 D1-D4). + one auth role per CCR is this repo's convention (cf. CCR-2026-0019). Replaces + the superseded secrets-engine consumer file (SECRETS-WP-0012-T02 D1-D4). review: required: true required_approvers: @@ -23,24 +23,33 @@ review: - at: '2026-10-06' reviewer: key-cape (owner packet, key-cape 7d96ee4) decision: claim_shape_reported - comment: 'KeyCape reports the groups claim is always emitted, so groups_claim groups - bound to net-kingdom-admins works as in CCR-2026-0019. MFA is not pinned on the - openbao-admin client; it holds only through the provider default requireForAll. - KeyCape asks that the role also bind the assurance claim (/assurance/level = aal2, - issued only after a verified factor). This is an owner report, not an approval - and not the founder confirmation of bound claims.' + comment: KeyCape reports the groups claim is always emitted, so groups_claim groups + bound to net-kingdom-admins works as in CCR-2026-0019. MFA is not pinned on + the openbao-admin client; it holds only through the provider default requireForAll. + KeyCape asks that the role also bind the assurance claim (/assurance/level = + aal2, issued only after a verified factor). This is an owner report, not an + approval and not the founder confirmation of bound claims. - at: '2026-10-07' reviewer: platform-owner (founder Bernd Worsch) decision: approved - comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as platform-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.' + comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) + approves CCR-2026-0034 as platform-owner. Covers A2 for this operator OIDC reader + (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the + role and policy needs its own go. - at: '2026-10-07' reviewer: key-cape-owner (founder Bernd Worsch) decision: approved - comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as key-cape-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.' + comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) + approves CCR-2026-0034 as key-cape-owner. Covers A2 for this operator OIDC reader + (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the + role and policy needs its own go. - at: '2026-10-07' reviewer: net-kingdom-owner (founder Bernd Worsch) decision: approved - comment: 'Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) approves CCR-2026-0034 as net-kingdom-owner. Covers A2 for this operator OIDC reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the role and policy needs its own go.' + comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06) + approves CCR-2026-0034 as net-kingdom-owner. Covers A2 for this operator OIDC + reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying + the role and policy needs its own go. target: domain: infotech tenant: platform @@ -90,8 +99,8 @@ openbao: founder_confirmation_items: - bound_claims_confirmed stays false until the founder confirms BOTH readers' bindings (this role's groups=net-kingdom-admins plus /assurance/level=aal2, and CCR-2026-0033's - external-secrets/external-secrets ServiceAccount). An unconfirmed binding blocks the - applier (applier-dry-run refuses). + external-secrets/external-secrets ServiceAccount). An unconfirmed binding blocks + the applier (applier-dry-run refuses). - The aal2 binding is the only MFA guarantee on this lane; the openbao-admin client itself does not pin MFA (KeyCape 7d96ee4). access_frontdoor: @@ -131,6 +140,16 @@ verification: - Founder approvals A1 (ops-mason design), A2 (this CCR and CCR-2026-0033 with three reviews and bound_claims_confirmed true) and a completed CCR-2026-0033 custody run (A3). + evidence: + - at: '2026-10-07T00:03:24+00:00' + actor: founder + kind: delegated_metadata_apply + result: passed + details: + - Delegated metadata applier ran as founder using local bao CLI ambient authority. + - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator' + - 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read' + - No secret values were read, written, printed, or accepted in argv. lifecycle: deactivate: Delete the OIDC role first, then the policy; value-free receipt. rotate: Not applicable to the reader; the value rotates through the CCR-2026-0033