7d498c8547
Policy workload-kv-read-keycape-forgejo-eso and Kubernetes role external-secrets-keycape-forgejo applied 2026-10-09T18:09Z. Inert until mint-secret creates platform/workloads/keycape/forgejo (RPF-WP-0054). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
111 lines
4.1 KiB
YAML
111 lines
4.1 KiB
YAML
id: CCR-2026-0041
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: 'forgejo-netkingdom-oidc: keycape-reader-policy (oidc-browser-relying-party@1.0)'
|
|
status: applied
|
|
created: '2026-10-09'
|
|
updated: '2026-10-09'
|
|
requester:
|
|
agent: ops-mason
|
|
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0),
|
|
render sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23.
|
|
Accepted by owner, founder on 2026-10-08: key-cape docs/forgejo-oidc-client-request.yaml
|
|
(status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision
|
|
memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The
|
|
case acceptance replaces a fresh executive summary.'
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
comments:
|
|
- at: '2026-10-09T18:09:10+00:00'
|
|
reviewer: platform-owner (founder Bernd Worsch)
|
|
decision: approved
|
|
comment: Approve ESO reader for SecurityCase forgejo-netkingdom-oidc (accepted
|
|
2026-10-08).
|
|
- at: '2026-10-09T18:09:10+00:00'
|
|
reviewer: founder
|
|
decision: binding_confirmed
|
|
comment: Bound to external-secrets/external-secrets, mirrors CCR-2026-0033.
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: keycape
|
|
environment: production
|
|
purpose: KeyCape reads its client secret only through ESO. No metadata, list, parent
|
|
or sibling access.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/forgejo
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-forgejo-eso
|
|
policy_file: openbao/policies/workload-kv-read-keycape-forgejo-eso.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-keycape-forgejo
|
|
audience: openbao
|
|
ttl: 15m
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
policies:
|
|
- workload-kv-read-keycape-forgejo-eso
|
|
bound_claims:
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
bound_claims_confirmed: true
|
|
access_frontdoor:
|
|
type: external-secrets
|
|
catalog_id: forgejo-keycape-client
|
|
readiness: pending-review
|
|
resolvable: false
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Rendered from an acknowledged SecurityCaseType; shape reviewed with the type,
|
|
names checked against live structure.
|
|
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
|
verification:
|
|
positive:
|
|
- policy workload-kv-read-keycape-forgejo-eso grants read on platform/data/workloads/keycape/forgejo
|
|
only (capabilities check)
|
|
negative:
|
|
- a default-only identity has no read capability on the path
|
|
- sibling GET and parent LIST are denied
|
|
activation_conditions:
|
|
- case acceptance present
|
|
- bound claims confirmed by the platform owner
|
|
evidence:
|
|
- at: '2026-10-09T18:09:18+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-forgejo-eso'
|
|
- 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-forgejo'
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
lifecycle:
|
|
deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-eso (case
|
|
rollback)
|
|
rotate: roll-forward through the credential broker (mint-secret); never a read of
|
|
the old value
|
|
compromised: owner incident process; no automatic read, reseed or cleanup
|
|
security_case:
|
|
case: forgejo-netkingdom-oidc
|
|
type: oidc-browser-relying-party@1.0
|
|
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
|
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08,
|
|
KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4,
|
|
hub decision e418263e
|
|
accepted_at: '2026-10-08'
|
|
accepted_by:
|
|
- owner
|
|
- founder
|