6b1c1c700d
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
81 lines
3.4 KiB
YAML
81 lines
3.4 KiB
YAML
id: CCR-2026-0042
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: 'forgejo-netkingdom-oidc: consumer-reader-policy (oidc-browser-relying-party@1.0)'
|
|
status: in_flight
|
|
created: '2026-10-09'
|
|
updated: '2026-10-09'
|
|
requester:
|
|
agent: ops-mason
|
|
reason: 'MASON-WP-0010-T03 build of SecurityCase forgejo-netkingdom-oidc (oidc-browser-relying-party@1.0), render
|
|
sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23. Accepted by owner, founder on 2026-10-08:
|
|
key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged
|
|
via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e. The case acceptance
|
|
replaces a fresh executive summary.'
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
comments: []
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: keycape
|
|
environment: production
|
|
purpose: The consuming service reads the same secret. No metadata, list, parent or sibling access.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/forgejo
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-forgejo-forgejo
|
|
policy_file: openbao/policies/workload-kv-read-keycape-forgejo-forgejo.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
access_frontdoor:
|
|
type: none
|
|
catalog_id: forgejo-keycape-client
|
|
readiness: pending-review
|
|
resolvable: false
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Rendered from an acknowledged SecurityCaseType; shape reviewed with the type, names checked against live structure.
|
|
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
|
verification:
|
|
positive:
|
|
- policy workload-kv-read-keycape-forgejo-forgejo grants read on platform/data/workloads/keycape/forgejo only
|
|
(capabilities check)
|
|
negative:
|
|
- a default-only identity has no read capability on the path
|
|
- sibling GET and parent LIST are denied
|
|
activation_conditions:
|
|
- case acceptance present
|
|
- bound claims confirmed by the platform owner
|
|
lifecycle:
|
|
deactivate: delete the role, then policy workload-kv-read-keycape-forgejo-forgejo (case rollback)
|
|
rotate: roll-forward through the credential broker (mint-secret); never a read of the old value
|
|
compromised: owner incident process; no automatic read, reseed or cleanup
|
|
security_case:
|
|
case: forgejo-netkingdom-oidc
|
|
type: oidc-browser-relying-party@1.0
|
|
render_digest: sha256:fb8b114d465341a46bb492259cb9c6b77bc0731670edace2e13a1f58758c6e23
|
|
acceptance_record: key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01);
|
|
type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e
|
|
accepted_at: '2026-10-08'
|
|
accepted_by:
|
|
- owner
|
|
- founder
|
|
in_flight:
|
|
missing_fields:
|
|
- openbao.auth
|
|
owner: railiance-apps
|
|
blocking_reason: >-
|
|
railiance-apps must choose and review the consumer delivery/auth identity. Native
|
|
forgejo-gitea and forgejo-runner both use forgejo/default; that shared identity
|
|
must not be filled as a dedicated consumer binding. RAPPS-WP-0016 intends ESO
|
|
delivery; current type1.1 templates only the KeyCape ESO role, so a consumer
|
|
role/delivery refinement needs explicit owner review. Historical type1.0 CCR
|
|
provenance remains unchanged; reconcile exact current1.1 structure before
|
|
application. See docs/evidence/2026-10-11-forgejo-first-case/owner-return.md.
|