2951b69fc5
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
155 lines
7.2 KiB
YAML
155 lines
7.2 KiB
YAML
id: CCR-2026-0046
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Reuse Surface exact seven private-source repository reader
|
|
status: approved
|
|
created: '2026-10-15'
|
|
updated: '2026-10-15'
|
|
requester:
|
|
agent: platform-reader-owner delegated preparation worker
|
|
reason: CUST-WP-0081 hosted63/70; founder metadata consent excludes credential provisioning.
|
|
Prepare separate seven-source reader.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- railiance-forge-owner
|
|
- reuse-surface-owner
|
|
- railiance-apps-owner
|
|
comments: []
|
|
target:
|
|
domain: infotech
|
|
tenant: reuse
|
|
workload: reuse-surface
|
|
environment: production
|
|
purpose: Native acquisition of seven owner-consented pinned capability indexes.
|
|
Entire private repository code becomes readable by this dedicated reader; publication
|
|
remains only approved metadata.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/reuse/reuse-surface/forgejo-source-read
|
|
fields:
|
|
- FORGEJO_SOURCE_TOKEN
|
|
- API_USER
|
|
- API_BASE_URL
|
|
- TOKEN_SCOPES
|
|
- GENERATED_AT
|
|
- CCR_ID
|
|
policy_name: workload-kv-read-reuse-surface-runtime-eso
|
|
policy_file: openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: reuse-surface-runtime-eso
|
|
bound_claims:
|
|
service_account_names:
|
|
- reuse-surface-eso
|
|
service_account_namespaces:
|
|
- reuse
|
|
bound_claims_confirmed: true
|
|
policies:
|
|
- workload-kv-read-reuse-surface-runtime-eso
|
|
ttl: 15m
|
|
audience: openbao
|
|
access_frontdoor:
|
|
type: external-secrets
|
|
catalog_id: reuse-surface-forgejo-source-read
|
|
readiness: pending-review
|
|
resolvable: false
|
|
delivery:
|
|
surface: external-secrets
|
|
bootstrap_command: warden access openbao-platform-admin-login --exec -- python3
|
|
scripts/provision-reuse-surface-forgejo-source.py --approval <approved-revision-receipt>
|
|
--receipt <0600-durable-receipt>
|
|
provisioning_script: scripts/provision-reuse-surface-forgejo-source.py
|
|
target: Existing namespace-limited store openbao-reuse. Apps owner adds only proposed
|
|
data item into ExternalSecret reuse/reuse-surface-runtime. Shared target reuse-surface-env
|
|
remains intact.
|
|
forgejo_identity: reuse-surface-source
|
|
forgejo_team: reuse-surface-source-readers
|
|
repositories:
|
|
- coulomb/rapp-openbao
|
|
- coulomb/rapp-policy-nexus
|
|
- coulomb/rapp-postgres
|
|
- coulomb/rapp-sbom-nexus
|
|
- coulomb/rapp-telemetry
|
|
- coulomb/rapp-tenant-engine
|
|
- coulomb/rapp-user-engine
|
|
token_scopes:
|
|
- read:repository
|
|
consumer_gate: Reader must not be delivered until reuse-surface owner supplies verified
|
|
image digest containing BOTH authenticated redirect rejection/HTTPS enforcement
|
|
AND runtime-controlled exact URL allowlist checked before credential lookup. Apps
|
|
owner must deploy REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST mapping the reader environment
|
|
to exactly fourteen consented pinned index/entry URLs and inventory existing authenticated
|
|
sources for migration. Current image and redirect-only fix are not approved. Native
|
|
owner helper must verify all seven pinned indexes and entry hashes after rollout.
|
|
risk:
|
|
classification: high
|
|
cost_estimate_eur: 0
|
|
notes:
|
|
- Repository grants disclose entire source of these seven repositories to hub; PAT
|
|
cannot restrict access to index files.
|
|
- No all-repositories membership, unrelated private grants, admin privileges or
|
|
repository writes.
|
|
- Existing ESO role expands by one exact data-read path; writer OIDC caller remains
|
|
unchanged and denied new path.
|
|
- Current consumer accepts arbitrary authenticated source URLs and redirects, allowing
|
|
bearer disclosure. Delivery barred until full reviewed redirect/HTTPS and runtime-controlled
|
|
exact URL allowlist patch image plus config is verified.
|
|
- PAT has no server-side expiry; rotate quarterly and immediately upon incident.
|
|
- Bootstrap writes only exact new identity/team/PAT/KV. Policy apply, ESO delivery,
|
|
consumer rollout and registrations require their separate reviewed owner steps.
|
|
- R1 pagination defect preserved; R2 pages until empty with duplicate/count/bound
|
|
checks. Deployed-version live complete-grant inventory remains required; code
|
|
review is not live scope proof.
|
|
- Quarterly rotation is a proposed manual requirement, not deployed expiry enforcement;
|
|
due-date owner task/receipt and separate exact-token recovery approval must be
|
|
established before activation.
|
|
verification:
|
|
positive:
|
|
- All seven repositories private; exact team/code-read flags, one dedicated team
|
|
member, exact seven memberships, effective permissions read and exactly one read:repository
|
|
PAT.
|
|
- Each consented index digest matches from authenticated Forgejo read; final hosted
|
|
native owner helper verifies pinned entry hashes as well.
|
|
- OpenBao stdin CAS=0 field write readback matches without printing or persisting
|
|
value.
|
|
- ESO binding and namespace condition surveyed and confirmed; native fixed consumer
|
|
image verified before delivery; final hosted70/70 exactly once.
|
|
negative:
|
|
- Known excluded private rapp-core-hub reader request denied (403/404); administrative
|
|
endpoint and Actions secrets denied.
|
|
- No additional private effective repositories or teams; no write probing that could
|
|
itself cause a change.
|
|
- Scoped writer and default OpenBao identities denied new data path; ESO role denied
|
|
unrelated siblings and wrong SA/namespace/audience login refused.
|
|
- Missing/anonymous native authentication refused with no privileged fallback.
|
|
activation_conditions:
|
|
- Independent platform/Forgejo/reuse/apps owner reviews of exact artifacts and founder
|
|
CCR provisioning disposition recorded; no approval inferred from metadata consent.
|
|
- Confirm existing ESO Kubernetes binding before any delegated metadata apply.
|
|
- Consumer security patch image digest verified and apps rollout artifacts reviewed/approved
|
|
before delivery.
|
|
- Durable bounded bootstrap and positive/negative receipts pass; owner native fetch
|
|
proof passes all seven pinned sources.
|
|
- Separate scoped writer registration batch followed by fresh hosted70/70 completion
|
|
audit.
|
|
evidence: []
|
|
lifecycle:
|
|
deactivate: Separate explicitly approved silent scripts/revoke-reuse-surface-forgejo-source.py
|
|
validates reviewed single PAT ID/name, admin PATCH only dedicated user to fresh
|
|
process-memory password, Basic-auth DELETE exact token, then reconciles complete
|
|
inventory absence. Admin PAT/Sudo alone cannot delete. KV/shared runtime Secret
|
|
preserved. Apps/platform owners remove only new ESO item/policy stanza through
|
|
their reviewed path; preserve writer/webhook/public registrations. Recovery helper
|
|
approval is separate from mint/bootstrap approval.
|
|
rotate: Attended owner revokes old identified PAT then governed bootstrap remints
|
|
and verifies; never overwrite differing/orphan KV through bootstrap. Explicit
|
|
scoped CAS update plan required for rotation.
|
|
compromised: Revoke all dedicated service-user PATs, remove delivery data item,
|
|
roll fixed consumer with owners, retain failed sanitized evidence; investigate
|
|
all seven private source exposure. Do not rotate unrelated credentials without
|
|
separate scope.
|
|
revision: 2
|