5f30ddd90c
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
174 lines
8.1 KiB
YAML
174 lines
8.1 KiB
YAML
{
|
|
"id": "CCR-2026-0049",
|
|
"kind": "credential-change-request",
|
|
"schema_version": 1,
|
|
"request_type": "workload-kv-read",
|
|
"title": "NetKingdom identity backup retention delivery",
|
|
"status": "verified",
|
|
"created": "2026-10-16",
|
|
"updated": "2026-10-16",
|
|
"requester": {
|
|
"agent": "codex",
|
|
"reason": "Operator requested implementation of missing full identity backup coverage under NK-WP-0049."
|
|
},
|
|
"review": {
|
|
"required": true,
|
|
"required_approvers": [
|
|
"platform-owner",
|
|
"net-kingdom-owner",
|
|
"backup-share-owner"
|
|
],
|
|
"comments": [
|
|
{
|
|
"reviewer": "User (platform-owner)",
|
|
"decision": "approved",
|
|
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
|
|
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
|
|
"reviewed_at": "2026-10-15T23:51:21.374014+00:00"
|
|
},
|
|
{
|
|
"reviewer": "User (net-kingdom-owner)",
|
|
"decision": "approved",
|
|
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
|
|
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
|
|
"reviewed_at": "2026-10-15T23:51:21.374033+00:00"
|
|
},
|
|
{
|
|
"reviewer": "User (backup-share-owner)",
|
|
"decision": "approved",
|
|
"source_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971",
|
|
"comment": "Operator approved initial live packet and subsequently explicitly approved provider-added folder-only re-sharing (publisher21/retention25). Native admission and independent recovery gates remain.",
|
|
"reviewed_at": "2026-10-15T23:51:21.374039+00:00"
|
|
}
|
|
]
|
|
},
|
|
"target": {
|
|
"domain": "infotech",
|
|
"tenant": "platform",
|
|
"workload": "net-kingdom-identity-backup",
|
|
"environment": "production",
|
|
"purpose": "retention limited to new encrypted identity bundle folder; no age private key or Backup account password"
|
|
},
|
|
"openbao": {
|
|
"mount": "platform",
|
|
"kv_path": "platform/workloads/net-kingdom/identity-backup/retention",
|
|
"fields": [
|
|
"NC_WEBDAV_TOKEN"
|
|
],
|
|
"policy_name": "net-kingdom-backup-retention-eso",
|
|
"policy_file": "openbao/policies/net-kingdom-backup-retention-eso.hcl",
|
|
"metadata_read": false,
|
|
"token_self_lifecycle": true,
|
|
"auth": {
|
|
"method": "kubernetes",
|
|
"mount": "kubernetes",
|
|
"role": "net-kingdom-backup-retention-eso",
|
|
"audience": "openbao",
|
|
"ttl": "15m",
|
|
"token_max_ttl": "15m",
|
|
"token_explicit_max_ttl": "15m",
|
|
"token_no_default_policy": true,
|
|
"policies": [
|
|
"net-kingdom-backup-retention-eso"
|
|
],
|
|
"bound_claims": {
|
|
"service_account_names": [
|
|
"net-kingdom-backup-retention-eso"
|
|
],
|
|
"service_account_namespaces": [
|
|
"sso"
|
|
]
|
|
},
|
|
"bound_claims_confirmed": true
|
|
}
|
|
},
|
|
"provider": {
|
|
"host": "nx4069.your-storageshare.de",
|
|
"account_owner": "Backup",
|
|
"folder": "/railiance-backups/net-kingdom-identity",
|
|
"share_type": 3,
|
|
"share_permissions": 25,
|
|
"label": "net-kingdom-identity-retention",
|
|
"age_private_key_delivered": false,
|
|
"backup_account_password_delivered": false,
|
|
"provider_added_resharing_approved": true,
|
|
"scope_approval_ref": "statehub:decision:5edd5203-fae7-461b-8775-5d22b7873971"
|
|
},
|
|
"delivery": {
|
|
"surface": "ESO-managed Secret",
|
|
"namespace": "sso",
|
|
"secret": "net-kingdom-backup-retention",
|
|
"key": "token",
|
|
"service_account": "net-kingdom-backup-retention-eso",
|
|
"reader": "owner-controlled root backup retention process on railiance01; no agent credential delivery",
|
|
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786"
|
|
},
|
|
"risk": {
|
|
"classification": "high",
|
|
"notes": [
|
|
"Secret-bearing capture is limited to the four reviewed identity services; source/cluster/PVC bindings and private staging are mandatory.",
|
|
"Publisher can read/create in only this folder; retention can read/delete in only this folder. Both also include explicitly owner-approved provider-added re-sharing, but neither grants update, other folders or account administration.",
|
|
"Compromise of the retention token can destroy backups in this folder; keep it separate from the publisher and retain independent custody/recovery points.",
|
|
"Node root and ESO administration are inside this credential boundary. Coding agents must be denied the new data/metadata paths.",
|
|
"KV initial CAS=0 only; preserve existing values and refuse drift. No rotation of service keys, age keys, operator credentials or existing shares.",
|
|
"Nextcloud adds permission16 to read-enabled public links. User approved exact normalized21/25 on2026-10-16; tokens remain confined to the encrypted backup folder. Original5/9 attempt failed before credential publication."
|
|
]
|
|
},
|
|
"verification": {
|
|
"positive": [
|
|
"Exact share path/permissions and bounded KV/ESO role readback",
|
|
"Ciphertext create/readback/hash and exact runtime token delivery",
|
|
"Retention protects recovered point/newest/seven daily/two weekly and uses ETag-conditional deletion"
|
|
],
|
|
"negative": [
|
|
"Publisher overwrite/delete denied; retention create/overwrite denied",
|
|
"Sibling namespace/path/audience and KV write/metadata access denied",
|
|
"Unapproved or changed CCR/source, wrong cluster, resource drift and malformed archive refuse execution"
|
|
],
|
|
"activation_conditions": [
|
|
"Explicit platform, NetKingdom and Backup-share owner approval of this exact request and source packet.",
|
|
"Native exact namespace/ServiceAccount/audience verification and bounded role readback; no coding-agent access.",
|
|
"First real encrypted capture, off-host readback, independent-key recovery and cleanup before enabling timers.",
|
|
"Retention protects the independently recovered point and newest backup; no automatic deletion of pre-existing backups."
|
|
],
|
|
"actual_native_receipt": {
|
|
"repository": "net-kingdom",
|
|
"path": "docs/evidence/2026-10-16-identity-backup-live/retention-native-delivery-verified.json",
|
|
"source_ccr_sha256": "d391018abbda0fbc1acec4b5a22c0f99ce65525de940431df376a7552b3746cf",
|
|
"status": "reader_and_delivery_verified",
|
|
"kv_version": 1,
|
|
"wrong_service_account_denied": true,
|
|
"wrong_namespace_denied": true,
|
|
"wrong_audience_denied": true,
|
|
"bounded_policy_ttl": true,
|
|
"eso_equality_verified": true,
|
|
"temporary_reader_revoked": true
|
|
},
|
|
"actual_archive_and_runtime_acceptance": {
|
|
"owner_repo": "net-kingdom",
|
|
"archive_recovery": "docs/evidence/2026-10-16-identity-backup-live/actual-full-recovery-review.json",
|
|
"activation": "docs/evidence/2026-10-16-identity-backup-live/activation-review.json",
|
|
"recurring_job": "docs/evidence/2026-10-16-identity-backup-live/recurring-job-review.json",
|
|
"independent_owner_retrieval_and_key_recovery_passed": true,
|
|
"systemd_job_result": "success",
|
|
"timers_enabled": true,
|
|
"retention_pinned_and_newest_protected": true,
|
|
"native_full_service_authentication_claimed": false
|
|
}
|
|
},
|
|
"state_hub": {
|
|
"workplan_id": "NK-WP-0049",
|
|
"task_id": "NK-WP-0049-T03"
|
|
},
|
|
"access_frontdoor": {
|
|
"type": "platform-owner",
|
|
"catalog_id": "net-kingdom-identity-backup-retention",
|
|
"readiness": "pending-review",
|
|
"resolvable": false
|
|
},
|
|
"lifecycle": {
|
|
"deactivate": "Stop the corresponding timer, withdraw only this reader and disable its dedicated share under owner control; retain archives and recovery keys.",
|
|
"rotate": "Separate owner-approved share replacement and KV CAS rotation, preserved old access until new readback and recovery pass; no silent replacement by this setup tool.",
|
|
"compromised": "Fence this executor and revoke its dedicated share/reader. Treat retention-token compromise as possible loss of this folder; preserve independent recovery points and rotate only under incident authority."
|
|
}
|
|
}
|