79fbb4bdb5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 306568@bnt-lap001 Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91
152 lines
6.7 KiB
YAML
152 lines
6.7 KiB
YAML
id: CCR-2026-0051
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Temporary MAS Scaleway TEM relay SMTP ESO read lane
|
|
status: applied
|
|
created: '2026-10-18'
|
|
updated: '2026-10-18'
|
|
requester:
|
|
agent: ops-mason
|
|
reason: ops-mason plans/mas-tem-relay-smtp.md (MASON-WP-0014, reviewed 2026-10-18T10:13:55Z)
|
|
for consumer mail-address-semantics MAS-WP-0003. Hub messages daa119e6, a77e5879
|
|
(kv_path correction) and 049afa1f. No approval is implied by this filing.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- founder
|
|
- railiance-platform-owner
|
|
- mail-address-semantics-owner
|
|
comments:
|
|
- at: '2026-10-18T10:36:53+00:00'
|
|
reviewer: railiance-platform-owner (policy-as-code ccr-standard-lane v1)
|
|
decision: approved
|
|
comment: 'Standard lane: passes ccr-standard-lane v1 sha256:5481be201456739b9e01b14b0b11211923d7d838a2e71e2e417af038a05aec95.
|
|
Platform-owner source review only; founder approval and confirm-binding still
|
|
required.'
|
|
- at: '2026-10-18T10:42:00+00:00'
|
|
reviewer: founder (Bernd Worsch)
|
|
decision: approved
|
|
comment: 'Approved 2026-10-18 for ops-mason plans/mas-tem-relay-smtp.md (MASON-WP-0014):
|
|
build policy workload-kv-read-mas-tem-relay and kubernetes role external-secrets-mas-tem-relay
|
|
under ops-mason-construct. Temporary; teardown with namespace mas.'
|
|
- at: '2026-10-18T10:46:25+00:00'
|
|
reviewer: founder
|
|
decision: approved
|
|
comment: 'State Hub decision e633607e-ff3e-46ec-bb6f-143e8b44f1af: APPROVE: CCR-2026-0051
|
|
path=platform/suppliers/scaleway/mas-tem-relay policy=workload-kv-read-mas-tem-relay
|
|
auth_role=auth/kubernetes/role/external-secrets-mas-tem-relay; rationale=temporary
|
|
MAS TEM relay lane, read-only, namespace mas, torn down with mas'
|
|
- at: '2026-10-18T10:58:26+00:00'
|
|
reviewer: railiance-platform-owner (claude, native evidence)
|
|
decision: binding_confirmed
|
|
comment: 'Native 2026-10-18: SA mas-tem-relay-eso exists in ns mas (consumer mail-address-semantics
|
|
deploy/railiance/manifests.yaml 2e9a074, automount false). SecretStore mas/openbao-mas-tem-relay
|
|
references mount kubernetes, role external-secrets-mas-tem-relay, SA mas-tem-relay-eso,
|
|
audience openbao, and validated Ready at 10:49:56Z, i.e. a successful login
|
|
with exactly the CCR bound claims. ESO reads the path; the 10:56:56Z failure
|
|
is consumer-side admission, not auth.'
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: mas-tem-relay
|
|
environment: production
|
|
purpose: Deliver Scaleway TEM SMTP relay username/password to namespace mas only.
|
|
Temporary lane; torn down with namespace mas.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/suppliers/scaleway/mas-tem-relay
|
|
fields:
|
|
- username
|
|
- password
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
policy_name: workload-kv-read-mas-tem-relay
|
|
policy_file: openbao/policies/workload-kv-read-mas-tem-relay.hcl
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-mas-tem-relay
|
|
bound_claims:
|
|
service_account_names:
|
|
- mas-tem-relay-eso
|
|
service_account_namespaces:
|
|
- mas
|
|
bound_claims_confirmed: true
|
|
policies:
|
|
- workload-kv-read-mas-tem-relay
|
|
ttl: 15m
|
|
audience: openbao
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
access_frontdoor:
|
|
type: external-secrets
|
|
catalog_id: mas-tem-relay-smtp
|
|
selector: Namespace mas, SA mas-tem-relay-eso only
|
|
readiness: pending-review
|
|
resolvable: false
|
|
delivery:
|
|
surface: external-secrets
|
|
target: Namespace mas; dedicated SA mas-tem-relay-eso; ExternalSecret projecting
|
|
username and password only.
|
|
bootstrap_command: Not applicable. KV value already written by the founder (v2);
|
|
this CCR creates no value and authorizes no value read.
|
|
risk:
|
|
classification: medium
|
|
notes:
|
|
- Supplier SMTP credential can send mail as the TEM sending domain; exposure is
|
|
limited to namespace mas.
|
|
- New read scope on a supplier path; founder approval required. No other lane reads
|
|
this path (ops-mason live survey 2026-10-18T10:13:55Z).
|
|
- Apply may be run by ops-mason under ops-mason-construct (MASON-IN-0005) once installed
|
|
(MASON-WP-0015-T02) and this CCR is approved; that grant covers workload-kv-read-*
|
|
policies and external-secrets-* roles only.
|
|
verification:
|
|
positive:
|
|
- Exact SA/namespace/audience login succeeds; ESO Ready/SecretSynced; metadata version
|
|
matches admitted KV version 2 without printing values.
|
|
negative:
|
|
- Wrong SA, namespace or audience login refused; sibling paths under platform/suppliers/scaleway,
|
|
list, metadata, write and delete denied.
|
|
activation_conditions:
|
|
- Founder, platform owner and consumer owner approve the exact CCR.
|
|
- Native bound claims confirmed (confirm-binding) and native policy/role readback
|
|
matches source.
|
|
evidence:
|
|
- at: '2026-10-18T10:44:23+00:00'
|
|
actor: ops-mason (claude-MASON-WP-0014-T03, ops-mason-construct)
|
|
kind: apply
|
|
result: success
|
|
details:
|
|
- '2026-10-18: policy workload-kv-read-mas-tem-relay written from openbao/policies/workload-kv-read-mas-tem-relay.hcl;
|
|
read back byte-equal'
|
|
- 'kubernetes role external-secrets-mas-tem-relay written: SA mas-tem-relay-eso,
|
|
ns mas, audience openbao, token_policies [workload-kv-read-mas-tem-relay], ttl/max/explicit_max
|
|
15m, token_no_default_policy true; read back matches CCR'
|
|
- KV platform/suppliers/scaleway/mas-tem-relay present (v2, founder-written);
|
|
no value read
|
|
- 'pending: SA mas-tem-relay-eso not yet applied (bound_claims_confirmed false);
|
|
confirm-binding and ESO sync next'
|
|
- at: '2026-10-18T10:58:27+00:00'
|
|
actor: railiance-platform (claude)
|
|
kind: native-binding
|
|
result: success
|
|
details:
|
|
- SecretStoreValid 2026-10-18T10:49:56Z with the exact CCR SA/namespace/audience/role;
|
|
ESO provider read succeeded; ops-mason apply readback 102668f.
|
|
- 'Open: ExternalSecret mas/mas-relay refused by admission policy reject-secret-last-applied
|
|
(client-side apply annotation copied to target); fix sent to mail-address-semantics
|
|
1a76a832. Negative checks (wrong SA/namespace/audience, sibling, list, metadata,
|
|
write) not yet run.'
|
|
lifecycle:
|
|
deactivate: Delete ExternalSecret and role external-secrets-mas-tem-relay, then
|
|
policy workload-kv-read-mas-tem-relay, when namespace mas is torn down.
|
|
rotate: Founder writes a new KV version via UI; ESO refresh picks it up; verify
|
|
metadata version only.
|
|
compromised: Revoke the SMTP credential at Scaleway, disable the role, rotate the
|
|
KV value, then re-enable after review.
|
|
state_hub:
|
|
decision_id: e633607e-ff3e-46ec-bb6f-143e8b44f1af
|
|
decision_api_url: http://127.0.0.1:8000/decisions/e633607e-ff3e-46ec-bb6f-143e8b44f1af
|
|
decision_resolved_at: '2026-10-18T10:46:17.864665Z'
|