7bdf1996f0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
169 lines
8 KiB
YAML
169 lines
8 KiB
YAML
id: CCR-2026-0059
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: NetKingdom bounded executor reads the synthetic journey identity (syn-journey)
|
|
status: verified
|
|
created: '2026-10-31'
|
|
updated: '2026-10-31'
|
|
requester:
|
|
agent: claude-code
|
|
reason: 'NK-WP-0056-T10/T06: the bounded executor service:nk-bind-executor runs
|
|
the synthetic MFA journey (KeyCape, Authelia, privacyIDEA) as the check after
|
|
each consumer restart, with no person signing in. It needs the syn-journey password
|
|
and TOTP seed held under CCR-2026-0057. Lane design: railiance-platform docs/credential-lane-designs/bounded-executor.md
|
|
"Journey secrets (T10)". Drafted by net-kingdom; not approved.'
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
- net-kingdom-owner
|
|
comments:
|
|
- at: '2026-10-31T18:06:02+00:00'
|
|
reviewer: platform-owner
|
|
decision: approved
|
|
comment: 'Approved by the founder 2026-10-31: standing journey reader for NK-WP-0056-T10,
|
|
accepting the CCR-2026-0057 runtime_access widening.'
|
|
- at: '2026-10-31T18:06:12+00:00'
|
|
reviewer: net-kingdom-owner
|
|
decision: approved
|
|
comment: Approved by the founder 2026-10-31 for NK-WP-0056-T10/T06.
|
|
- at: '2026-10-31T18:38:23+00:00'
|
|
reviewer: platform-owner
|
|
decision: binding_confirmed
|
|
comment: 'Binding confirmed: ServiceAccount nk-bind-executor in namespace sso
|
|
only (uid bd15569c-8a85-4625-b001-d9f799cb857b), audience openbao, from rapp-bounded-executor.'
|
|
supersedes_boundary:
|
|
ccr: CCR-2026-0057
|
|
field: openbao.runtime_access
|
|
was: false
|
|
change: 'This request gives one workload reader to the path CCR-2026-0057 holds
|
|
with runtime_access: false. CCR-2026-0057''s attended setup, teardown and rotation
|
|
stay valid and unchanged; its rotate (teardown + setup) does not need this role.'
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: net-kingdom-bind-executor
|
|
rapp: rapp-bounded-executor
|
|
environment: production
|
|
purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the syn-journey
|
|
PASSWORD and TOTP_SEED to run the synthetic journey; no write, metadata, list,
|
|
sibling path, or other identity
|
|
admission:
|
|
standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
|
|
executor_identity: service:nk-bind-executor
|
|
example: net-kingdom examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml
|
|
note: The journey is a check step under an admission. The OpenBao role does not
|
|
evaluate the admission; it bounds what the ServiceAccount can read to one synthetic,
|
|
group-less identity.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/net-kingdom/synthetic-journey/syn-journey
|
|
fields:
|
|
- PASSWORD
|
|
- TOTP_SEED
|
|
policy_name: net-kingdom-bind-executor-syn-journey-read
|
|
policy_file: openbao/policies/net-kingdom-bind-executor-syn-journey-read.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: net-kingdom-bind-executor-syn-journey-read
|
|
audience: openbao
|
|
ttl: 15m
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
policies:
|
|
- net-kingdom-bind-executor-syn-journey-read
|
|
bound_claims:
|
|
service_account_names:
|
|
- nk-bind-executor
|
|
service_account_namespaces:
|
|
- sso
|
|
bound_claims_confirmed: true
|
|
access_frontdoor:
|
|
type: platform-owner
|
|
catalog_id: net-kingdom-bind-executor-syn-journey-read
|
|
readiness: pending-review
|
|
resolvable: false
|
|
agent_fence:
|
|
data_and_metadata_denied: true
|
|
note: The syn-journey data and metadata paths are denied to coding agents since
|
|
CCR-2026-0057; setup re-checks the deny before the role is created.
|
|
lifecycle:
|
|
role_window: Standing (founder decision 2026-10-31, net-kingdom session). Unlike
|
|
the CCR-2026-0058 write role, this role only reads a group-less synthetic identity,
|
|
and a standing reader lets the journey run as a scheduled check (T10) without
|
|
a platform-admin per run.
|
|
deactivate: Delete the role, then the policy. The KV entry, the LLDAP user and the
|
|
privacyIDEA token stay under CCR-2026-0057.
|
|
rotate: As in CCR-2026-0057 (lane.py teardown and setup); the reader needs no change,
|
|
because the path stays the same.
|
|
compromised: Delete the privacyIDEA token SYNJOURNEY01 first (the account then cannot
|
|
pass MFA), delete this role, then tear down and set up as in CCR-2026-0057. The
|
|
identity has no groups, so a leak grants a sign-in that reaches no protected service.
|
|
delivery:
|
|
surface: native-workload-login
|
|
namespace: sso
|
|
service_account: nk-bind-executor
|
|
reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
|
|
logs in with its projected ServiceAccount token, audience openbao, separately
|
|
from the CCR-2026-0058 write role; values stay in memory and never reach a Secret,
|
|
log or receipt
|
|
manifest: 'rapp-bounded-executor: manifests/rbac.yaml, templates/job.yaml'
|
|
risk:
|
|
classification: low
|
|
notes:
|
|
- Reachable value is one synthetic identity with no groups. Authelia and KeyCape
|
|
admit it, but no consuming service grants it anything (CCR-2026-0057 risk notes).
|
|
- A reader holding both values can complete an MFA sign-in as syn-journey, which
|
|
is the purpose. privacyIDEA refuses a reused TOTP time step, so a parallel use
|
|
and the journey can race; the journey then fails closed.
|
|
- The role is separate from the CCR-2026-0058 write role and from the ESO reader
|
|
(CCR-2026-0053); policies are never combined in one role.
|
|
- Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
|
|
remain inside this credential boundary.
|
|
verification:
|
|
positive:
|
|
- Exact policy and role read back; login as sso/nk-bind-executor (audience openbao)
|
|
gets only this policy with a lease of at most 15m
|
|
- The synthetic journey passes at aal2 with the values read through this role, with
|
|
a value-free receipt
|
|
negative:
|
|
- Write, metadata read, list, delete and sibling paths (including directory-binds)
|
|
are refused
|
|
- Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
|
|
- Coding-agent boundary denies data and metadata of the path
|
|
activation_conditions:
|
|
- Explicit platform-owner and net-kingdom-owner approval of this exact request,
|
|
which includes the change to CCR-2026-0057's runtime_access boundary.
|
|
- ServiceAccount sso/nk-bind-executor exists from the reviewed rapp-bounded-executor
|
|
package (bound_claims_confirmed then set to true by the platform-owner).
|
|
- Attended platform-admin (aal2) session applies the policy and role from a reviewed
|
|
commit.
|
|
- Positive and negative results recorded in value-free receipts.
|
|
evidence:
|
|
- at: '2026-10-31T18:48:55+00:00'
|
|
actor: founder (attended), claude-code guiding
|
|
kind: executor_lane_setup_and_proof
|
|
result: passed
|
|
details:
|
|
- '2026-10-31: policy and standing role applied by net-kingdom tools/service-binds/executor-lanes.py
|
|
setup (lanes_prepared); verify (lanes_verified): sso/nk-bind-executor audience
|
|
openbao gets exactly this policy, lease <=15m, reads only syn-journey data (fields
|
|
checked in memory), metadata/directory-binds/token-create denied, default SA,
|
|
wrong audience and write-role login denied, coding-agent fence effective. The
|
|
positive journey run through this role is the open part of NK-WP-0056-T10. Evidence:
|
|
net-kingdom docs/evidence/2026-10-31-nk56-t10-executor-lanes/ (ef6284c).'
|
|
- at: '2026-10-31T19:50:05+00:00'
|
|
actor: founder started the Job; no person in the journey
|
|
kind: executor_journey_live
|
|
result: passed
|
|
details:
|
|
- '2026-10-31: rapp-bounded-executor make journey, Job sso/bounded-executor-journey-20261031-194719
|
|
(image sha256:71da4a51), logged in as sso/nk-bind-executor with this role only
|
|
(openbao audience), read syn-journey and passed the synthetic journey at aal2
|
|
(pwd+otp, signature verified), effects false. Evidence: net-kingdom docs/evidence/2026-10-31-nk56-t10-journey-only/live-receipt.json
|
|
(a020758).'
|