180 lines
8.2 KiB
YAML
180 lines
8.2 KiB
YAML
id: CCR-2026-0034
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: KeyCape secrets-engine-openbao attended operator reader (in-memory, per command)
|
|
status: applied
|
|
created: '2026-10-06'
|
|
updated: '2026-10-07'
|
|
requester:
|
|
agent: railiance-platform
|
|
reason: Founder direction 2026-10-06 - the secrets-engine-openbao client secret
|
|
lives only in OpenBao; ops-mason plan keycape-secrets-engine-openbao-client-custody
|
|
(658cdbc, MASON-WP-0009) section 3.3. Sibling of CCR-2026-0033 (issuer ESO reader);
|
|
one auth role per CCR is this repo's convention (cf. CCR-2026-0019). Replaces
|
|
the superseded secrets-engine consumer file (SECRETS-WP-0012-T02 D1-D4).
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
- key-cape-owner
|
|
- net-kingdom-owner
|
|
comments:
|
|
- at: '2026-10-06'
|
|
reviewer: key-cape (owner packet, key-cape 7d96ee4)
|
|
decision: claim_shape_reported
|
|
comment: KeyCape reports the groups claim is always emitted, so groups_claim groups
|
|
bound to net-kingdom-admins works as in CCR-2026-0019. MFA is not pinned on
|
|
the openbao-admin client; it holds only through the provider default requireForAll.
|
|
KeyCape asks that the role also bind the assurance claim (/assurance/level =
|
|
aal2, issued only after a verified factor). This is an owner report, not an
|
|
approval and not the founder confirmation of bound claims.
|
|
- at: '2026-10-07'
|
|
reviewer: platform-owner (founder Bernd Worsch)
|
|
decision: approved
|
|
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
|
approves CCR-2026-0034 as platform-owner. Covers A2 for this operator OIDC reader
|
|
(groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the
|
|
role and policy needs its own go.
|
|
- at: '2026-10-07'
|
|
reviewer: key-cape-owner (founder Bernd Worsch)
|
|
decision: approved
|
|
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
|
approves CCR-2026-0034 as key-cape-owner. Covers A2 for this operator OIDC reader
|
|
(groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying the
|
|
role and policy needs its own go.
|
|
- at: '2026-10-07'
|
|
reviewer: net-kingdom-owner (founder Bernd Worsch)
|
|
decision: approved
|
|
comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
|
|
approves CCR-2026-0034 as net-kingdom-owner. Covers A2 for this operator OIDC
|
|
reader (groups=net-kingdom-admins and /assurance/level=aal2 confirmed). Applying
|
|
the role and policy needs its own go.
|
|
- at: '2026-10-07'
|
|
reviewer: platform-owner, key-cape-owner, net-kingdom-owner (founder Bernd Worsch)
|
|
decision: approved
|
|
comment: Founder decision 73fff3d3-49fd-4535-9040-b2754a3e2024 approves removing
|
|
the retired bao.coulomb.social OIDC callback from allowed_redirect_uris and
|
|
one delegated re-apply. Nothing else changes.
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: keycape
|
|
environment: production
|
|
purpose: Let a net-kingdom-admins operator running secrets-engine read CLIENT_SECRET
|
|
into process memory once per command, revoke the token, and present it to KeyCape;
|
|
no copy at rest anywhere.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/secrets-engine-openbao
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-secrets-engine-openbao-operator
|
|
policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-operator.hcl
|
|
metadata_read: false
|
|
token_revoke_self: true
|
|
auth:
|
|
method: oidc
|
|
mount: netkingdom
|
|
role: keycape-secrets-engine-openbao-operator-workload-kv-read
|
|
allowed_redirect_uris:
|
|
- http://localhost:8250/oidc/callback
|
|
- http://127.0.0.1:8250/oidc/callback
|
|
oidc_scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
user_claim: sub
|
|
groups_claim: groups
|
|
bound_claims_type: string
|
|
bound_claims:
|
|
groups:
|
|
- net-kingdom-admins
|
|
/assurance/level: aal2
|
|
bound_claims_confirmed: true
|
|
policies:
|
|
- workload-kv-read-keycape-secrets-engine-openbao-operator
|
|
ttl: 5m
|
|
token_max_ttl: 5m
|
|
token_explicit_max_ttl: 5m
|
|
token_no_default_policy: true
|
|
token_num_uses: 4
|
|
token_type: service
|
|
founder_confirmation_items:
|
|
- bound_claims_confirmed stays false until the founder confirms BOTH readers' bindings
|
|
(this role's groups=net-kingdom-admins plus /assurance/level=aal2, and CCR-2026-0033's
|
|
external-secrets/external-secrets ServiceAccount). An unconfirmed binding blocks
|
|
the applier (applier-dry-run refuses).
|
|
- The aal2 binding is the only MFA guarantee on this lane; the openbao-admin client
|
|
itself does not pin MFA (KeyCape 7d96ee4).
|
|
access_frontdoor:
|
|
type: ops-warden
|
|
catalog_id: keycape-secrets-engine-openbao-operator
|
|
readiness: pending-review
|
|
resolvable: false
|
|
delivery:
|
|
surface: operator-process-memory
|
|
target: secrets-engine --auth service-jwt, profile using the KeyCape secrets-engine-openbao
|
|
client; OIDC login without a token helper, one KV GET, revoke-self, value in memory
|
|
only. No file, tmpfs, env var, argv, keyring or cache.
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Presenting copy of the secrets-engine-openbao client; the holder can mint 15-minute
|
|
service JWTs and use the separately reviewed secrets-engine-openbao JWT role.
|
|
- Strictly narrower than what net-kingdom-admins members already hold; widens nothing.
|
|
- 'Acyclic: the bootstrap is a human MFA login (aal2), never the service JWT this
|
|
lane serves. Invariants: no auth/jwt role grants this path; the secrets-engine-openbao
|
|
JWT policy has no capability on it; the ESO reader (CCR-2026-0033) stays on kubernetes
|
|
auth.'
|
|
verification:
|
|
positive:
|
|
- Operator token from this role has read on platform/data/workloads/keycape/secrets-engine-openbao
|
|
and update on auth/token/revoke-self (sys/capabilities-self, value-free).
|
|
- A secrets-engine service-jwt run reads in memory, logs in, and both revoke-self
|
|
calls succeed; evidence is provider name, accessor fingerprints and revoke results.
|
|
negative:
|
|
- deny on the metadata path, the parent LIST, sibling platform/data/workloads/keycape/*
|
|
and any write.
|
|
- A non-member identity, or a member without aal2, cannot obtain the role.
|
|
- No auth/jwt role and not policy secrets-engine-login-self has any capability on
|
|
this path.
|
|
- A file source is refused for this secrets-engine profile.
|
|
activation_conditions:
|
|
- Founder approvals A1 (ops-mason design), A2 (this CCR and CCR-2026-0033 with three
|
|
reviews and bound_claims_confirmed true) and a completed CCR-2026-0033 custody
|
|
run (A3).
|
|
evidence:
|
|
- at: '2026-10-07T00:03:24+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator'
|
|
- 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read'
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
- at: '2026-10-07T13:10:47+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-operator'
|
|
- 'Auth role metadata write: auth/netkingdom/role/keycape-secrets-engine-openbao-operator-workload-kv-read'
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
lifecycle:
|
|
deactivate: Delete the OIDC role first, then the policy; value-free receipt.
|
|
rotate: Not applicable to the reader; the value rotates through the CCR-2026-0033
|
|
custody child (roll-forward, cas=<current>).
|
|
compromised: KeyCape/NetKingdom disable the registration first; platform detaches
|
|
this role's policy and rotates via the custody child; tokens are 5m/4-use and
|
|
self-revoked.
|
|
state_hub:
|
|
workplan_id: RPF-WP-0035
|
|
task_id: RPF-WP-0035-T09
|
|
related_workplan: KEY-WP-0037
|
|
related:
|
|
sibling_ccr: CCR-2026-0033
|
|
design: ops-mason plans/keycape-secrets-engine-openbao-client-custody.md (658cdbc)
|