0f0282a436
credential-change.py generates sys/capabilities-self (update) when openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops calling sys/capabilities with a root token. The OpenBao login page keeps its platform-admin button and adds an allow-listed workload role choice. Repo only; nothing applied to OpenBao or the cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
24 lines
665 B
HCL
24 lines
665 B
HCL
# CCR-2026-0044 adds lookup-self and revoke-self for the dedicated caller.
|
|
# CCR-2026-0045 (NK-WP-0051-T06) adds capabilities-self so the caller proves
|
|
# its own reach without an operator or root token.
|
|
# Do not attach this policy to entity 4a1f663c-0621-0483-edd0-f852274f4b6b.
|
|
|
|
path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|
|
|
|
path "sys/capabilities-self" {
|
|
capabilities = ["update"]
|
|
}
|