1900e24f80
Record founder acceptance on CCR-2026-0036 and CCR-2026-0037, install the reader roles, and admit only the email-connect node delivery. Treat a missing OpenBao token period as non-periodic. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
163 lines
7.7 KiB
YAML
163 lines
7.7 KiB
YAML
{
|
|
"id": "CCR-2026-0036",
|
|
"kind": "credential-change-request",
|
|
"schema_version": 1,
|
|
"request_type": "workload-kv-read",
|
|
"title": "coulomb-social primary archive node-delivery reader",
|
|
"status": "applied",
|
|
"created": "2026-10-08",
|
|
"updated": "2026-10-08",
|
|
"requester": {
|
|
"agent": "codex",
|
|
"reason": "User asked to arrange platform credential delivery; preparation under RPF-WP-0053, no live grant inferred."
|
|
},
|
|
"review": {
|
|
"required": true,
|
|
"required_approvers": [
|
|
"platform-owner",
|
|
"coulomb-social-owner"
|
|
],
|
|
"comments": [
|
|
{
|
|
"at": "2026-10-08T12:40:00Z",
|
|
"reviewer": "User (platform-owner)",
|
|
"decision": "approved",
|
|
"comment": "Founder accepted this reader on 2026-10-08. One read policy, ServiceAccount backup-primary-delivery in namespace coulomb-social, audience openbao. Node delivery is not admitted.",
|
|
"source_ref": "founder-acceptance-2026-10-08"
|
|
},
|
|
{
|
|
"at": "2026-10-08T12:40:00Z",
|
|
"reviewer": "User (coulomb-social-owner)",
|
|
"decision": "approved",
|
|
"comment": "Founder accepted the coulomb-social reader record. Node delivery of its pair was not requested.",
|
|
"source_ref": "founder-acceptance-2026-10-08"
|
|
}
|
|
]
|
|
},
|
|
"target": {
|
|
"domain": "communication",
|
|
"tenant": "platform",
|
|
"workload": "coulomb-social",
|
|
"environment": "production",
|
|
"purpose": "Read this application backup publisher key pair into the admitted node delivery process; no other workload credential or escrow."
|
|
},
|
|
"openbao": {
|
|
"mount": "platform",
|
|
"kv_path": "platform/workloads/coulomb-social/backup-primary",
|
|
"fields": [
|
|
"AWS_ACCESS_KEY_ID",
|
|
"AWS_SECRET_ACCESS_KEY"
|
|
],
|
|
"policy_name": "workload-kv-read-coulomb-social-backup-primary",
|
|
"policy_file": "openbao/policies/workload-kv-read-coulomb-social-backup-primary.hcl",
|
|
"metadata_read": false,
|
|
"token_self_lifecycle": true,
|
|
"auth": {
|
|
"method": "kubernetes",
|
|
"mount": "kubernetes",
|
|
"role": "coulomb-social-backup-primary-workload-kv-read",
|
|
"audience": "openbao",
|
|
"ttl": "5m",
|
|
"token_max_ttl": "5m",
|
|
"token_explicit_max_ttl": "5m",
|
|
"token_no_default_policy": true,
|
|
"token_num_uses": 4,
|
|
"token_type": "service",
|
|
"policies": [
|
|
"workload-kv-read-coulomb-social-backup-primary"
|
|
],
|
|
"bound_claims": {
|
|
"service_account_names": [
|
|
"backup-primary-delivery"
|
|
],
|
|
"service_account_namespaces": [
|
|
"coulomb-social"
|
|
]
|
|
},
|
|
"bound_claims_confirmed": true
|
|
}
|
|
},
|
|
"access_frontdoor": {
|
|
"type": "platform-owner",
|
|
"catalog_id": "coulomb-social-backup-primary-delivery",
|
|
"readiness": "applied-pending-verify",
|
|
"resolvable": false
|
|
},
|
|
"delivery": {
|
|
"surface": "node-private-file",
|
|
"host": "railiance01",
|
|
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
|
"target": "/etc/coulomb-social-backup/primary.env",
|
|
"owner": "root:root",
|
|
"mode": "0600",
|
|
"directory_mode": "0700",
|
|
"procedure": "scripts/application_backup_credentials.py",
|
|
"admission": {
|
|
"node_executor_approved": false,
|
|
"provider_scope_verified": false,
|
|
"reader_boundary_verified": false,
|
|
"source_ref": null
|
|
}
|
|
},
|
|
"provider": {
|
|
"endpoint": "https://s3.nl-ams.scw.cloud",
|
|
"bucket": "railiance-platform-pg-backup",
|
|
"prefix": "platform-pg/application-archives/coulomb-social/",
|
|
"identity": "IAM application coulomb-social-backup-primary 681d00bf-b965-4323-b657-97bfde423511; key only in OpenBao; bucket policy limits the prefix and withholds object delete",
|
|
"retained_delete": false
|
|
},
|
|
"risk": {
|
|
"classification": "high",
|
|
"notes": [
|
|
"Admitted node root may request the dedicated ServiceAccount JWT; no RBAC grant or mounted token for this account. Namespace writers and node administrators are inside this credential boundary.",
|
|
"TokenRequest JWT and five-minute, four-use OpenBao token stay in process memory; only the provider pair is delivered at rest.",
|
|
"No worker receives IAM/bucket administration, native Barman access, sibling archive access or decryption identity.",
|
|
"Policy/role construction does not seed values or activate capture, timers, retention, deletion or a production restore."
|
|
]
|
|
},
|
|
"verification": {
|
|
"positive": [
|
|
"Exact namespace/ServiceAccount/audience authenticates with this one policy, no default/identity policy, five-minute maximum TTL and four-use bound.",
|
|
"One own-path KV read followed by self-revocation yields only these two fields at a positive pinned KV version.",
|
|
"Node delivery produces root-owned 0600 file in 0700 directory; contained readback equality and metadata-only receipt; no secrets in outputs/argv.",
|
|
"Provider caller conditional multipart publication and version-pinned readback within exact archive prefix work."
|
|
],
|
|
"negative": [
|
|
"Wrong namespace, ServiceAccount and audience cannot log in.",
|
|
"Sibling application data GET, parent LIST, metadata GET, any KV write and platform admin endpoints are denied.",
|
|
"Provider denies sibling/native prefixes, retained object/version deletion and IAM/bucket administration.",
|
|
"Draft/unconfirmed/source-changed contract, wrong cluster, symlinks, hard links, insecure modes, changed KV version, unconfirmed token revocation and different existing file refuse delivery."
|
|
],
|
|
"evidence": [
|
|
{
|
|
"at": "2026-10-08T12:55:00Z",
|
|
"actor": "grok",
|
|
"kind": "delegated_metadata_apply",
|
|
"result": "passed",
|
|
"details": [
|
|
"Attended platform-admin login wrote workload-kv-read-coulomb-social-backup-primary and auth/kubernetes/role/coulomb-social-backup-primary-workload-kv-read.",
|
|
"Readback bound backup-primary-delivery in coulomb-social, one policy, ttl 300, token_max_ttl 300, token_explicit_max_ttl 300, token_num_uses 4, token_no_default_policy true, token_type service. Node delivery remains unadmitted."
|
|
]
|
|
}
|
|
],
|
|
"activation_conditions": [
|
|
"Named owner reviews and confirmed native reader bindings, applied policy/role with live positive/negative evidence, provider prefix boundary proof and explicit node execution admission.",
|
|
"Separate platform-owned attended pair provision with initial KV CAS=0, no partial/second single-field PUT; retain only version metadata. Current reader does not create or rotate values.",
|
|
"Pin the final reviewed CCR SHA256 and expected KV version; initialise designated root directory only after admission. Initial delivery may resume identical bytes but cannot rotate.",
|
|
"Independent age escrow and metadata receipt custody, retention/lifecycle/capacity, first capture/recovery and timer activation remain separate RPF-WP-0053 gates."
|
|
]
|
|
},
|
|
"lifecycle": {
|
|
"deactivate": "Owner detaches this Kubernetes role first, revokes tokens, and removes only admitted local delivery through an explicit withdrawal record. Do not delete retained archives.",
|
|
"rotate": "Separate owner-approved CAS rotation and atomic host replacement contract required. This helper refuses different existing bytes; retain old provider identity until new publication/recovery acceptance, then revoke predecessor at provider.",
|
|
"compromised": "Fence this worker and disable its provider identity first. Owner revokes reader tokens, withdraws reader, rotates pair and reviews retained-object access under incident authority; no automated archive deletion."
|
|
},
|
|
"state_hub": {
|
|
"workplan_id": "RPF-WP-0053",
|
|
"task_id": "RPF-WP-0053-T02"
|
|
},
|
|
"related": {
|
|
"consumer_workplan": "CSOC-WP-0008",
|
|
"design": "docs/credential-lane-designs/application-backup-delivery-2026-10-08.md"
|
|
}
|
|
}
|