ba445d7aed
The founder acknowledged oidc-service-client 0.2 on 2026-11-01 (memo r2, hub decision f8044f81, net-kingdom 9ce0d60), meeting the RPF-WP-0060-T01 rule from review R1. keycape_client_secret_generate.py pins the 0.2 type bytes, keys parameter pins by exact type reference, and derives confidentiality per type: browser 1.1 keeps its client_type check, the service type is confidential by construction (no client_type, unconditional custody path); a service case carrying client_type is refused. Create-only is unchanged. Eleven new tests; the existing browser tests are unchanged apart from the re-keyed pin. CCR-2026-0060/0061 match the 0.2 materialization; references updated, still proposed. T09 (wait) tracks their approval and apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
99 lines
4.3 KiB
YAML
99 lines
4.3 KiB
YAML
id: CCR-2026-0060
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: 'nk-bind-executor-approval: keycape-reader-policy and eso-role (oidc-service-client@0.2)'
|
|
status: proposed
|
|
created: '2026-10-31'
|
|
updated: '2026-11-01'
|
|
requester:
|
|
agent: railiance-platform
|
|
reason: 'NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom
|
|
9ce0d60, acknowledged 2026-11-01; hub decision f8044f81; memo nk-wp-0056-t14-oidc-service-client-r2).
|
|
Drafted by the platform owner in its review (docs/credential-lane-designs/oidc-service-client-review.md,
|
|
R6). KeyCape reads the client secret of nk-bind-executor-approval only through ESO, as
|
|
CCR-2026-0041 for the browser type. Not approved.'
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
comments: []
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: keycape
|
|
environment: production
|
|
purpose: KeyCape reads the nk-bind-executor-approval client secret only through ESO. No metadata,
|
|
list, parent or sibling access.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/nk-bind-executor-approval
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-nk-bind-executor-approval-eso
|
|
policy_file: openbao/policies/workload-kv-read-keycape-nk-bind-executor-approval-eso.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-keycape-nk-bind-executor-approval
|
|
audience: openbao
|
|
ttl: 15m
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
policies:
|
|
- workload-kv-read-keycape-nk-bind-executor-approval-eso
|
|
bound_claims:
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
bound_claims_confirmed: false
|
|
access_frontdoor:
|
|
type: external-secrets
|
|
catalog_id: bounded-executor-keycape-nk-bind-executor-approval
|
|
readiness: pending-review
|
|
resolvable: false
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Rendered from the acknowledged SecurityCaseType oidc-service-client 0.2 (names and bodies
|
|
checked against its materialization 2026-11-01); the case is not yet accepted.
|
|
- Exact read on one KV path; no metadata, list, parent or sibling access.
|
|
- The value lets its holder obtain approval-engine tokens as service:nk-bind-executor
|
|
(approval:create/read/consume, tenant:platform).
|
|
- Only ExternalSecrets in namespace sso may use the store; sso namespace writers are
|
|
within this boundary (as CCR-2026-0033/0041).
|
|
verification:
|
|
positive:
|
|
- policy workload-kv-read-keycape-nk-bind-executor-approval-eso grants read on
|
|
platform/data/workloads/keycape/nk-bind-executor-approval only (capabilities check)
|
|
- ExternalSecret sso/keycape-nk-bind-executor-approval-client reports Ready=True (status
|
|
only)
|
|
negative:
|
|
- a default-only identity has no read capability on the path
|
|
- sibling GET, parent LIST and metadata read are denied
|
|
- wrong ServiceAccount and wrong audience logins are denied
|
|
activation_conditions:
|
|
- oidc-service-client 0.2 acknowledged by the founder (done 2026-11-01, memo r2, hub decision
|
|
f8044f81).
|
|
- SecurityCase nk-bind-executor-approval accepted by owner and founder.
|
|
- Custody entry minted at version 1 by keycape-client-secret-generate, by the broker, which admits
|
|
oidc-service-client@0.2 since RPF-WP-0069-T08.
|
|
- platform-owner approval of this exact request and bound_claims_confirmed set to true.
|
|
lifecycle:
|
|
deactivate: delete ExternalSecret sso/keycape-nk-bind-executor-approval-client, then role
|
|
external-secrets-keycape-nk-bind-executor-approval, then the policy (case rollback)
|
|
rotate: no rotation lane exists yet (RPF-WP-0055 residual); until then a rotation is an
|
|
attended platform-admin write with CAS=current, an ESO refresh and a KeyCape restart
|
|
compromised: owner incident process; delete the role first; no automatic read, reseed or
|
|
cleanup
|
|
security_case:
|
|
case: nk-bind-executor-approval
|
|
type: oidc-service-client@0.2
|
|
type_status: acknowledged
|
|
type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, sha256:cd238693...)
|
|
type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 on 2026-11-01 (hub decision f8044f81)
|
|
acceptance_record: pending
|