ba445d7aed
The founder acknowledged oidc-service-client 0.2 on 2026-11-01 (memo r2, hub decision f8044f81, net-kingdom 9ce0d60), meeting the RPF-WP-0060-T01 rule from review R1. keycape_client_secret_generate.py pins the 0.2 type bytes, keys parameter pins by exact type reference, and derives confidentiality per type: browser 1.1 keeps its client_type check, the service type is confidential by construction (no client_type, unconditional custody path); a service case carrying client_type is refused. Create-only is unchanged. Eleven new tests; the existing browser tests are unchanged apart from the re-keyed pin. CCR-2026-0060/0061 match the 0.2 materialization; references updated, still proposed. T09 (wait) tracks their approval and apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
129 lines
6.3 KiB
YAML
129 lines
6.3 KiB
YAML
id: CCR-2026-0061
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: 'nk-bind-executor-approval: consumer reader for sso/nk-bind-executor (oidc-service-client@0.2)'
|
|
status: proposed
|
|
created: '2026-10-31'
|
|
updated: '2026-11-01'
|
|
requester:
|
|
agent: railiance-platform
|
|
reason: 'NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom
|
|
9ce0d60, acknowledged 2026-11-01; hub decision f8044f81). The bounded executor service:nk-bind-executor
|
|
reads its approval-engine client secret natively per call to file, read and consume its
|
|
own approvals. Drafted by the platform owner in its review
|
|
(docs/credential-lane-designs/oidc-service-client-review.md, R2-R6). Not approved.'
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
- net-kingdom-owner
|
|
comments: []
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: net-kingdom-bind-executor
|
|
rapp: rapp-bounded-executor
|
|
environment: production
|
|
purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the
|
|
nk-bind-executor-approval CLIENT_SECRET in memory for its client_credentials exchange;
|
|
no write, metadata, list, sibling path, Secret copy or other identity
|
|
admission:
|
|
standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
|
|
executor_identity: service:nk-bind-executor
|
|
note: The role does not evaluate the admission. It bounds what the ServiceAccount can read
|
|
to one client secret whose tokens carry approval:create/read/consume at approval-engine.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/nk-bind-executor-approval
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor
|
|
policy_file: openbao/policies/workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
# Type 0.2 template keycape-{client_id}-{consuming_service}-workload-kv-read (review R4):
|
|
# the delegated applier admits it.
|
|
role: keycape-nk-bind-executor-approval-bounded-executor-workload-kv-read
|
|
audience: openbao
|
|
ttl: 15m
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
policies:
|
|
- workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor
|
|
bound_claims:
|
|
service_account_names:
|
|
- nk-bind-executor
|
|
service_account_namespaces:
|
|
- sso
|
|
bound_claims_confirmed: false
|
|
access_frontdoor:
|
|
type: platform-owner
|
|
catalog_id: bounded-executor-keycape-nk-bind-executor-approval
|
|
readiness: pending-review
|
|
resolvable: false
|
|
agent_fence:
|
|
data_and_metadata_denied: true
|
|
note: Coding agents are denied data and metadata of platform/workloads/keycape/nk-bind-executor-approval;
|
|
setup checks the deny before the role is created.
|
|
lifecycle:
|
|
role_window: Standing, as CCR-2026-0059. The executor exchanges a fresh token per call and
|
|
keeps neither the secret nor a token beyond the call.
|
|
deactivate: Delete the role, then the policy. The custody entry and the ESO reader stay
|
|
under CCR-2026-0060 until the case rollback.
|
|
rotate: No rotation lane exists yet (RPF-WP-0055 residual). The reader needs no change on
|
|
rotation because the path stays the same.
|
|
compromised: Remove client nk-bind-executor-approval from KeyCape (register-client rollback,
|
|
attended), delete this role, then rotate attended. Approvals already created by the
|
|
client still need a human entry under human_control.
|
|
delivery:
|
|
surface: native-workload-login
|
|
namespace: sso
|
|
service_account: nk-bind-executor
|
|
reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
|
|
logs in with its projected ServiceAccount token, audience openbao, separately from the
|
|
CCR-2026-0058 and CCR-2026-0059 roles; the value stays in memory and never reaches a
|
|
Secret, log or receipt
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Reachable value is one confidential client secret; its tokens act as service:nk-bind-executor
|
|
at approval-engine (create approvals naming itself, read and consume approvals of
|
|
tenant:platform). Approvals still need a human entry under human_control.
|
|
- The role is separate from the CCR-2026-0058 write role, the CCR-2026-0059 journey reader
|
|
and the CCR-2026-0060 ESO reader; policies are never combined in one role.
|
|
- No Secret copy in namespace sso beyond KeyCape's own ESO target; other workloads in sso
|
|
without the ServiceAccount cannot log in.
|
|
- Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
|
|
remain inside this credential boundary.
|
|
verification:
|
|
positive:
|
|
- Exact policy and role read back; login as sso/nk-bind-executor (audience openbao) gets
|
|
only this policy with a lease of at most 15m
|
|
- The executor reports the claims of one client_credentials exchange per scope (sub
|
|
service:nk-bind-executor, aud approval-engine, tenant:platform, lifetime <= 15m), value-free
|
|
negative:
|
|
- Write, metadata read, list, delete and sibling paths (including keycape/secrets-engine-openbao
|
|
and directory-binds) are refused
|
|
- Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
|
|
- Coding-agent boundary denies data and metadata of the path
|
|
activation_conditions:
|
|
- oidc-service-client 0.2 acknowledged (done 2026-11-01) and case nk-bind-executor-approval accepted.
|
|
- Custody entry minted (CCR-2026-0040 lane; broker admits
|
|
oidc-service-client@0.2 since RPF-WP-0069-T08).
|
|
- Explicit platform-owner and net-kingdom-owner approval of this exact request.
|
|
- bound_claims_confirmed set to true by the platform-owner (ServiceAccount sso/nk-bind-executor
|
|
already exists, uid bd15569c, CCR-2026-0058/0059).
|
|
- Attended platform-admin (aal2) session or the delegated applier applies policy and role
|
|
from a reviewed commit; positive and negative results recorded in value-free receipts.
|
|
security_case:
|
|
case: nk-bind-executor-approval
|
|
type: oidc-service-client@0.2
|
|
type_status: acknowledged
|
|
type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60, sha256:cd238693...)
|
|
type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2 on 2026-11-01 (hub decision f8044f81)
|
|
acceptance_record: pending
|