b6148da443
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 306568@bnt-lap001 Assistant-Session: 8bdf8150-ea56-41e7-9132-13f04f6b0b91
76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
# Standard lane profile for self-service CCR intake (RPF-WP-0061-T01).
|
|
#
|
|
# A CCR that satisfies every rule below receives the railiance-platform-owner
|
|
# review from `credential-change.py review-standard` without a platform worker
|
|
# session. Anything else is routed to the railiance-platform inbox. Changes to
|
|
# this file are platform-owner review changes: the profile digest is recorded
|
|
# in every review comment it produces.
|
|
#
|
|
# The profile never grants approval. Founder approval, confirm-binding against
|
|
# native state and the applier boundary are unchanged.
|
|
profile: ccr-standard-lane
|
|
version: 1
|
|
|
|
# Identities allowed to file CCRs with `credential-change.py submit`.
|
|
submitters:
|
|
- ops-mason
|
|
|
|
request_type: workload-kv-read
|
|
mount: platform
|
|
kv_path_patterns:
|
|
- '^platform/workloads/[a-z0-9][a-z0-9-]*/[a-z0-9][a-z0-9-]*(/[a-z0-9][a-z0-9-]*)?$'
|
|
- '^platform/suppliers/[a-z0-9][a-z0-9-]*/[a-z0-9][a-z0-9-]*$'
|
|
policy_name_prefix: workload-kv-read-
|
|
# The policy file must equal the generated HCL: data read, plus
|
|
# lookup-self/revoke-self when token_self_lifecycle is set.
|
|
metadata_read: false
|
|
token_capabilities_self: false
|
|
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role_prefix: external-secrets-
|
|
audience: openbao
|
|
max_ttl_seconds: 900
|
|
token_no_default_policy: true
|
|
service_accounts: 1
|
|
namespaces: 1
|
|
forbidden_namespaces:
|
|
- argocd
|
|
- cert-manager
|
|
- default
|
|
- external-secrets
|
|
- kube-public
|
|
- kube-system
|
|
- openbao
|
|
|
|
allowed_risk_classifications:
|
|
- low
|
|
- medium
|
|
|
|
# A second reader of an existing path is a platform judgement.
|
|
reader_conflict_statuses:
|
|
- draft
|
|
- in_flight
|
|
- proposed
|
|
- needs_changes
|
|
- approved
|
|
- apply_pending
|
|
- applied
|
|
- verified
|
|
- active
|
|
- rotated
|
|
|
|
# Calibration against all 51 CCRs on main at 2026-10-18 (version 1, status
|
|
# ignored): only CCR-2026-0051 passes. First failing rule for the others:
|
|
# metadata_read set ............ 0001-0004, 0006, 0010-0014, 0017-0020,
|
|
# 0023-0027, 0029-0031, 0035, 0044-0046
|
|
# non-standard role/policy name 0015, 0016, 0032, 0036, 0037, 0048, 0049
|
|
# audience not openbao ......... 0021, 0022, 0047
|
|
# central ESO SA namespace ..... 0033, 0041 (external-secrets/external-secrets)
|
|
# not kubernetes / not platform 0007-0009, 0034, 0042
|
|
# policy file drift ............ 0005
|
|
# risk high .................... 0050
|
|
# other request types .......... 0028, 0038-0040, 0043
|
|
# The profile is deliberately stricter than past practice: older shapes need a
|
|
# platform review instead of silently passing.
|