railiance-platform/credential-change-requests/CCR-2026-0033.yaml

id: CCR-2026-0033
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: KeyCape secrets-engine-openbao issuer workload reader and authoritative custody
status: applied
created: '2026-10-04'
updated: '2026-10-07'
requester:
  agent: key-cape
  reason: 'KEY-WP-0037-T02 owner packet; issuer-side read of the authoritative secrets-engine-openbao
    client secret. Revised 2026-10-06 per founder direction (the secret lives only
    in OpenBao) and ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc,
    MASON-WP-0009): consumer file and secrets-engine D1-D4 removed.'
review:
  required: true
  required_approvers:
  - platform-owner
  - key-cape-owner
  - net-kingdom-owner
  comments:
  - at: '2026-10-07'
    reviewer: platform-owner (founder Bernd Worsch)
    decision: approved
    comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
      approves CCR-2026-0033 as platform-owner. Covers A1 (ops-mason design 658cdbc),
      A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed)
      and A3 (exactly one attended custody-child provision run, cas=0, KV version
      1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the
      KeyCape registration, the restart or any rotation.
  - at: '2026-10-07'
    reviewer: key-cape-owner (founder Bernd Worsch)
    decision: approved
    comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
      approves CCR-2026-0033 as key-cape-owner. Covers A1 (ops-mason design 658cdbc),
      A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed)
      and A3 (exactly one attended custody-child provision run, cas=0, KV version
      1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the
      KeyCape registration, the restart or any rotation.
  - at: '2026-10-07'
    reviewer: net-kingdom-owner (founder Bernd Worsch)
    decision: approved
    comment: Founder decision 2ab717e1-7881-491e-aed4-28946550c289 (resolved 2026-10-06)
      approves CCR-2026-0033 as net-kingdom-owner. Covers A1 (ops-mason design 658cdbc),
      A2 (this CCR and CCR-2026-0034 at 4a284f0, bound claims of both readers confirmed)
      and A3 (exactly one attended custody-child provision run, cas=0, KV version
      1). Does not approve the policy/role/ESO apply, the NetKingdom env patch, the
      KeyCape registration, the restart or any rotation.
  - at: '2026-10-07'
    reviewer: platform-owner, key-cape-owner, net-kingdom-owner (founder Bernd Worsch)
    decision: approved
    comment: Founder decision 1fdd993b-8899-4f87-8a8e-636346bb9692 approves the token_self_lifecycle
      amendment (lookup-self and revoke-self on the ESO reader's own token) and one
      delegated re-apply of this CCR's policy and role. Nothing else changes.
target:
  domain: infotech
  tenant: platform
  workload: keycape
  environment: production
  purpose: Hold the secrets-engine-openbao client secret authoritatively in platform
    KV and deliver it to the KeyCape issuer through sso-only ESO
openbao:
  mount: platform
  kv_path: platform/workloads/keycape/secrets-engine-openbao
  fields:
  - CLIENT_SECRET
  policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
  policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
  metadata_read: false
  token_self_lifecycle: true
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-keycape-secrets-engine-openbao
    audience: openbao
    ttl: 15m
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
    policies:
    - workload-kv-read-keycape-secrets-engine-openbao-eso
    bound_claims:
      service_account_names:
      - external-secrets
      service_account_namespaces:
      - external-secrets
    bound_claims_confirmed: true
  kv_metadata:
    cas_required: true
    max_versions: 2
    delete_version_after: 0s
    custom_metadata:
      owner: railiance-platform
      client_id: secrets-engine-openbao
      issuer: keycape
      readers: eso-sso-issuer,oidc-secrets-engine-operator
      ccr: CCR-2026-0033
      plan: ops-mason/keycape-secrets-engine-openbao-client-custody
      classification: high
      rotation: event-driven+90d
access_frontdoor:
  type: external-secrets
  catalog_id: keycape-secrets-engine-openbao-eso
  readiness: pending-review
  resolvable: false
risk:
  classification: high
  notes:
  - Reads the whole path holding the secrets-engine-openbao confidential value
  - Only ExternalSecrets in namespace sso may use the store; sso namespace writers
    are within this boundary
  - 'One value, two copies: KV (authoritative) and the sso Secret (issuer delivery).
    The consumer holds no copy at rest; it reads in memory through CCR-2026-0034.'
  - 'Must stay on kubernetes auth: a KeyCape-issued identity would make KeyCape startup
    depend on KeyCape.'
verification:
  positive:
  - Owner-reviewed native exact identity and exact path proof required
  negative:
  - Owner-reviewed wrong identity, sibling GET and parent LIST denials required
  - Metadata shows cas_required=true, max_versions=2 and the declared custom_metadata
    (value-free).
  activation_conditions:
  - Exact CCR approval, confirmed identity, attended custody and native receipt acceptance
    required
  evidence:
  - at: '2026-10-07T00:03:08+00:00'
    actor: founder
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso'
    - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao'
    - No secret values were read, written, printed, or accepted in argv.
  - at: '2026-10-07T00:10:09+00:00'
    actor: founder
    kind: delegated_metadata_apply
    result: passed
    details:
    - Delegated metadata applier ran as founder using local bao CLI ambient authority.
    - 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-secrets-engine-openbao-eso'
    - 'Auth role metadata write: auth/kubernetes/role/external-secrets-keycape-secrets-engine-openbao'
    - No secret values were read, written, printed, or accepted in argv.
lifecycle:
  deactivate: Owner-reviewed delivery withdrawal and token revocation; exact rollback
    receipt required
  rotate: 'Roll-forward only: custody child writes a new version with cas=<current>
    under a standing rotation approval for this CCR (event-driven + 90d); never a
    read or restore of an old version'
  compromised: Owner incident process; no automatic read, reseed or cleanup
scaffold:
  draft_only: true
  consumer_repo: key-cape
  owner_repo: railiance-platform
  request_sha256: ade2e10b0f65341051b955900c68931bdd56fd3a81bf452ae81229cc2390ad63
  catalog_request_sha256: null
state_hub:
  workplan_id: RPF-WP-0035
  task_id: RPF-WP-0035-T02
  related_workplan: KEY-WP-0037
delivery:
  surface: external-secrets
  target: sso/keycape-secrets-engine-openbao-client key client-secret; issuer-side
    delivery only
  review_bundle: docs/provisioning-windows/2026-10-04-1000/keycape
  consumer_delivery: none at rest; attended operator OIDC reader CCR-2026-0034 reads
    into secrets-engine process memory per command
boundary_decision:
  id: 632a8893-0d6a-4591-a50b-40bbdb798f32
  approves: custody boundary only (platform authoritative KV and least-privilege issuer
    delivery; secrets-engine-owned mode-0600 consumer file outside every worktree)
  does_not_approve: generation, KV write, fetch, delivery, registration or deployment
  note: 'The design narrows this boundary: the secrets-engine consumer file it approved
    is withdrawn (founder direction 2026-10-06).'
path_correction: 'Candidate path platform/services/keycape/secrets-engine-openbao
  from the KeyCape packet is outside the platform-mount applier scope (WARDEN-WP-0028:
  platform/workloads/ only). Corrected to platform/workloads/keycape/secrets-engine-openbao,
  same field CLIENT_SECRET. The issuer binds to the sso Secret; the operator reader
  (CCR-2026-0034) reads the exact data path.'
custody_child:
  script: scripts/keycape_secrets_engine_openbao_custody.py
  tests: tests/test_keycape_secrets_engine_openbao_custody.py
  status: source-only; never executed
  requires:
  - --approval-decision <A3-decision-id>; refused when absent, malformed, equal to
    the boundary decision, or not recorded in an approved review comment of this CCR
  - this CCR and sibling CCR-2026-0034 approved with platform-owner, key-cape-owner
    and net-kingdom-owner approvals and bound_claims_confirmed true
  - attended warden platform-admin envelope; no BAO_TOKEN/VAULT_TOKEN in environment
  - umask 077, shell tracing off
  - --rotate for any run after the first (cas=<observed current version>); without
    it an existing entry is refused
  generation: one secrets.token_urlsafe(48) value in process memory (64 chars); never
    in argv, environment, stdout, stderr, logs, Git or the hub
  authoritative_write: KV-v2 write with options.cas=0 (absent) or cas=<observed current
    version> (rotation, --rotate); value only in process memory and the bao stdin/HTTP
    body; metadata-only preflight
  receipt: O_EXCL 0600 JSON with booleans, KV version, request id, CAS, metadata applied/unchanged,
    CCR/decision ids and CCR digest only
  failure_cleanup: nothing to clean locally; a written KV version is retained and
    recorded; recovery is a fresh roll-forward run with --rotate (cas=<current>),
    never a KV read
  metadata_write: kv metadata put of openbao.kv_metadata, compared before write against
    a metadata-only read; skipped when equal
rotation_revocation:
  generation_and_authoritative_version: railiance-platform custody child, version-guarded,
    roll-forward
  issuer_pickup: 'key-cape / net-kingdom: ESO refresh then KeyCape restart immediately
    (exchanges fail closed 401 between KV write and restart)'
  consumer_pickup: 'automatic: the next secrets-engine command reads the latest version
    in memory (CCR-2026-0034)'
  disable_on_compromise: key-cape / net-kingdom remove registration first; platform
    rotates and detaches the CCR-2026-0034 role policy
  retire_versions: railiance-platform per separate destroy approval
live_order:
- 0 founder approvals A1 design, A2 this CCR + CCR-2026-0034 (three reviews, bound
  claims confirmed for both readers), A3 custody-child decision id
- 1 attended custody child (this repo) writes KV v1 and metadata; non-secret receipt
- 2 platform applies policies/roles (this CCR and CCR-2026-0034) and the sso-only
  ClusterSecretStore + ExternalSecret; Secret sso/keycape-secrets-engine-openbao-client
  exists (metadata receipt only)
- 3 net-kingdom env patch secrets-engine-openbao-client.proposed.patch.yaml (NK-WP-0046)
- 4 KeyCape registration merge (KEY-WP-0037-T03)
- 5 KeyCape restart immediately after step 4
- 6 KeyCape live issuance check (KEY-WP-0037-T04)
- 7 platform OpenBao JWT role/policy secrets-engine-openbao and login proof (RPF-WP-0035-T02)
rollback:
  before_step_3: delete the CCR-2026-0034 OIDC role, then its policy; delete ExternalSecret
    (uid precondition), then the ESO role/policy; KV entry retained pending separate
    destroy approval
  after_step_3: net-kingdom rollout helper restores prior config/Deployment first,
    then the before_step_3 sequence
  cleanup_receipts: native, value-free, per step owner; a failed cleanup is recorded
    as open evidence
founder_confirmation_items:
- 'bound_claims_confirmed stays false until the founder confirms BOTH readers: this
  CCR (kubernetes, external-secrets/external-secrets, audience openbao) and sibling
  CCR-2026-0034 (OIDC, groups=net-kingdom-admins and /assurance/level=aal2).'
- 'Approvals: A1 ops-mason design; A2 this CCR plus CCR-2026-0034 with platform-owner,
  key-cape-owner and net-kingdom-owner reviews; A3 the exact custody-child decision
  id (must differ from boundary decision 632a8893-0d6a-4591-a50b-40bbdb798f32).'
runbook: docs/provisioning-windows/2026-10-04-1000/keycape/founder-runbook.md
related:
  sibling_ccr: CCR-2026-0034
  design: ops-mason plans/keycape-secrets-engine-openbao-client-custody.md (658cdbc)