159 lines
7.4 KiB
YAML
159 lines
7.4 KiB
YAML
id: CCR-2026-0061
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: 'nk-bind-executor-approval: consumer reader for sso/nk-bind-executor (oidc-service-client@0.2)'
|
|
status: applied
|
|
created: '2026-10-31'
|
|
updated: '2026-11-04'
|
|
requester:
|
|
agent: railiance-platform
|
|
reason: NK-WP-0056-T14 first case of SecurityCaseType oidc-service-client 0.2 (net-kingdom
|
|
9ce0d60, acknowledged 2026-11-01; hub decision f8044f81). The bounded executor
|
|
service:nk-bind-executor reads its approval-engine client secret natively per
|
|
call to file, read and consume its own approvals. Drafted by the platform owner
|
|
in its review (docs/credential-lane-designs/oidc-service-client-review.md, R2-R6).
|
|
Not approved.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
- net-kingdom-owner
|
|
comments:
|
|
- at: '2026-11-04T06:21:31+00:00'
|
|
reviewer: platform-owner
|
|
decision: approved
|
|
comment: 'Approved by the founder 2026-11-04: executor reader of the nk-bind-executor-approval
|
|
client secret, NK-WP-0056-T06.'
|
|
- at: '2026-11-04T06:21:40+00:00'
|
|
reviewer: net-kingdom-owner
|
|
decision: approved
|
|
comment: Approved by the founder 2026-11-04 for NK-WP-0056-T06.
|
|
- at: '2026-11-04T06:21:47+00:00'
|
|
reviewer: platform-owner
|
|
decision: binding_confirmed
|
|
comment: 'Binding confirmed: ServiceAccount nk-bind-executor in namespace sso
|
|
only (uid bd15569c-8a85-4625-b001-d9f799cb857b), audience openbao, from rapp-bounded-executor.'
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: net-kingdom-bind-executor
|
|
rapp: rapp-bounded-executor
|
|
environment: production
|
|
purpose: Let only the executor ServiceAccount sso/nk-bind-executor read the nk-bind-executor-approval
|
|
CLIENT_SECRET in memory for its client_credentials exchange; no write, metadata,
|
|
list, sibling path, Secret copy or other identity
|
|
admission:
|
|
standard: net-kingdom canon/standards/bounded-execution-admission_v0.1.md (proposed)
|
|
executor_identity: service:nk-bind-executor
|
|
note: The role does not evaluate the admission. It bounds what the ServiceAccount
|
|
can read to one client secret whose tokens carry approval:create/read/consume
|
|
at approval-engine.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/keycape/nk-bind-executor-approval
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor
|
|
policy_file: openbao/policies/workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: keycape-nk-bind-executor-approval-bounded-executor-workload-kv-read
|
|
audience: openbao
|
|
ttl: 15m
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
policies:
|
|
- workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor
|
|
bound_claims:
|
|
service_account_names:
|
|
- nk-bind-executor
|
|
service_account_namespaces:
|
|
- sso
|
|
bound_claims_confirmed: true
|
|
access_frontdoor:
|
|
type: platform-owner
|
|
catalog_id: bounded-executor-keycape-nk-bind-executor-approval
|
|
readiness: pending-review
|
|
resolvable: false
|
|
agent_fence:
|
|
data_and_metadata_denied: true
|
|
note: Coding agents are denied data and metadata of platform/workloads/keycape/nk-bind-executor-approval;
|
|
scripts/nk_bind_executor_custody.py fence adds and proves the deny before the
|
|
role is created.
|
|
lifecycle:
|
|
role_window: Standing, as CCR-2026-0059. The executor exchanges a fresh token per
|
|
call and keeps neither the secret nor a token beyond the call.
|
|
deactivate: Delete the role, then the policy. The custody entry and the ESO reader
|
|
stay under CCR-2026-0060 until the case rollback.
|
|
rotate: No rotation lane exists yet (RPF-WP-0055 residual). The reader needs no
|
|
change on rotation because the path stays the same.
|
|
compromised: Remove client nk-bind-executor-approval from KeyCape (register-client
|
|
rollback, attended), delete this role, then rotate attended. Approvals already
|
|
created by the client still need a human entry under human_control.
|
|
delivery:
|
|
surface: native-workload-login
|
|
namespace: sso
|
|
service_account: nk-bind-executor
|
|
reader: Executor runtime (net-kingdom bounded-executor/, deployed by rapp-bounded-executor);
|
|
logs in with its projected ServiceAccount token, audience openbao, separately
|
|
from the CCR-2026-0058 and CCR-2026-0059 roles; the value stays in memory and
|
|
never reaches a Secret, log or receipt
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- Reachable value is one confidential client secret; its tokens act as service:nk-bind-executor
|
|
at approval-engine (create approvals naming itself, read and consume approvals
|
|
of tenant:platform). Approvals still need a human entry under human_control.
|
|
- The role is separate from the CCR-2026-0058 write role, the CCR-2026-0059 journey
|
|
reader and the CCR-2026-0060 ESO reader; policies are never combined in one role.
|
|
- No Secret copy in namespace sso beyond KeyCape's own ESO target; other workloads
|
|
in sso without the ServiceAccount cannot log in.
|
|
- Node root, cluster admins able to mint tokens for sso/nk-bind-executor and platform-admin
|
|
remain inside this credential boundary.
|
|
verification:
|
|
positive:
|
|
- Exact policy and role read back; login as sso/nk-bind-executor (audience openbao)
|
|
gets only this policy with a lease of at most 15m
|
|
- The executor reports the claims of one client_credentials exchange per scope (sub
|
|
service:nk-bind-executor, aud approval-engine, tenant:platform, lifetime <= 15m),
|
|
value-free
|
|
negative:
|
|
- Write, metadata read, list, delete and sibling paths (including keycape/secrets-engine-openbao
|
|
and directory-binds) are refused
|
|
- Wrong ServiceAccount, wrong namespace and wrong audience logins are denied
|
|
- Coding-agent boundary denies data and metadata of the path
|
|
activation_conditions:
|
|
- oidc-service-client 0.2 acknowledged (done 2026-11-01) and case nk-bind-executor-approval
|
|
accepted.
|
|
- Custody entry minted (CCR-2026-0040 lane; broker admits oidc-service-client@0.2
|
|
since RPF-WP-0069-T08).
|
|
- Explicit platform-owner and net-kingdom-owner approval of this exact request.
|
|
- bound_claims_confirmed set to true by the platform-owner (ServiceAccount sso/nk-bind-executor
|
|
already exists, uid bd15569c, CCR-2026-0058/0059).
|
|
- Attended platform-admin (aal2) session or the delegated applier applies policy
|
|
and role from a reviewed commit; positive and negative results recorded in value-free
|
|
receipts.
|
|
evidence:
|
|
- at: '2026-11-04T22:09:46+00:00'
|
|
actor: founder
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as founder using local bao CLI ambient authority.
|
|
- 'Policy metadata write: sys/policies/acl/workload-kv-read-keycape-nk-bind-executor-approval-bounded-executor'
|
|
- 'Auth role metadata write: auth/kubernetes/role/keycape-nk-bind-executor-approval-bounded-executor-workload-kv-read'
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
security_case:
|
|
case: nk-bind-executor-approval
|
|
type: oidc-service-client@0.2
|
|
type_status: acknowledged
|
|
type_source: net-kingdom security-case-types/oidc-service-client/type.yaml (9ce0d60,
|
|
sha256:cd238693...)
|
|
type_acknowledgment: founder accepted informed-decision memo nk-wp-0056-t14-oidc-service-client-r2
|
|
on 2026-11-01 (hub decision f8044f81)
|
|
acceptance_record: pending
|