f3b0c4f4b2
- CCR-2026-0063: NetKingdom's answer recorded (ESO as drafted); delivery aligned to the Secret the rapp Job mounts (sso/bounded-executor-tokens, key audit-core); reader role in the CCR-2026-0033/0041/0060 shape (audience openbao, explicit max TTL, self-lifecycle); custody_procedure names audit-core's seeder (one seeder only). - CCR-2026-0060: delivery block (store rendered from the issuer template); fence step named. - manifests/nk-bind-executor-eso.yaml: two sso-restricted stores and ExternalSecrets. - scripts/nk_bind_executor_custody.py plan|fence|verify with synthetic-fixture tests. - Source coding-agent boundary carries the KeyCape nk-bind-executor-approval path. - docs/credential-lane-designs/nk-bind-executor-go-live.md: exact founder sequence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350
101 lines
3 KiB
YAML
101 lines
3 KiB
YAML
# Bounded executor credential delivery (NK-WP-0056-T06; RPF-WP-0069-T05/T09).
|
|
# Apply only after CCR-2026-0060 and CCR-2026-0063 are approved and applied and both custody
|
|
# entries exist (docs/credential-lane-designs/nk-bind-executor-go-live.md). No value is in this file.
|
|
#
|
|
# 1. KeyCape's copy of the nk-bind-executor-approval client secret (CCR-2026-0060), rendered from
|
|
# manifests/templates/keycape-issuer-eso.yaml for client_id nk-bind-executor-approval.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-keycape-nk-bind-executor-approval-issuer
|
|
annotations:
|
|
railiance.io/credential-change: CCR-2026-0060
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: http://openbao.openbao.svc:8200
|
|
path: platform
|
|
version: v2
|
|
auth:
|
|
kubernetes:
|
|
mountPath: kubernetes
|
|
role: external-secrets-keycape-nk-bind-executor-approval
|
|
serviceAccountRef:
|
|
name: external-secrets
|
|
namespace: external-secrets
|
|
audiences:
|
|
- openbao
|
|
conditions:
|
|
- namespaces:
|
|
- sso
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: keycape-nk-bind-executor-approval-client
|
|
namespace: sso
|
|
annotations:
|
|
railiance.io/credential-change: CCR-2026-0060
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-keycape-nk-bind-executor-approval-issuer
|
|
target:
|
|
name: keycape-nk-bind-executor-approval-client
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
- secretKey: client-secret
|
|
remoteRef:
|
|
key: workloads/keycape/nk-bind-executor-approval
|
|
property: CLIENT_SECRET
|
|
---
|
|
# 2. The executor's audit-core sender bearer (CCR-2026-0063). Secret name and key are the ones the
|
|
# rapp-bounded-executor run Job mounts (/var/run/secrets/bounded-executor/audit-core).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-nk-bind-executor-audit
|
|
annotations:
|
|
railiance.io/credential-change: CCR-2026-0063
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: http://openbao.openbao.svc:8200
|
|
path: platform
|
|
version: v2
|
|
auth:
|
|
kubernetes:
|
|
mountPath: kubernetes
|
|
role: external-secrets-nk-bind-executor-audit
|
|
serviceAccountRef:
|
|
name: external-secrets
|
|
namespace: external-secrets
|
|
audiences:
|
|
- openbao
|
|
conditions:
|
|
- namespaces:
|
|
- sso
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: bounded-executor-tokens
|
|
namespace: sso
|
|
annotations:
|
|
railiance.io/credential-change: CCR-2026-0063
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao-nk-bind-executor-audit
|
|
target:
|
|
name: bounded-executor-tokens
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
- secretKey: audit-core
|
|
remoteRef:
|
|
key: workloads/net-kingdom/bounded-executor/audit-sender
|
|
property: AUDIT_TOKEN
|