bbff2bfb93
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
174 lines
8.9 KiB
YAML
174 lines
8.9 KiB
YAML
id: CCR-2026-0019
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: secrets-engine client-side read of its approval client secret
|
|
status: applied
|
|
created: '2026-09-09'
|
|
updated: '2026-09-13'
|
|
requester:
|
|
agent: claude
|
|
reason: RPF-WP-0035-T06 residual from the completed verifier custody (CCR-2026-0017).
|
|
The verifier copy lets KeyCape authenticate the secrets-engine-approval client;
|
|
it does not let secrets-engine present that client. secrets-engine implemented
|
|
the consumer on 2026-09-09 (SECRETS-WP-0009-T03, repo revision 9eb07fd, secrets-engine/docs/approval-service-auth.md)
|
|
and reads the value from SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE, an explicit
|
|
protected file. This request establishes the separate exact read that fills that
|
|
file. It reuses the existing version-1 custody and requests no reseed and no rotation.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
- secrets-engine-owner
|
|
comments:
|
|
- at: '2026-09-09'
|
|
reviewer: railiance-platform (claude)
|
|
decision: shape_determined_actor_pending
|
|
comment: 'Reader shape determined from owner source rather than assumed: the consumer
|
|
is an operator-run CLI that exchanges the client secret for a short-lived token
|
|
immediately before each approval request, holds it only in memory, and has no
|
|
refresh token, renewal or fallback identity. That makes this an attended operator-workstation
|
|
lane on the OIDC mount, not an External Secrets lane. The named operator group
|
|
claim is the one input neither this repo nor secrets-engine can supply; NetKingdom/KeyCape
|
|
own it.'
|
|
- at: '2026-09-10'
|
|
reviewer: codex (consumer source review)
|
|
decision: consumer_procedure_documented
|
|
comment: 'Secrets Engine source 98d72ceb1dbcff2d2a80fb8c3058d76777a0ac93, docs/approval-service-auth.md,
|
|
supplies the requested workstation procedure: operator-owned 0700 runtime session
|
|
directory outside Git, new 0600 file, path-only configuration across one claim/consume
|
|
operation, EXIT/INT/TERM cleanup, and explicit residual-file handling after
|
|
a hard interruption. The consumer checks file permissions/location/non-emptiness;
|
|
creation, parent custody and removal remain attended responsibilities. No automatic
|
|
cleanup or live read proof is claimed. This documents the consumer return; it
|
|
is not platform-operator/secrets-engine-owner approval, group confirmation or
|
|
authority to apply the role. Existing activation conditions and in_flight status
|
|
remain.'
|
|
- at: '2026-09-14'
|
|
reviewer: operator (user confirmation in Codex session)
|
|
decision: approved
|
|
comment: The operator explicitly selected net-kingdom-admins and instructed Codex
|
|
to bind the approval-client reader to it. This authorizes the exact CCR-2026-0019
|
|
policy and OIDC role apply through attended platform-admin authentication. The
|
|
existing group is documented in the platform's live-inspected OpenBao binding.
|
|
Consumer file custody was reviewed above. This is the operator's instruction,
|
|
not a fabricated separate owner vote or approval-engine human decision. Live
|
|
delivery verification remains pending and the credential front door remains
|
|
non-resolvable.
|
|
target:
|
|
domain: financials
|
|
tenant: platform
|
|
workload: secrets-engine
|
|
environment: production
|
|
purpose: Let the authorized operator running the secrets-engine approval CLI fetch
|
|
the secrets-engine-approval client secret into a protected file, without granting
|
|
any in-cluster reader, any sibling path, or any write on the custody path.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/secrets-engine/approval-client
|
|
fields:
|
|
- CLIENT_SECRET
|
|
policy_name: workload-kv-read-secrets-engine-approval-client
|
|
policy_file: openbao/policies/workload-kv-read-secrets-engine-approval-client.hcl
|
|
auth:
|
|
method: oidc
|
|
mount: netkingdom
|
|
role: secrets-engine-approval-client-workload-kv-read
|
|
allowed_redirect_uris:
|
|
- https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
|
|
- http://localhost:8250/oidc/callback
|
|
- http://127.0.0.1:8250/oidc/callback
|
|
oidc_scopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
user_claim: sub
|
|
groups_claim: groups
|
|
bound_claims:
|
|
groups:
|
|
- net-kingdom-admins
|
|
bound_claims_confirmed: true
|
|
policies:
|
|
- workload-kv-read-secrets-engine-approval-client
|
|
ttl: 15m
|
|
access_frontdoor:
|
|
type: ops-warden
|
|
catalog_id: secrets-engine-approval-client
|
|
selector: secrets-engine approval client secret
|
|
command: warden access secrets-engine-approval-client --out FILE
|
|
resolvable: false
|
|
readiness: pending-review
|
|
delivery:
|
|
surface: operator-workstation
|
|
target: 'Protected file consumed as SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE by
|
|
the secrets-engine approval CLI: owner-only mode, outside any Git work tree, removed
|
|
at the end of the session. No Kubernetes Secret, no ExternalSecret and no reuse
|
|
of the sso verifier Secret keycape-secrets-engine-approval-client.'
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- This is the presenting copy. Anyone holding it can obtain tokens as service:secrets-engine
|
|
for approval:read and approval:consume until KeyCape disables the registration.
|
|
The verifier copy admitted in CCR-2026-0017 does not carry that power; the two
|
|
must not be conflated because they hold the same value.
|
|
- A file-delivered credential outlives the process that read it. The lane depends
|
|
on operator hygiene for removal, which is weaker than an ESO-delivered Secret
|
|
bounded by a pod lifetime. That is a consequence of the consumer being a workstation
|
|
CLI and is recorded rather than engineered away.
|
|
- approval:consume is a production-effect scope. This lane grants the ability to
|
|
present the client; it does not grant approval decisions, which remain with access-engine,
|
|
approval-engine and the existing consume gates.
|
|
- No reseed and no rotation. Custody is the existing version 1 from the verifier
|
|
activation; a rotation is a distinct version-guarded operation that also invalidates
|
|
the KeyCape verifier copy and needs both owners.
|
|
verification:
|
|
positive:
|
|
- The bound operator identity reads CLIENT_SECRET from the exact path into a protected
|
|
file with no value in chat, argv, shell history or logs.
|
|
- The secrets-engine approval CLI exchanges it for a token with subject service:secrets-engine,
|
|
audience approval-engine, tenant tenant:platform and the single requested scope,
|
|
verified against live JWKS.
|
|
negative:
|
|
- An identity outside the confirmed group claim cannot authenticate through role
|
|
secrets-engine-approval-client-workload-kv-read.
|
|
- The role cannot read the approval-engine operator-client path, cannot list any
|
|
parent, and cannot write or patch the custody path.
|
|
- No in-cluster ServiceAccount, including secrets-engine/secrets-engine, gains a
|
|
read through this lane.
|
|
- The KeyCape verifier role cannot be substituted for this reader, and this reader
|
|
cannot read the verifier's delivery Secret.
|
|
activation_conditions:
|
|
- NetKingdom/KeyCape confirm the exact group claim for the authorized operator and
|
|
it is recorded in openbao.auth.bound_claims with bound_claims_confirmed true.
|
|
- secrets-engine confirms the workstation procedure, file mode and removal step
|
|
for SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE.
|
|
- Policy and OIDC role applied under attended authority (openbao-platform-admin-login,
|
|
founder_required) with metadata-only receipts.
|
|
- Positive and negative results recorded with non-secret request ids.
|
|
evidence:
|
|
- at: '2026-09-13T23:27:23+00:00'
|
|
actor: operator via attended Warden platform-admin OIDC
|
|
kind: delegated_metadata_apply
|
|
result: passed
|
|
details:
|
|
- Delegated metadata applier ran as operator via attended Warden platform-admin
|
|
OIDC using local bao CLI ambient authority.
|
|
- 'Policy metadata write: sys/policies/acl/workload-kv-read-secrets-engine-approval-client'
|
|
- 'Auth role metadata write: auth/netkingdom/role/secrets-engine-approval-client-workload-kv-read'
|
|
- No secret values were read, written, printed, or accepted in argv.
|
|
lifecycle:
|
|
deactivate: Detach the policy from role secrets-engine-approval-client-workload-kv-read
|
|
and disable the ops-warden catalog entry. The KeyCape verifier lane and its delivery
|
|
are unaffected.
|
|
rotate: 'Shared with CCR-2026-0017: the value is one client secret. Rotation is
|
|
minted by KeyCape and rewritten once under attended authority; both the verifier
|
|
delivery and this reader then see the new version. No independent rotation exists
|
|
for this lane alone.'
|
|
compromised: KeyCape disables the secrets-engine-approval registration first, since
|
|
that is what stops token issuance, then the value is rotated and this role's policy
|
|
detached pending review.
|
|
state_hub:
|
|
workplan_id: RPF-WP-0035
|
|
task_id: RPF-WP-0035-T06
|
|
related_request: CCR-2026-0017
|