coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/credential-lane-designs/telemetry-grafana.md
codex 805e0e5a2b
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Verify telemetry essentials recovery from versioned Scaleway archive 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
2026-09-06 23:46:20 +02:00

2.9 KiB
Raw Blame History

Grafana administrator custody

This is the attended bootstrap lane for rapp-telemetry on railiance01, not a coding-agent credential vending interface or an accepted operator OIDC design. User authorized service activation on September 6, 2026.

  • KV: platform/workloads/telemetry/grafana-admin; ADMIN_USERNAME and ADMIN_PASSWORD.
  • ESO identity: telemetry/telemetry-grafana-eso, automount disabled.
  • Kubernetes auth role: telemetry-grafana-eso; policy telemetry-grafana-admin-eso.
  • Exact data-only read, self-lookup/revoke, audience openbao, 15-minute maximum; no default policy, wildcard namespace, sibling grant or secret write.
  • ClusterSecretStore openbao-telemetry-grafana restricts consumers to telemetry; ExternalSecret telemetry-grafana-admin refreshes every 5 minutes and retains the delivered Secret. Grafana references admin-user and admin-password.
  • Coding-agent high-risk boundary denies both data and metadata, including when combined with the ESO read policy. Cluster administration/ESO remain trusted.

Source manifests belong to ../rapp-telemetry/manifests/. The platform writer scripts/telemetry_grafana_custody.py uses CAS zero, refuses existing role/policy or credential shape drift, preserves existing boundary policy text, and checks positive and negative login/access before verifying ESO delivery. Run only under scripts/openbao-attended-exec.py after warden route show openbao-platform-admin-login. A unique --receipt path is required; receipts contain metadata only. The bootstrap does not rotate existing credentials.

scripts/telemetry_grafana_access.py checks anonymous and forged proxy-header denials, positive native-admin API access, datasource and dashboards inside the same attended envelope. It requires an operator-created localhost-only port forward on 13001 to the known Grafana service. Do not substitute an untrusted endpoint. It emits only a metadata receipt and never logs passwords or headers.

Rotation must update the existing Grafana database administrator credential as well as OpenBao; changing ESO/environment alone does not reset an initialized Grafana admin password. Coordinate and test old-login rejection/new-login success before calling rotation complete. Disable the ESO role to revoke future delivery but remember the existing Kubernetes Secret and application password persist; revoke application access and remove the binding deliberately in a compromise. Do not delete retained recovery material as an implicit rollback.

Accepted September 6 evidence: exact read and delivery match; wrong identity, namespace and audience denied; sibling/write denied; coding-agent deny wins; native login succeeds; anonymous/proxy-header requests denied. See ../rapp-telemetry/evidence/live/2026-09-06-railiance01.json. A version-pinned Scaleway essentials archive and isolated application restore passed later on September 6; see history/2026-09-06-telemetry-scaleway-recovery.md. Recurring backups, operator OIDC and public production admission remain open.