805e0e5a2b
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
45 lines
2.9 KiB
Markdown
45 lines
2.9 KiB
Markdown
# Grafana administrator custody
|
|
|
|
This is the attended bootstrap lane for rapp-telemetry on railiance01, not a
|
|
coding-agent credential vending interface or an accepted operator OIDC design.
|
|
User authorized service activation on September 6, 2026.
|
|
|
|
- KV: platform/workloads/telemetry/grafana-admin; ADMIN_USERNAME and ADMIN_PASSWORD.
|
|
- ESO identity: telemetry/telemetry-grafana-eso, automount disabled.
|
|
- Kubernetes auth role: telemetry-grafana-eso; policy telemetry-grafana-admin-eso.
|
|
- Exact data-only read, self-lookup/revoke, audience openbao, 15-minute maximum;
|
|
no default policy, wildcard namespace, sibling grant or secret write.
|
|
- ClusterSecretStore openbao-telemetry-grafana restricts consumers to telemetry;
|
|
ExternalSecret telemetry-grafana-admin refreshes every 5 minutes and retains
|
|
the delivered Secret. Grafana references admin-user and admin-password.
|
|
- Coding-agent high-risk boundary denies both data and metadata, including when
|
|
combined with the ESO read policy. Cluster administration/ESO remain trusted.
|
|
|
|
Source manifests belong to ../rapp-telemetry/manifests/. The platform writer
|
|
scripts/telemetry_grafana_custody.py uses CAS zero, refuses existing role/policy
|
|
or credential shape drift, preserves existing boundary policy text, and checks
|
|
positive and negative login/access before verifying ESO delivery. Run only under
|
|
scripts/openbao-attended-exec.py after warden route show
|
|
openbao-platform-admin-login. A unique --receipt path is required; receipts contain
|
|
metadata only. The bootstrap does not rotate existing credentials.
|
|
|
|
scripts/telemetry_grafana_access.py checks anonymous and forged proxy-header
|
|
denials, positive native-admin API access, datasource and dashboards inside the
|
|
same attended envelope. It requires an operator-created localhost-only port
|
|
forward on 13001 to the known Grafana service. Do not substitute an untrusted
|
|
endpoint. It emits only a metadata receipt and never logs passwords or headers.
|
|
|
|
Rotation must update the existing Grafana database administrator credential as
|
|
well as OpenBao; changing ESO/environment alone does not reset an initialized
|
|
Grafana admin password. Coordinate and test old-login rejection/new-login success
|
|
before calling rotation complete. Disable the ESO role to revoke future delivery
|
|
but remember the existing Kubernetes Secret and application password persist;
|
|
revoke application access and remove the binding deliberately in a compromise.
|
|
Do not delete retained recovery material as an implicit rollback.
|
|
|
|
Accepted September 6 evidence: exact read and delivery match; wrong identity,
|
|
namespace and audience denied; sibling/write denied; coding-agent deny wins;
|
|
native login succeeds; anonymous/proxy-header requests denied. See
|
|
../rapp-telemetry/evidence/live/2026-09-06-railiance01.json. A version-pinned Scaleway essentials archive and isolated application restore
|
|
passed later on September 6; see history/2026-09-06-telemetry-scaleway-recovery.md.
|
|
Recurring backups, operator OIDC and public production admission remain open.
|