tegwick
5f85c784d9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
76 lines
2.9 KiB
Markdown
76 lines
2.9 KiB
Markdown
---
|
|
id: SECRETS-WP-0017
|
|
type: workplan
|
|
title: "Catalog and guard bounded-executor CAS rotation lanes (NK-WP-0056 pilot)"
|
|
domain: infotech
|
|
repo: secrets-engine
|
|
status: active
|
|
flavor: implementation
|
|
owner: secrets-engine
|
|
topic_slug: custodian
|
|
created: "2026-10-31"
|
|
updated: "2026-10-31"
|
|
depends_on: []
|
|
related: [SECRETS-WP-0013]
|
|
state_hub_workstream_id: "c0ca67a0-4404-5ceb-bdcd-7c9f33ece5eb"
|
|
---
|
|
|
|
Owner answer to NK-WP-0056-T02 (hub message 16adf344). Design and proposed lane
|
|
shapes: `docs/bounded-executor-credential-lanes.md`. The engine catalogs and
|
|
statically guards the executor lane. railiance-platform applies the Kubernetes
|
|
auth role and policy through its own CCR, and the executor holds only its own
|
|
15-minute token. Nothing here is a grant or a live change.
|
|
|
|
## Model an existing-auth CAS rotation lane in the catalog
|
|
|
|
```task
|
|
id: SECRETS-WP-0017-T01
|
|
status: todo
|
|
needs_human: true
|
|
decision_id: c29c6eda-fa13-4d53-8293-17261eb437c1
|
|
priority: high
|
|
state_hub_task_id: "d921d92f-38ed-5da7-8820-8a9e614c84de"
|
|
```
|
|
|
|
Add an explicit lane access mode, for example `access: rotate-cas`, for `kv`
|
|
lanes with `delivery_auth.management: existing`. It renders `["read",
|
|
"update"]` on the exact data path and no `create`, metadata, delete, destroy or
|
|
undelete paths. It requires the `cas_required` declaration, a 15m maximum TTL,
|
|
risk `high`, and rotation and deactivation owners. Kubernetes auth is recorded
|
|
as existing-auth metadata only. Keep the default read-only `lane_policy_paths`
|
|
unchanged. Add tests for the rendered policy and for refusal of wildcard, extra
|
|
capability and metadata variants.
|
|
|
|
## Check a platform policy file against the catalog-rendered policy
|
|
|
|
```task
|
|
id: SECRETS-WP-0017-T02
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "2b1572b3-10d9-54ff-a1e2-047ae36826f8"
|
|
```
|
|
|
|
Add a static, offline comparison of a railiance-platform policy HCL with the
|
|
engine-rendered policy for a lane, reported as non-secret pass/fail. Platform
|
|
can run it on the CCR policy file before an attended apply. No OpenBao call.
|
|
|
|
## Add catalog entries for the pilot executor
|
|
|
|
```task
|
|
id: SECRETS-WP-0017-T03
|
|
status: todo
|
|
needs_human: true
|
|
decision_id: 3d0c8f86-7b9c-456b-8951-5ae889829118
|
|
priority: medium
|
|
state_hub_task_id: "2b751e4c-6cbc-54b9-8cb2-0e78d4a59739"
|
|
```
|
|
|
|
Add `nk-bind-executor-svc-authelia` (rotate-cas) and the syn-journey check read
|
|
as non-secret entries that reference the platform CCR and NK-WP-0056. If the
|
|
founder chooses the fallback LLDAP account, also add
|
|
`nk-bind-executor-lldap-credential` (high risk). Use `route` for readiness
|
|
pointers only.
|
|
|
|
## Founder decision 2026-10-31
|
|
|
|
Approved by the founder (`proposed` -> `ready`) after the NK-WP-0056-T02 owner answers (hub decision 19afd15e). Founder choices: the executor write role is window-scoped (hub c29c6eda; CCR-2026-0058 approved as amended) and the bind rotates its own password (hub 3d0c8f86), so no `lldap_password_manager` lane is needed; T01 and T03 are unblocked.
|