tegwick
a852d3f1ff
Implements SECRETS-WP-0002 end to end as a uv-managed Python package: - catalog: non-secret lane registry + strict validator (build/test/prod) - stage roles + OpenBao ACL policies; guards refuse wildcards, sys/, identity/, admin names, and cross-stage paths before any backend call - plan/apply: dry-run-first, idempotent policy + approle apply, decision-gated - decisions: State Hub lookup with local-fixture fallback; non-secret evidence to JSONL + hub progress, scrubbed of any value - provision/verify: mode-0600 file import + generated test values; positive/ negative checks that never print the value - exec delivery: `exec --catalog ... -- npm publish` injects the token via a temp .npmrc for the child only, cleaned up on exit/failure/interrupt - ops-warden routing contract + hardening backlog docs - 34 tests incl. live OpenBao integration; scripts/demo-e2e.sh runs the full chain against a throwaway bao dev server Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
1.9 KiB
HCL
47 lines
1.9 KiB
HCL
# secrets-engine-prod — production stage role policy.
|
|
#
|
|
# Scope: apply approved PRODUCTION metadata (ACL policies + approle roles) and
|
|
# write approved lane values for provisioning. Deliberately NARROW:
|
|
# - no root / sudo
|
|
# - no sys/* administration beyond its own se-prod-* ACL policies
|
|
# - no identity/* administration
|
|
# - no auth/token administration
|
|
# - cannot reach into build/ or test/ prefixes
|
|
#
|
|
# Production raw-value READ stays gated: this role can write a value during an
|
|
# approved provisioning step, but broad read of arbitrary prod paths is denied.
|
|
# Consumers read their own lane through the narrow se-prod-<lane> consumer policy.
|
|
|
|
# Apply approved production lane values (provisioning) and metadata.
|
|
# Owner-scoped prod lanes (e.g. whynot-design/...) — NOT under build/ or test/.
|
|
path "secret/data/+/*" {
|
|
capabilities = ["create", "update"]
|
|
}
|
|
path "secret/metadata/+/*" {
|
|
capabilities = ["create", "read", "update", "list"]
|
|
}
|
|
|
|
# Manage only the prod consumer policies this role owns.
|
|
path "sys/policies/acl/se-prod-*" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
# Manage prod approle roles only.
|
|
path "auth/approle/role/se-prod-*" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
path "auth/approle/role/se-prod-*/role-id" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "auth/approle/role/se-prod-*/secret-id" {
|
|
capabilities = ["create", "update"]
|
|
}
|
|
|
|
# Hard denials — production appliers must not become broad admins.
|
|
path "secret/data/build/*" { capabilities = ["deny"] }
|
|
path "secret/data/test/*" { capabilities = ["deny"] }
|
|
path "sys/policies/acl/secrets-engine-*" { capabilities = ["deny"] } # can't edit stage roles
|
|
path "auth/token/*" { capabilities = ["deny"] }
|
|
path "identity/*" { capabilities = ["deny"] }
|
|
path "sys/auth/*" { capabilities = ["deny"] }
|
|
path "sys/mounts/*" { capabilities = ["deny"] }
|