402 lines
22 KiB
JSON
402 lines
22 KiB
JSON
{
|
|
"checker": {
|
|
"bytes": 13633409,
|
|
"native_custody_admitted": false,
|
|
"path": "/tmp/nk-checker-environment-r2-rebuild/keycape",
|
|
"runtime_contract": "Current owner adapter rehashes source/file, snapshots exact checker into sealed memfd, executes same snapshot for live/proposed checks with empty environment; this does not establish parent-directory/interpreter/kernel custody.",
|
|
"sha256": "sha256:be37738fe1c08259fb4f9ca0daf0f9301bfffc237e5bb38435525dfbf11ccff5"
|
|
},
|
|
"complete_executable_descriptor_set": false,
|
|
"composition": [
|
|
{
|
|
"candidate_descriptor": null,
|
|
"candidate_descriptor_digest": null,
|
|
"declared_owner": "net-kingdom",
|
|
"dispatch_permitted": false,
|
|
"existing_seam": "identity-provisioner governed journal T14 with delivered PostgreSQL T21",
|
|
"exists_in_default_1_1": true,
|
|
"missing_exact_owner_facts": [
|
|
"native dedicated CNPG consumer, checkpoint holder and backup/lost-store continuity",
|
|
"authoritative tenant/case/source/principal callbacks",
|
|
"all LDAP writers fenced or provider CAS/ABA exclusion",
|
|
"exact owner adapter/source/descriptor and revocation evidence; existing legacy ensure/revoke is not created-only undo"
|
|
],
|
|
"native_owner_assent": false,
|
|
"resolved_first_consumer_owner": "net-kingdom",
|
|
"rollback_requirement": "Only independently authenticated created groups/memberships; preserve shared/preexisting membership and unresolved intents.",
|
|
"source_order": 1,
|
|
"source_step": {
|
|
"attended": true,
|
|
"attended_justification": "The provisioner's only HTTP credential is user-engine's runtime token, and its NetworkPolicy admits only user-engine pods. A proxy lane would act as user-engine (ops-warden review R8; canon section 3; ops-warden ADR-0002). Running it in the session register-client already needs adds no attended session. It can become unattended once the provisioner has an operator credential of its own and an admitted path.",
|
|
"auth": "operator cluster access in the attended register-client session; the in-pod call uses the provisioner's own directory binding, and no provisioner or user-engine token is read or sent",
|
|
"entry_point": "identity-provisioner ensure_service_groups, run inside the provisioner pod through the session's contained cluster access (groups {access_groups}; members exactly {initial_members} as recorded in the accepted case, nothing else)",
|
|
"id": "ensure-groups",
|
|
"lane": "key-cape-oidc-login",
|
|
"owner": "net-kingdom",
|
|
"value_handling": "none",
|
|
"warden_executes": false
|
|
},
|
|
"step": "ensure-groups"
|
|
},
|
|
{
|
|
"candidate_descriptor": null,
|
|
"candidate_descriptor_digest": null,
|
|
"declared_owner": "railiance-platform",
|
|
"dispatch_permitted": false,
|
|
"existing_seam": "scripts/keycape_client_secret_generate.py; RPF-WP-0054 and existing broker lane",
|
|
"exists_in_default_1_1": true,
|
|
"missing_exact_owner_facts": [
|
|
"fixed kernel Adapter/Descriptor for exact admitted case/type and broker source",
|
|
"authoritative case materialization receipt and original CAS0 uncertainty reconciliation",
|
|
"independent broker-grant AND parent-session revocation receipts for exact current attempt"
|
|
],
|
|
"native_owner_assent": false,
|
|
"resolved_first_consumer_owner": "railiance-platform",
|
|
"rollback_requirement": "Never regenerate after uncertain write; read-only metadata reconciliation does not establish creation or retry authority; owner custody delete only if exact created-only entitlement.",
|
|
"source_order": 2,
|
|
"source_step": {
|
|
"attended": false,
|
|
"auth": "the caller's broker grant for the case's KV path, through its lane; the value is generated in custody and never returned",
|
|
"entry_point": "railiance-platform credential broker: generate a client secret inside custody at bao:platform/workloads/keycape/{client_id}",
|
|
"id": "mint-secret",
|
|
"lane": "keycape-client-secret-generate",
|
|
"owner": "railiance-platform",
|
|
"value_handling": "generated_in_custody",
|
|
"warden_executes": true,
|
|
"when": "client_type == confidential"
|
|
},
|
|
"step": "mint-secret"
|
|
},
|
|
{
|
|
"candidate_descriptor": null,
|
|
"candidate_descriptor_digest": null,
|
|
"declared_owner": "railiance-platform",
|
|
"dispatch_permitted": false,
|
|
"existing_seam": "existing ESO delivery/role and structural materialization boundary",
|
|
"exists_in_default_1_1": true,
|
|
"missing_exact_owner_facts": [
|
|
"exact delivery object UID/ownerReference prestate and admitted owner adapter",
|
|
"current Ready status/readback without value access",
|
|
"independent cleanup/revocation receipt and owner custody identity"
|
|
],
|
|
"native_owner_assent": false,
|
|
"resolved_first_consumer_owner": "railiance-platform",
|
|
"rollback_requirement": "Delete only authenticated case-created delivery objects, preserve preexisting target and shared resources.",
|
|
"source_order": 3,
|
|
"source_step": {
|
|
"attended": false,
|
|
"auth": "railiance-platform ESO delivery through role external-secrets-keycape-{client_id}; no value leaves custody",
|
|
"entry_point": "ExternalSecret sso/keycape-{client_id}-client (key client-secret) from bao:platform/workloads/keycape/{client_id}",
|
|
"id": "deliver-secret",
|
|
"owner": "railiance-platform",
|
|
"ready_check": "the delivery for sso/keycape-{client_id}-client reports Ready=True (status only, no value read)",
|
|
"value_handling": "none",
|
|
"warden_executes": false,
|
|
"when": "client_type == confidential"
|
|
},
|
|
"step": "deliver-secret"
|
|
},
|
|
{
|
|
"candidate_descriptor": null,
|
|
"candidate_descriptor_digest": null,
|
|
"declared_owner": "net-kingdom",
|
|
"dispatch_permitted": false,
|
|
"existing_seam": "existing sso/keycape Deployment prerequisite checked by keycape-client.py; T12",
|
|
"exists_in_default_1_1": true,
|
|
"missing_exact_owner_facts": [
|
|
"reviewed fixed exact Deployment UID/resourceVersion/env binding update adapter",
|
|
"created-only prestate/readback and owner evidence/session capabilities",
|
|
"separately reviewed quiet-window restart/readiness procedure; registry helper only reports restart_required"
|
|
],
|
|
"native_owner_assent": false,
|
|
"resolved_first_consumer_owner": "net-kingdom",
|
|
"rollback_requirement": "Restore only exact case-created env binding under current revision; a whole Deployment rollback or deleting preexisting env is not admitted.",
|
|
"source_order": 4,
|
|
"source_step": {
|
|
"attended": true,
|
|
"attended_justification": "A change to the live identity provider's Deployment. It runs in the same attended operator session as register-client, before it, because KeyCape resolves a confidential client's secret at start and fails closed if the binding is missing.",
|
|
"auth": "operator kube credentials for namespace sso",
|
|
"entry_point": "patch Deployment sso/keycape: env KEYCAPE_{client_id:env}_CLIENT_SECRET from sso/keycape-{client_id}-client",
|
|
"id": "bind-env",
|
|
"lane": "key-cape-oidc-login",
|
|
"owner": "net-kingdom",
|
|
"value_handling": "none",
|
|
"warden_executes": false,
|
|
"when": "client_type == confidential"
|
|
},
|
|
"step": "bind-env"
|
|
},
|
|
{
|
|
"candidate_descriptor": {
|
|
"actor": "human",
|
|
"adapter": "net-kingdom/keycape-registration@v1",
|
|
"adapter_source": "sha256:7db1caa4d1e73e8f65b6744af53bcdce628bcd86732f74bdc125f85c531a22d1",
|
|
"allowed_created": [
|
|
"keycape-client"
|
|
],
|
|
"effect": "change",
|
|
"lane": "key-cape-oidc-login",
|
|
"owner": "net-kingdom",
|
|
"retry_safe": false,
|
|
"revocation_scopes": [
|
|
"parent-session"
|
|
],
|
|
"step": "register-client",
|
|
"target_parameter": "client_id",
|
|
"version": "warden.case.execution.v1"
|
|
},
|
|
"candidate_descriptor_digest": "sha256:1b86e9032845ec35a58d88a9f1108dbb7d8cee0c9c9176d4a694b893d9d7a3fa",
|
|
"declared_owner": "net-kingdom",
|
|
"dispatch_permitted": false,
|
|
"existing_seam": "keycape-registration-adapter.py build/publish/authenticate/revoke_session injection seam",
|
|
"exists_in_default_1_1": true,
|
|
"missing_exact_owner_facts": [
|
|
"actual admitted durable owner publisher/authenticator and exact parent-session revoker",
|
|
"native executable storage/provenance and exact descriptor/type source admission",
|
|
"T15 original-attempt recovery contract; fresh adapter intentionally cannot undo prior-process creation"
|
|
],
|
|
"native_owner_assent": false,
|
|
"resolved_first_consumer_owner": "net-kingdom",
|
|
"rollback_requirement": "Same-process authenticated successful creation only; exact original entry and unchanged postcreation UID/resourceVersion; post-restart stays refused.",
|
|
"source_order": 5,
|
|
"source_step": {
|
|
"attended": true,
|
|
"attended_justification": "The live KeyCape client registry is a Kubernetes Secret, and agents do not read or write Secrets. Until KeyCape loads clients from a non-secret registry with secrets referenced from custody, one attended operator session applies the rendered registration. ops-warden groups all attended steps of a run into that one session. KeyCape loads clients at startup and keeps login, authorization and handoff state in memory, so the restart drops in-flight logins and sessions for every client; runs go in a quiet window (key-cape type review R4). The rendered registry must pass KeyCape's own startup checks (keycape check-config, key-cape c528daa, which keycape-client.py runs before it patches) before the restart: a refused entry stops the single replica and every client loses sign-in (R1).",
|
|
"auth": "operator write access to the live KeyCape client registry in namespace sso",
|
|
"entry_point": "sso-mfa/k8s/keycape/keycape-client.py apply --client-file <client-from-case> --case-acceptance <record> --check-config <keycape binary> (net-kingdom.keycape-client-registration)",
|
|
"id": "register-client",
|
|
"lane": "key-cape-oidc-login",
|
|
"owner": "net-kingdom",
|
|
"value_handling": "none",
|
|
"warden_executes": false
|
|
},
|
|
"step": "register-client"
|
|
},
|
|
{
|
|
"candidate_descriptor": null,
|
|
"candidate_descriptor_digest": null,
|
|
"declared_owner": "{consumer_owner_repo}",
|
|
"dispatch_permitted": false,
|
|
"existing_seam": "acknowledged source1.2 dedicated SA/namespace SecretStore/ExternalSecret composition",
|
|
"exists_in_default_1_1": false,
|
|
"missing_exact_owner_facts": [
|
|
"actual installed ESO TokenRequest/RBAC compatibility and consumer owner admission",
|
|
"fixed owner adapter/descriptor for exact identities with created/preexisting readback",
|
|
"receiver evidence for Ready status and case-issued token revocation/expiry"
|
|
],
|
|
"native_owner_assent": false,
|
|
"resolved_first_consumer_owner": "railiance-apps for Forgejo",
|
|
"rollback_requirement": "Revert consumer reference first; delete only authenticated created UID/ownerReference resources; SA/Store deletion alone does not immediately revoke OpenBao tokens.",
|
|
"source_order": 6,
|
|
"source_step": {
|
|
"attended": false,
|
|
"auth": "Consumer owner contained Kubernetes deployment authority; ESO authenticates to OpenBao role external-secrets-keycape-{client_id}-{consuming_service} with a TokenRequest for the dedicated namespaced serviceAccountRef; controller remains trusted",
|
|
"entry_point": "Owner applies dedicated ServiceAccount {consumer_namespace}/{consuming_service}-keycape-{client_id}-eso (automount=false, no legacy tokens), namespace SecretStore openbao-keycape-{client_id}-consumer with serviceAccountRef and audiences [openbao], and ExternalSecret {consuming_service}-netkingdom-oidc-client with Owner target, Retain remote deletion and only CLIENT_SECRET from workloads/keycape/{client_id}. Admission validates actual installed ESO TokenRequest support and common controller RBAC before any owner-approved apply.",
|
|
"id": "deliver-consumer-secret",
|
|
"owner": "{consumer_owner_repo}",
|
|
"ready_check": "Namespace SecretStore and ExternalSecret both report Ready=True; dedicated SA has no legacy token refs; status and fixed metadata only, never Secret values.",
|
|
"value_handling": "none",
|
|
"warden_executes": false,
|
|
"when": "client_type == confidential"
|
|
},
|
|
"step": "deliver-consumer-secret"
|
|
},
|
|
{
|
|
"candidate_descriptor": null,
|
|
"candidate_descriptor_digest": null,
|
|
"declared_owner": "{consumer_owner_repo}",
|
|
"dispatch_permitted": false,
|
|
"existing_seam": "consumer owner OIDC configuration and groups enforcement path",
|
|
"exists_in_default_1_1": true,
|
|
"missing_exact_owner_facts": [
|
|
"owner exact deployment/source adapter/descriptor and accepted issuer/client/delivery binding",
|
|
"actual human login/group-denial and public authorization/MFA pin verifications",
|
|
"rollback and native receipt/custody acceptance"
|
|
],
|
|
"native_owner_assent": false,
|
|
"resolved_first_consumer_owner": "railiance-apps for Forgejo",
|
|
"rollback_requirement": "Remove only this case-created OIDC source; preserve shared/preexisting auth sources and consumer state.",
|
|
"source_order": 7,
|
|
"source_step": {
|
|
"attended": false,
|
|
"auth": "the consumer owner's own deployment path",
|
|
"entry_point": "configure {consuming_service} with issuer {issuer}, client {client_id} and custody bao:platform/workloads/keycape/{client_id}, and make it require one of {access_groups} in the groups claim before sign-in completes",
|
|
"id": "hand-over",
|
|
"owner": "{consumer_owner_repo}",
|
|
"value_handling": "none",
|
|
"warden_executes": false
|
|
},
|
|
"step": "hand-over"
|
|
}
|
|
],
|
|
"execution_permitted": false,
|
|
"missing_descriptor_steps": [
|
|
"ensure-groups",
|
|
"mint-secret",
|
|
"deliver-secret",
|
|
"bind-env",
|
|
"deliver-consumer-secret",
|
|
"hand-over"
|
|
],
|
|
"native_complete": false,
|
|
"proposed_version_selection": {
|
|
"canonical_case": "Keep1.1 accepted history unchanged and1.2 example proposed without acceptance fields.",
|
|
"classification": "Exact closed execution references and any changed trust/materialization/authentication must be classified by the existing owner; changed trust/authentication requires informed-decision acknowledgment, never self-classified as harmless validation.",
|
|
"default_loader": "Keep canonical1.1 unchanged; select1.2 only through existing explicit version-root option for source review.",
|
|
"descriptor_revision": "Do not edit acknowledged source1.1/1.2 in place or inherit old acknowledgment for new descriptor bytes. Allocate the exact successor revision/version through NetKingdom canon section6 after the complete owner-reviewed set exists.",
|
|
"first_consumer": "Forgejo",
|
|
"review_base": "explicit source-only oidc-browser-relying-party@1.2",
|
|
"why": "Its dedicated consumer SA/ESO authentication boundary expresses the reviewed six-object structural design;1.1 does not."
|
|
},
|
|
"purpose": "Review inventory only; this is not a Warden descriptor bundle or accepted SecurityCaseType.",
|
|
"register_descriptor": {
|
|
"decode": "Actual Warden Descriptor.decode round-trip passed; no Executor admission or tooling invocation performed.",
|
|
"owner_source_composition": "sha256:7db1caa4d1e73e8f65b6744af53bcdce628bcd86732f74bdc125f85c531a22d1",
|
|
"path": "register-client.proposed-descriptor.json",
|
|
"sha256": "sha256:1b86e9032845ec35a58d88a9f1108dbb7d8cee0c9c9176d4a694b893d9d7a3fa"
|
|
},
|
|
"rollback_inventory": [
|
|
{
|
|
"action": "remove the OIDC source for {client_id} from {consuming_service} (owner {consumer_owner_repo})",
|
|
"reverses": "hand-over"
|
|
},
|
|
{
|
|
"action": "After reverting consumer secret reference, delete only authenticated created ExternalSecret/owned target by UID and ownerReference, then SecretStore and dedicated SA; preserve preexisting-matched resources and never delete a shared target. Retain audit and ownership receipts; removing SecretStore/SA alone is not immediate OpenBao token revocation.",
|
|
"reverses": "deliver-consumer-secret",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "keycape-client.py apply --operation remove for {client_id}",
|
|
"reverses": "register-client"
|
|
},
|
|
{
|
|
"action": "remove env KEYCAPE_{client_id:env}_CLIENT_SECRET from Deployment sso/keycape, after register-client is reversed",
|
|
"reverses": "bind-env",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "delete ExternalSecret sso/keycape-{client_id}-client and its target",
|
|
"reverses": "deliver-secret",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "covered by client-secret-path: one metadata delete, after deliver-secret is reversed",
|
|
"reverses": "mint-secret",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "identity-provisioner revoke_service_groups inside the provisioner pod (attended, as ensure-groups) with the case's memberships; delete_if_empty only if no other case uses {access_groups}",
|
|
"reverses": "ensure-groups"
|
|
},
|
|
{
|
|
"action": "delete metadata and all versions at platform/workloads/keycape/{client_id}, after the ExternalSecret is gone (this also reverses mint-secret)",
|
|
"reverses": "client-secret-path",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "delete Kubernetes-auth role external-secrets-keycape-{client_id}",
|
|
"reverses": "eso-role",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "delete policy workload-kv-read-keycape-{client_id}-eso, after eso-role",
|
|
"reverses": "keycape-reader-policy",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "Delete only this case-created role external-secrets-keycape-{client_id}-{consuming_service}, before deleting consumer-reader-policy; revoke case-issued OpenBao tokens or prove expiration before declaring deactivation.",
|
|
"reverses": "consumer-eso-role",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "delete policy workload-kv-read-keycape-{client_id}-{consuming_service}",
|
|
"reverses": "consumer-reader-policy",
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"action": "remove catalog entry {consuming_service}-keycape-client",
|
|
"reverses": "catalog-entry"
|
|
}
|
|
],
|
|
"run_order_and_completion": [
|
|
"Accepted exact case source and independently verified six-object native structural materialization before follow-through; a file status or rendered bundle is insufficient.",
|
|
"Preserve existing source follow-through order. Delivery Ready and exact Deployment env prerequisite before registry apply. Separate quiet-window restart/readiness after checked registration before real sign-in; registry changed receipt alone is not service activation.",
|
|
"Warden rechecks actual caller principal/actor/lane before each admitted dispatch. A session revoked at a step cannot be reused for later steps; owner must define fresh-session or admitted run-envelope grouping without weakening parent-session revocation.",
|
|
"Mint must carry separately authenticated broker-grant and parent-session revocation; every completed step requires independently authenticated owner and session evidence.",
|
|
"Verification is the complete declared positive/negative inventory plus actual human login/group denial. Reverse only independently confirmed creations, retaining uncertain intents and preserving shared/preexisting objects."
|
|
],
|
|
"schema": "custodian.registration-descriptor-review.v1",
|
|
"source_versions": {
|
|
"1.1": {
|
|
"machine_descriptor_map_present": false,
|
|
"status": "acknowledged",
|
|
"step_count": 6
|
|
},
|
|
"1.2": {
|
|
"machine_descriptor_map_present": false,
|
|
"status": "acknowledged",
|
|
"step_count": 7
|
|
}
|
|
},
|
|
"verification_inventory": [
|
|
{
|
|
"check": "GET {issuer}/authorize with client {client_id} and each of {redirect_uris} returns the login page",
|
|
"expect": "present",
|
|
"id": "authorize-accepts-redirects",
|
|
"reads_secret_value": false
|
|
},
|
|
{
|
|
"check": "GET {issuer}/authorize with client {client_id} and an unregistered redirect returns an OAuth error",
|
|
"expect": "deny",
|
|
"id": "authorize-refuses-other-redirect",
|
|
"reads_secret_value": false
|
|
},
|
|
{
|
|
"check": "a default-only OpenBao identity has no read capability on bao:platform/workloads/keycape/{client_id}",
|
|
"expect": "deny",
|
|
"id": "custody-denied-to-default",
|
|
"reads_secret_value": false,
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"check": "policy workload-kv-read-keycape-{client_id}-{consuming_service} grants read on bao:platform/workloads/keycape/{client_id} (capabilities check only)",
|
|
"expect": "allow",
|
|
"id": "custody-allowed-to-consumer",
|
|
"reads_secret_value": false,
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"check": "LLDAP groups {access_groups} exist, with exactly the memberships of the accepted case added",
|
|
"expect": "present",
|
|
"id": "groups-present",
|
|
"reads_secret_value": false
|
|
},
|
|
{
|
|
"check": "{consuming_service}'s OIDC source for {client_id} (owner {consumer_owner_repo}) requires one of {access_groups} in the groups claim (configuration read, no secret value)",
|
|
"expect": "present",
|
|
"id": "consumer-enforces-groups",
|
|
"reads_secret_value": false
|
|
},
|
|
{
|
|
"check": "the delivery for sso/keycape-{client_id}-client reports Ready=True (status only)",
|
|
"expect": "present",
|
|
"id": "secret-delivered",
|
|
"reads_secret_value": false,
|
|
"when": "client_type == confidential"
|
|
},
|
|
{
|
|
"check": "keycape-client.py inspect for {client_id} shows the MFA pin on the registered client (non-secret client view)",
|
|
"expect": "present",
|
|
"id": "mfa-pinned",
|
|
"reads_secret_value": false,
|
|
"when": "mfa_required == true"
|
|
},
|
|
{
|
|
"check": "{consumer_namespace} SecretStore openbao-keycape-{client_id}-consumer and ExternalSecret {consuming_service}-netkingdom-oidc-client Ready=True, exact dedicated SA/audience role binding, fixed CLIENT_SECRET mapping; no Secret value read",
|
|
"expect": "present",
|
|
"id": "consumer-secret-delivered",
|
|
"reads_secret_value": false,
|
|
"when": "client_type == confidential"
|
|
}
|
|
]
|
|
}
|