diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index f59a516..6a59c22 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -636,7 +636,23 @@ ruled IN SCOPE, not deferred**: the checker learns to FAIL on an hacluster relation with no VIP, because `cluster_count` is checked NOWHERE today and a 3->1 rewrite of all 20 values produces a byte-identical PASS. Per R6 these VIPs land BEFORE the HA overlay. - Remaining: R7-R10 blocking, R12-R15 standing -- all measured. + **R7 RULED 2026-07-27 -- exact utterance "Per-DC independent Octavia PKI; fix the generator + first (Recommended)"**, recorded as a **D-109 AMENDMENT (2026-07-27)** extending per-DC + cryptographic independence from Vault roots to the Octavia amphora control-plane PKI (a + SEPARATE trust domain, generated outside Vault by phase-01 step 1.0-GEN, which D-109 never + mentioned). Measured refinement that narrows the work: the generator is dc0-frozen in TWO + ways of DIFFERENT severity -- the CA SUBJECT is a baked `VR0 DC0` literal, but the + controller cert's SAN is **already DERIVED per-DC by design** (DOCFIX-067, "never a baked + literal"), so only the subject and the `^10\.12\.4\.` VIP gate need changing. A DOCFIX was + owed regardless: the generator cannot produce a dc1 artifact today and phase-01:144-145 + hard-ABORTS without the overlay. Reuse refused on posture -- the overlay carries CA private + keys plus a plaintext passphrase in a repo SEC-004 records as PUBLIC, so one shared amphora + CA across two clouds D-100 defines as independent would widen an existing exposure. + **Caveat carried forward: the generator's VIP gate must read the MERGED deploy input, not + `bundle.yaml`, or it breaks again the moment ruling-3's VIP extraction and R11's `.61`/`.62` + land.** Roosevelt analog: same "no cross-DC shared secret" principle as the per-DC MAAS + power keys (SEC-012/-016). + Remaining: R8-R10 blocking, R12-R15 standing -- all measured. - Position inside Stage 3: deploy step A EXECUTED 2026-07-19 (6/0/6 exact; convergence zero -- `docs/audit/outer-plan-20260719-postA-converged.txt`). **Deploy step B diff --git a/docs/audit/queued-rulings-20260727.md b/docs/audit/queued-rulings-20260727.md index 34e7ed8..80adccd 100644 --- a/docs/audit/queued-rulings-20260727.md +++ b/docs/audit/queued-rulings-20260727.md @@ -362,7 +362,20 @@ - **(c)** Fix the generator now and defer the trust-domain decision until it can actually be executed either way. -OPERATOR UTTERANCE: +OPERATOR UTTERANCE: **"Per-DC independent Octavia PKI; fix the generator first +(Recommended)"** -- RULED 2026-07-27. **R7 IS CLOSED.** Recorded as a **D-109 AMENDMENT +(2026-07-27)** extending per-DC cryptographic independence from Vault roots to the +Octavia amphora control-plane PKI. Measured refinement: the generator is dc0-frozen in +TWO ways of DIFFERENT severity -- the CA SUBJECT is a baked `VR0 DC0` literal, but the +controller cert's SAN is **already DERIVED per-DC by design** (DOCFIX-067, "never a baked +literal"), so only the subject and the `^10\.12\.4\.` VIP gate need work. Reuse was +refused on posture: the overlay carries CA private keys plus a plaintext passphrase in a +repo SEC-004 records as PUBLIC, so sharing one amphora CA across two clouds D-100 defines +as independent would widen an existing exposure. Roosevelt analog: same "no cross-DC +shared secret" principle already ruled for per-DC MAAS power keys (SEC-012/-016). +**Caveat carried forward:** the generator's VIP gate must read the MERGED deploy input, +not `bundle.yaml`, or it breaks again the moment ruling-3's VIP extraction and R11's +`.61`/`.62` land. --- diff --git a/docs/design-decisions.md b/docs/design-decisions.md index d1f8658..50d17a0 100644 --- a/docs/design-decisions.md +++ b/docs/design-decisions.md @@ -2559,6 +2559,62 @@ --- +## D-109 -- AMENDMENT (2026-07-27): per-DC cryptographic independence EXTENDS to the Octavia control-plane PKI + +**Status:** RULED 2026-07-27 (operator, GA-R5). Question as presented, verbatim: "R7 -- +Octavia CA scope. The generator bakes a 'VR0 DC0' CA subject and gates on dc0's VIP band, so +it cannot produce a dc1 artifact as written; a DOCFIX is owed either way. D-109 rules per-DC +independent Vault roots for DR-honesty but does not mention Octavia PKI. Do the two DCs +share one Octavia CA, or get independent trust domains?" Options presented: (a) per-DC +independent Octavia PKI, fixing the generator first; (b) reuse dc0's existing CA across both +DCs; (c) fix the generator now and defer the trust-domain decision. Operator selection, +exact utterance: **"Per-DC independent Octavia PKI; fix the generator first (Recommended)"**. + +**WHAT THIS AMENDS.** D-109 established "Per-DC INDEPENDENT Vault roots (each DC's Vault is +its own root CA; no regional root-of-trust this phase)", rationale "independent roots keep +the two clouds cryptographically independent (DR-honest)". It did NOT mention the Octavia +amphora control-plane PKI, which is a SEPARATE trust domain with its own CA, generated +outside Vault by `runbooks/phase-01-bundle-deploy.md` step 1.0-GEN. This amendment extends +the same posture to it: **each DC gets its own Octavia CA; no cross-DC amphora +root-of-trust.** + +**MEASURED STATE -- the generator is dc0-frozen in TWO ways of DIFFERENT severity**, and the +distinction matters because only one of them is a real design problem: +- The CA SUBJECT is a BAKED LITERAL: `-subj "/CN=VR0 DC0 Omega Cloud Octavia Controller + CA/O=Neumatrix"`. Reusing it puts a VR0-DC0-named CA at the root of dc1's amphora chain. +- The controller cert's SAN is **DERIVED, not baked** -- the step states it carries the + controller FQDN, the octavia API FQDN and the Octavia API VIP "derived from the bundle at + generation time -- DOCFIX-067; never a baked literal". **That half is already + per-DC-correct by design** and needs no change. +- The blocker is the VIP gate: `grep -qE '^10\.12\.4\.[0-9]{1,3}$'` accepts ONLY dc0's band, + while dc1's octavia VIP is `10.12.64.57` and lives in `overlays/vr1-dc1-vips.yaml`, not in + `bundle.yaml` where the generator reads it (audit finding L5-3). + +**A DOCFIX IS OWED REGARDLESS OF THIS RULING.** The generator cannot produce a dc1 artifact +as written, and `runbooks/phase-01-bundle-deploy.md:144-145` hard-ABORTS the deploy when +`overlays/octavia-pki.yaml` is absent -- which it currently is (it is a gitignored secret, +and preflight P4 CHECK 0 fails on it by design). So option (c) would have deferred only the +part D-109 already answers by precedent, while leaving the required work untouched. + +**SECURITY POSTURE, and why reuse was refused.** `overlays/octavia-pki.yaml` carries CA +private keys plus a plaintext issuing-CA passphrase inside the repo clone, and SEC-004 +records the repo as still PUBLIC. Reuse would place ONE amphora control-plane CA private key +across two clouds that D-100 defines as independent -- widening an existing exposure rather +than containing it, in a commercial multi-tenant cloud with hard tenant isolation (the SCS +Domain Manager posture). Independent per-DC CAs keep the blast radius of that exposure to +one DC. + +**Work implied (each gated, NOT authorised by this ruling):** parameterise the CA subject +per DC; widen or DC-parameterise the VIP gate so it reads the per-DC VIP from the merged +deploy input rather than `bundle.yaml`'s dc0 band; then generate dc1's own PKI. Note the +generator's VIP source interacts with the 2026-07-25 ruling-3 VIP extraction and with R11's +new `.61`/`.62` allocations -- the gate must read the MERGED input, not the base bundle, or +it will break again the moment the extraction lands. + +**Roosevelt analog:** per-DC amphora CAs match per-DC IPMI/BMC credentials and per-DC MAAS +power keys (SEC-012/-016) -- the same "no cross-DC shared secret" principle already ruled +twice in this deployment. + ## D-110: DC-DC numbering and repo-seed policy **Status:** ADOPTED 2026-07-09 (operator ruling; meta / process).