diff --git a/creds-manifests/host-identity b/creds-manifests/host-identity index c70c910..81efc0a 100644 --- a/creds-manifests/host-identity +++ b/creds-manifests/host-identity @@ -35,3 +35,8 @@ # `#` comments and blank lines ignored. jumphost vcloud +# RULED 2026-07-29 (D-109 ruling note (b)): the per-DC Octavia PKI is GENERATED on the Plane-2 +# headend, because juju lives there and the deploy reads the overlay from the same host. Its +# locations are declared `local`, so this binding is what makes a vcloud run report them NOT +# PROBED instead of absent. +headend voffice1 diff --git a/creds-manifests/vm-secret-locations b/creds-manifests/vm-secret-locations index e86d2b2..ced58dc 100644 --- a/creds-manifests/vm-secret-locations +++ b/creds-manifests/vm-secret-locations @@ -77,14 +77,21 @@ # both DCs' workspaces contain identically-named basenames, and a shared `-` scope would # collapse them into one namespace where a missing dc1 file is indistinguishable from a # present dc0 one -- reintroducing exactly the blindness F2 removed from the matrix. -jumphost vr1-dc0 local ~/octavia-pki/vr1-dc0/issuing-ca/* -jumphost vr1-dc0 local ~/octavia-pki/vr1-dc0/controller-ca/* -jumphost vr1-dc0 local ~/octavia-pki/vr1-dc0/controller/* -jumphost vr1-dc0 local /overlays/vr1-dc0-octavia-pki.yaml -jumphost vr1-dc1 local ~/octavia-pki/vr1-dc1/issuing-ca/* -jumphost vr1-dc1 local ~/octavia-pki/vr1-dc1/controller-ca/* -jumphost vr1-dc1 local ~/octavia-pki/vr1-dc1/controller/* -jumphost vr1-dc1 local /overlays/vr1-dc1-octavia-pki.yaml +# HOST-ROLE IS `headend`, RULED 2026-07-29 (D-109 ruling note (b), operator: "Generate on +# voffice1 (Recommended)"). juju is ABSENT on vcloud and 3.6.27 on voffice1, and the deploy +# runs from voffice1 -- so generating on the jumphost would mint the PKI on a host the deploy +# cannot read it from. Generate-then-transfer was declined: a second at-rest copy of a CA +# private key plus a plaintext passphrase widens the SEC-004 exposure R7 refused to widen. +# `local` (not the voffice1 ssh-target) so the F6 host binding governs: on vcloud these read +# NOT PROBED rather than absent, and on voffice1 they are probed for real. +headend vr1-dc0 local ~/octavia-pki/vr1-dc0/issuing-ca/* +headend vr1-dc0 local ~/octavia-pki/vr1-dc0/controller-ca/* +headend vr1-dc0 local ~/octavia-pki/vr1-dc0/controller/* +headend vr1-dc0 local /overlays/vr1-dc0-octavia-pki.yaml +headend vr1-dc1 local ~/octavia-pki/vr1-dc1/issuing-ca/* +headend vr1-dc1 local ~/octavia-pki/vr1-dc1/controller-ca/* +headend vr1-dc1 local ~/octavia-pki/vr1-dc1/controller/* +headend vr1-dc1 local /overlays/vr1-dc1-octavia-pki.yaml # Predicted Stage-5 exposure (SEC-023): phase-03 writes $HOME/admin-openrc. jumphost - local ~/admin-openrc diff --git a/creds-matrix.tsv b/creds-matrix.tsv index 7d3247c..d007095 100644 --- a/creds-matrix.tsv +++ b/creds-matrix.tsv @@ -100,24 +100,24 @@ # ---------------------------------------------------------------- outside the SEC-009 *-creds/ convention (research FINDING 2) vault-unseal-shares singleton - jumphost init.txt none service off-manifest-known vr0-phase02 runbook:runbooks/phase-02-vault-bringup.md:71 SEC-023 n-outside-convention vault-root-token singleton - jumphost init.txt none service off-manifest-known vr0-phase02 runbook:runbooks/phase-02-vault-bringup.md:71 SEC-023 n-outside-convention -octavia-issuing-ca-passphrase per-DC vr1-dc0 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:383 SEC-023 n-outside-convention -octavia-issuing-ca-key per-DC vr1-dc0 jumphost issuing-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:387 SEC-023 n-outside-convention -octavia-issuing-ca-cert per-DC vr1-dc0 jumphost issuing-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-023 n-outside-convention -octavia-controller-ca-pass per-DC vr1-dc0 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:406 SEC-023 n-outside-convention -octavia-controller-ca-key per-DC vr1-dc0 jumphost controller-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:410 SEC-023 n-outside-convention -octavia-controller-ca-cert per-DC vr1-dc0 jumphost controller-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:414 SEC-023 n-outside-convention -octavia-controller-key per-DC vr1-dc0 jumphost controller.key none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:429 SEC-023 n-outside-convention -octavia-controller-bundle per-DC vr1-dc0 jumphost controller.bundle.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:517 SEC-023 n-outside-convention -octavia-pki-overlay per-DC vr1-dc0 jumphost vr1-dc0-octavia-pki.yaml none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:553 SEC-004 n-overlay-in-clone -octavia-issuing-ca-passphrase per-DC vr1-dc1 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:383 SEC-023 n-outside-convention -octavia-issuing-ca-key per-DC vr1-dc1 jumphost issuing-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:387 SEC-023 n-outside-convention -octavia-issuing-ca-cert per-DC vr1-dc1 jumphost issuing-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-023 n-outside-convention -octavia-controller-ca-pass per-DC vr1-dc1 jumphost passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:406 SEC-023 n-outside-convention -octavia-controller-ca-key per-DC vr1-dc1 jumphost controller-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:410 SEC-023 n-outside-convention -octavia-controller-ca-cert per-DC vr1-dc1 jumphost controller-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:414 SEC-023 n-outside-convention -octavia-controller-key per-DC vr1-dc1 jumphost controller.key none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:429 SEC-023 n-outside-convention -octavia-controller-bundle per-DC vr1-dc1 jumphost controller.bundle.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:517 SEC-023 n-outside-convention -octavia-pki-overlay per-DC vr1-dc1 jumphost vr1-dc1-octavia-pki.yaml none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:553 SEC-004 n-overlay-in-clone +octavia-issuing-ca-passphrase per-DC vr1-dc0 headend passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:383 SEC-023 n-outside-convention +octavia-issuing-ca-key per-DC vr1-dc0 headend issuing-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:387 SEC-023 n-outside-convention +octavia-issuing-ca-cert per-DC vr1-dc0 headend issuing-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-023 n-outside-convention +octavia-controller-ca-pass per-DC vr1-dc0 headend passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:406 SEC-023 n-outside-convention +octavia-controller-ca-key per-DC vr1-dc0 headend controller-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:410 SEC-023 n-outside-convention +octavia-controller-ca-cert per-DC vr1-dc0 headend controller-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:414 SEC-023 n-outside-convention +octavia-controller-key per-DC vr1-dc0 headend controller.key none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:429 SEC-023 n-outside-convention +octavia-controller-bundle per-DC vr1-dc0 headend controller.bundle.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:517 SEC-023 n-outside-convention +octavia-pki-overlay per-DC vr1-dc0 headend vr1-dc0-octavia-pki.yaml none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:553 SEC-004 n-overlay-in-clone +octavia-issuing-ca-passphrase per-DC vr1-dc1 headend passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:383 SEC-023 n-outside-convention +octavia-issuing-ca-key per-DC vr1-dc1 headend issuing-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:387 SEC-023 n-outside-convention +octavia-issuing-ca-cert per-DC vr1-dc1 headend issuing-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:391 SEC-023 n-outside-convention +octavia-controller-ca-pass per-DC vr1-dc1 headend passphrase.txt none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:406 SEC-023 n-outside-convention +octavia-controller-ca-key per-DC vr1-dc1 headend controller-ca.key.enc none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:410 SEC-023 n-outside-convention +octavia-controller-ca-cert per-DC vr1-dc1 headend controller-ca.cert.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:414 SEC-023 n-outside-convention +octavia-controller-key per-DC vr1-dc1 headend controller.key none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:429 SEC-023 n-outside-convention +octavia-controller-bundle per-DC vr1-dc1 headend controller.bundle.pem none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:517 SEC-023 n-outside-convention +octavia-pki-overlay per-DC vr1-dc1 headend vr1-dc1-octavia-pki.yaml none service off-manifest-known stage5 runbook:runbooks/phase-01-bundle-deploy.md:553 SEC-004 n-overlay-in-clone tenant-domain-admin per-tenant - jumphost -domain-admin-cred.txt gui human off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:64 SEC-023 n-tenant-dir tenant-cluster-user per-tenant - jumphost -cluster-cred.txt api human off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:90 SEC-023 n-tenant-dir tenant-svc-user per-tenant - jumphost -svc-cred.txt api service off-manifest-known tenant-onboard script:scripts/tenant-onboard.sh:90 SEC-023 n-tenant-dir diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index be3fc41..bd68395 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2153,6 +2153,20 @@ `host-role=headend`; repoint the Octavia entries in `vm-secret-locations`; and bind `headend` in `host-identity` so the F6 wrong-host refusal covers them -- on vcloud they must read NOT PROBED rather than absent. + **THAT WORK IS NOW EXECUTED (2026-07-29), repo-side only -- no PKI has been minted.** All + seven `RUN` markers inside Step 1.0-GEN say **voffice1**, with `$REPO` stated to mean the + HEADEND clone; the 18 register rows are `host-role=headend`; the Octavia entries in + `vm-secret-locations` are `headend ... local ...`; and `host-identity` binds + `headend -> voffice1`. **MEASURED BOTH WAYS, which is the point of declaring them `local` + rather than with an ssh-target:** on vcloud all eight Octavia locations report + `NOT PROBED -- role 'headend' lives on 'voffice1' and this run is on 'vcloud'`, so absence is + never asserted from the wrong host; on a headend-identity run they are probed for real and + report not-yet-minted. Verdict unchanged at 7 findings on vcloud, harness **65/65**. + **CONSEQUENCE WORTH KNOWING BEFORE THE GENERATION RUNS:** P5's octavia rows are now judged + ONLY on voffice1. A vcloud preflight can no longer report on them at all -- correctly, but it + means the credential half of the Stage-5 entry gate must be read on the headend, which is the + same host P3/P4 already require. That is a narrowing of where preflight is authoritative, not + a widening, and it is the direct consequence of the ruled generation host. **F3 -- both `~/octavia-pki/` and `overlays/octavia-pki.yaml` are ABSENT here** (existence checked, no contents read). So this is generation FROM SCRATCH for both DCs: there is nothing to reuse, which retires the reuse-vs-regenerate choice diff --git a/runbooks/phase-01-bundle-deploy.md b/runbooks/phase-01-bundle-deploy.md index 5967d3b..f2f490a 100644 --- a/runbooks/phase-01-bundle-deploy.md +++ b/runbooks/phase-01-bundle-deploy.md @@ -327,10 +327,18 @@ > left the one fixed-name overlay carrying the wrong DC's CA -- which a later redeploy > of the first DC would then apply to it. Set `DC` ONCE here; everything below derives > from it, paths included. +> +> **RUN LOCATION RULED 2026-07-29 (D-109 ruling note (b)) -- this step runs ON `voffice1`, +> the D-128 Plane-2 headend, NOT the vcloud jumphost.** `juju` is ABSENT on vcloud and 3.6.27 +> on voffice1, and `dc-dc-phase4` deploys from voffice1 -- so generating here on the jumphost +> would mint the PKI on a host the deploy cannot read it from. Generate-then-transfer was +> declined: a second at-rest copy of a CA private key plus a plaintext passphrase widens the +> SEC-004 exposure R7 refused to widen. **`$REPO` below therefore means the HEADEND clone**, +> and the artifacts are registered at `host-role=headend`, not `jumphost`. -**RUN -- jumphost** +**RUN -- voffice1 (the D-128 Plane-2 headend; RULED 2026-07-29)** ```bash -# RUN: jumphost +# RUN: voffice1 export DC="${DC:-vr1-dc0}" # vr1-dc0 | vr1-dc1 -- region-qualified, never bare dcN export DC_LABEL="$(printf '%s' "$DC" | tr 'a-z-' 'A-Z ')" # e.g. "VR1 DC0" export REPO="${REPO:?REPO not set -- export REPO= (see runbooks/README.md Conventions)}" @@ -350,7 +358,7 @@ default outcome of re-running a step. ```bash -# RUN: jumphost +# RUN: voffice1 if [ -e "$WORKDIR/issuing-ca/issuing-ca.key.enc" ] || [ -e "$OCTAVIA_PKI_OVERLAY" ]; then echo "REFUSING: PKI material already exists for DC=$DC." echo " workspace: $WORKDIR" @@ -364,7 +372,7 @@ ### 1.0-GEN.a -- Issuing CA (EC P-384, AES-256 encrypted key, self-signed 10y) -**RUN -- jumphost** +**RUN -- voffice1 (the D-128 Plane-2 headend; RULED 2026-07-29)** > **R7 (D-109 AMENDMENT, RULED 2026-07-27) -- this generator is PER-DC.** It used to > bake `VR0 DC0` into both CA subjects and gate the VIP on `^10\.12\.4\.`, so it could @@ -398,7 +406,7 @@ The controller CA key is encrypted (its own passphrase) for future controller-cert rotation -- Octavia never receives this key, only the controller CA cert. -**RUN -- jumphost** +**RUN -- voffice1 (the D-128 Plane-2 headend; RULED 2026-07-29)** ```bash ( { WORKDIR="$HOME/octavia-pki/${DC:?DC not set -- run 1.0-GEN.0 first}" @@ -421,7 +429,7 @@ The P-256 key is unencrypted -- Octavia reads it at startup. SAN carries the controller FQDN, the octavia API FQDN, and the Octavia API VIP (derived from the bundle at generation time -- DOCFIX-067; never a baked literal). -**RUN -- jumphost** +**RUN -- voffice1 (the D-128 Plane-2 headend; RULED 2026-07-29)** ```bash ( { WORKDIR="$HOME/octavia-pki/${DC:?DC not set -- run 1.0-GEN.0 first}" @@ -531,7 +539,7 @@ > matching and the file would have been committable. The pattern is now a glob, and this > block ASSERTS that fact at generation time rather than trusting anyone to remember it. -**RUN -- jumphost** +**RUN -- voffice1 (the D-128 Plane-2 headend; RULED 2026-07-29)** ```bash ( { WORKDIR="$HOME/octavia-pki/${DC:?DC not set -- run 1.0-GEN.0 first}"