A7 Credential management & rotation
- Area
- A — Getting started
- Audience
- operator
- Kind
- feature
- Status
- accepted
- Maturity
- built
- Labels
- security
The feature in the specification · Read at
Requirements
lemonfiber MUST provide a single inventory of every credential it holds, showing name, consumer, storage location, and validation state.
The inventory MUST NOT display credential values.
Credential values MUST NOT appear in logs, errors, dashboards, diagnostics, or support bundles.
- locked by
- 0.13.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/credential.rscrates/lemonfiber-core/src/credential/held.rscrates/lemonfiber-core/src/app/credentials/reading.rscrates/lemonfiber/src/render/credentials.rs
- cited by
- lemonfiber@a4c7d2dccelemonfiber@866fc172bclemonfiber@14f1111efclemonfiber@1543d54191lemonfiber@e1cb02261alemonfiber@588d3227a1lemonfiber@5b43ec7d1clemonfiber@122972daeblemonfiber@afe3a6b2f8lemonfiber@63f21a5f19lemonfiber@377eeee9b9lemonfiber@1d7aea4ae8lemonfiber@3469d76390lemonfiber@36ce848f93
Rotation MUST validate the replacement before destroying the existing value.
- locked by
- 0.13.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/credentials/rotating.rscrates/lemonfiber-core/src/credential/rotation.rscrates/lemonfiber-core/src/app/credentials/pending.rscrates/lemonfiber-core/src/app/credentials/resetting.rs
- cited by
- lemonfiber@a4c7d2dccelemonfiber@5540e6a62flemonfiber@0c0d5505ddlemonfiber@4388b37bfclemonfiber@122972daeb
On rotation failure, the existing credential MUST remain active and functional.
- locked by
- 0.13.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/credentials/rotating.rscrates/lemonfiber-core/src/credential/rotation.rscrates/lemonfiber-core/src/app/credentials/pending.rscrates/lemonfiber-core/src/app/credentials/resetting.rs
- cited by
- lemonfiber@a4c7d2dccelemonfiber@0c0d5505ddlemonfiber@4388b37bfclemonfiber@122972daeb
Successful rotation MUST propagate to every consumer and MUST report any consumer that could not be updated.
- locked by
- 0.13.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/credentials/rotating.rscrates/lemonfiber-core/src/credential/rotation.rscrates/lemonfiber-core/src/app/credentials/pending.rscrates/lemonfiber-core/src/app/credentials/resetting.rs
- cited by
- lemonfiber@5540e6a62flemonfiber@4388b37bfclemonfiber@122972daeb
lemonfiber MUST detect a service-regenerated API key and MUST re-propagate it.
- locked by
- 0.13.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/credentials/rotating.rscrates/lemonfiber-core/src/credential/rotation.rscrates/lemonfiber-core/src/app/credentials/pending.rscrates/lemonfiber-core/src/app/credentials/resetting.rs
- cited by
- lemonfiber@5540e6a62flemonfiber@122972daeb
Credential files MUST be created with permissions restricting access to the owning user.
lemonfiber MUST state accurately what its credential storage protects against, and MUST NOT overstate it.
- locked by
- 0.13.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/journal.rscrates/lemonfiber-core/src/app/recover.rscrates/lemonfiber-core/src/config/env.rscrates/lemonfiber-core/src/config/store.rscrates/lemonfiber/src/setup/interrupted.rscrates/lemonfiber/src/setup.rs
- cited by
- lemonfiber@6d343cd1d7lemonfiber@122972daeb
Revealing a stored credential MUST be possible, and MUST require explicit confirmation with a warning.
Stale credentials MUST be surfaced as advisories and MUST NOT be automatically expired.
Backups containing credentials MUST be labelled as sensitive at creation time.
Over-permissive credential file permissions MUST be reported as a diagnostic finding with a remedy.
Where a service mints only a temporary credential, lemonfiber MUST generate a durable replacement, set it on the service, and record it for its consumers. The operator MUST NOT be required to handle it.
Where an installed plugin consumes a credential lemonfiber rotates, that plugin MUST be among the consumers rotation propagates to, and one that could not be updated MUST be named in the report like any other.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/credentials.rscrates/lemonfiber-core/src/settings/run.rscrates/lemonfiber-core/src/settings/files.rscrates/lemonfiber-core/tests/integration/credential_inventory/republishing.rs::a_key_handed_out_again_reaches_the_plugin_that_reads_itcrates/lemonfiber-core/src/settings/tests/reaching.rs::replacing_a_crossing_credential_regenerates_and_restarts_what_reads_itcrates/lemonfiber-core/src/settings/tests/reaching.rs::a_reader_the_engine_would_not_recreate_is_named_as_not_reachedcrates/lemonfiber-core/src/settings/tests/reaching.rs::a_secrets_file_that_cannot_be_written_is_named_and_nothing_restarts
- cited by
- lemonfiber@e2005b9828