diff --git a/project/roadmap.md b/project/roadmap.md index 89d68d2..eb9a503 100644 --- a/project/roadmap.md +++ b/project/roadmap.md @@ -9,7 +9,7 @@ This document tracks the high-level goals and future development milestones for ## Phase 1: TYR Service Identity (SPIFFE/SVID) - [x] Deploy step-ca - [x] Bootstrap SPIRE -- [~] Establish Binary Authorization Infrastructure (staged, pending attestor creation) +- [x] Establish Binary Authorization Infrastructure ## Phase 3: Memory Bank & Project Management - [x] Implement `read_memory_bank` and `write_memory_bank` MCP tools. diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md index bfce9b6..d9259e5 100644 --- a/tyr/memory_bank/completed.md +++ b/tyr/memory_bank/completed.md @@ -9,5 +9,5 @@ - Notes: `install_spire.sh` executed and daemons are running. - **Phase 1.4: Binary Authorization** - - Status: **Staged** - - Notes: Policy YAML drafted, but blocked on creation of a KMS-based attestor resource. + - Status: **Complete** + - Notes: KMS key, attestor, and policy are created and active. diff --git a/tyr/policy/binauthz.yaml b/tyr/policy/binauthz.yaml index b16a243..eddf05d 100644 --- a/tyr/policy/binauthz.yaml +++ b/tyr/policy/binauthz.yaml @@ -5,14 +5,3 @@ defaultAdmissionRule: - projects/propane-will-491900-m5/attestors/tyr-kms-attestor globalPolicyEvaluationMode: ENABLE name: projects/propane-will-491900-m5/policy -attestationAuthorities: - "projects/propane-will-491900-m5/attestors/tyr-kms-attestor": - userOwnedGrafeasNote: - noteReference: "projects/propane-will-491900-m5/notes/cosign-attestor-note" # NOTE: This is a placeholder - publicKeys: - - pkixPublicKey: - publicKeyPem: |- - -----BEGIN PUBLIC KEY----- - MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEk7BUor5+RImB5EiI7imet3Xwm4vj - j0Fg0sXKY8icZfinWr3hwyGwSGmd/vq22OLjIhlhChTp10xXzKIVZyzQAA== - -----END PUBLIC KEY-----