Airframe

Why Airframe

Zero standing privilege

No person's everyday account, a maintainer's included, holds a role that can change production infrastructure. Outside a time-boxed grant, what changes it is a pipeline job whose short-lived identity is bound to one repository, a protected ref and an environment.

How a job gets an identity, and how a person gets access

  1. A job proves where it runs

    A pipeline job asks GitLab for a signed token that names its repository, its environment and whether its ref is protected. Google Cloud's workload identity federation checks the token; a token from outside the projectairframe group, a fork in a personal namespace included, is refused before any binding is read.

  2. An apply identity answers to one repository

    Each apply identity is bound to its product's repository, on a protected ref, in its own environment: the production one answers to jobs in the environment prod, and in grafana for the product's dashboards. A job on an unprotected branch, in another repository or in another environment gets nothing.

  3. No keys

    Service account keys cannot be created or uploaded: an organization policy on the demo organization's folder forbids both, and a deny policy blocks key creation for everyone but the break-glass group, the bootstrap administrator account and Privileged Access Manager's service agent. Credentials come from the job's token or from the metadata server.

  4. People get grants, not standing admin roles

    A maintainer who needs to change something requests a Privileged Access Manager grant with a justification. A grant of administrative roles needs the approval of another member of the platform group and lasts at most two hours; read access to a non-production project's logs and state is self-approved and lasts an hour. Every grant is in the audit log.

  5. An image is attested, then admitted

    The trusted builder builds each image from the approved commit. The executor checks Cloud Build's record of the build before a separate identity signs the build attestation, and promotion adds a second. Every service the golden path's Cloud Run module deploys opts into the Binary Authorization policy its project carries, which in production admits only an image with both; the policy is written once a product's projects are billed. The gate and this website run under the same rule.

  6. A flawed release can be revoked

    The platform's pipeline tooling ships as dated releases. Revoking one, a merge request to the list of permitted releases, makes the gate fail every new pipeline that still includes it, naming the release to move to.

Try it

Pick a GitLab job. This is the identity it may obtain, if any, from the bindings the platform's code declares at the release this site describes.

projectairframe/shop/store/ordering/orders · prod · protected

May obtain orders-apply@lk-store-orders-8k2p.iam.gserviceaccount.com

through the binding on the repository, environment and protected ref

Attribute: attribute.airframe/projectairframe/shop/store/ordering/orders/prod/true

What makes it true

No person's everyday account holds a standing role that can change production infrastructure.
The folders root and the project factories grant people viewer and log viewer roles, and the product template lets a team add versions of its production secrets, never read them. Administrative roles reach people only through Privileged Access Manager grants. Organization administration stays with one dedicated administrator account, used only for the bootstrap and exceptional procedures; a scheduled Policy Analyzer job fails if, at the organization node, that account holds any role but Organization Administrator, or any other person or group holds a standing role.
Only a job of the product's own repository, on a protected ref, in the right environment, can obtain its apply identity.
The project factory binds each apply identity to the composite attribute of repository path, environment and ref protection, with the protected value only; the identity pool's provider refuses any token from outside the projectairframe group.
No service account key can be created or uploaded under the demo organization's folder.
Organization policies at the folder disable key creation and upload for every principal, and an IAM deny policy blocks key creation for everyone but the break-glass group, the bootstrap administrator account and the Privileged Access Manager service agent.
A maintainer's administrative access within the demo organization's folder is temporary, and another member of the platform group approves it.
Privileged Access Manager entitlements that grant administrative roles require the approval of another member of the platform group, never the requester's own account, and last at most two hours; the one level 1 entitlement, on the platform's non-production project lk-runtime-np, grants read access to it for an hour, self-approved.
A product service deployed through the golden path runs only an image the platform built and promoted.
The golden path's Cloud Run module opts every service into the Binary Authorization policy its project carries, which in a billed product's production project is enforced and requires the build and promote attestations; the trusted-builder root lets only the build attestor and the artifact promoter sign with their keys.
A revoked release runs no new pipeline.
The gate's integrity job, which the group's pipeline execution policy injects into every pipeline, reads the permitted releases on control-plane's main and fails a pipeline that includes a revoked one; the executor makes the same check before a merge request or release run holds a product's credentials.