That makes the bridge concrete. Scoped credentials only limit the blast radius if the admin macaroon and every path that can recreate it stay outside the web-facing host and process.
In this case, did the fix remove the admin macaroon from that box entirely, or could a recovery path still recreate it there?
That makes the bridge concrete. Scoped credentials only limit the blast radius if the admin macaroon and every path that can recreate it stay outside the web-facing host and process.
In this case, did the fix remove the admin macaroon from that box entirely, or could a recovery path still recreate it there?