Finish ACTIVITY-WP-0025 after NK-WP-0021 group allowlist.
Close T06: LLDAP activity-core-operators and Authelia domain rules are live in net-kingdom. Mark the workplan finished, update G10/runbook/SSO design with membership pointers, and clear residual handoff notes.
This commit is contained in:
parent
6134b82101
commit
fee89c4ea1
6 changed files with 49 additions and 32 deletions
2
SCOPE.md
2
SCOPE.md
|
|
@ -213,7 +213,7 @@ Open product/policy workplan: **ACTIVITY-WP-0022** (IssueSink no-default-Forgejo
|
|||
| **G7. Credential delivery** | Low (residual) | **FORGEJO_TOKEN** via ESO `actcore-forgejo-admin` (WP-0023-T05, Ready). issue-core `GITEA_BACKEND_TOKEN` still 503 forgejo-inbox for path A rest — **issue-core owner** (WP-0023-T06). |
|
||||
| **G8. Live-images hygiene** | Medium (ops) | Multi-cluster `live-images-all.txt` must be refreshed after deploys or prune can delete live tags (incident 2026-07-21, restored). `scripts/refresh_live_images.sh` (T04). |
|
||||
| **G9. Evidence federation** | Low | Progress often lands on railiance01 edge/hub; workstation primary hub may not show the same feed without tunnel/outbox health. |
|
||||
| **G10. API external access** | Medium (mostly done) | WP-0025: Traefik + Authelia SSO live for `activity.coulomb.social` + `temporal.coulomb.social`; port-forward break-glass; residual T06 group allowlist. |
|
||||
| **G10. API external access** | Done | WP-0025 finished: Traefik + Authelia SSO for ops + Temporal UI; LLDAP `activity-core-operators` (NK-WP-0021); port-forward break-glass only. |
|
||||
|
||||
### Drift risks
|
||||
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@
|
|||
| workplan | ACTIVITY-WP-0022 | finished | — | workplans/ACTIVITY-WP-0022-issuesink-no-default-forgejo.md |
|
||||
| workplan | ACTIVITY-WP-0023 | finished | — | workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md |
|
||||
| workplan | ACTIVITY-WP-0024 | finished | — | workplans/ACTIVITY-WP-0024-operator-automation-console.md |
|
||||
| workplan | ACTIVITY-WP-0025 | active | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| workplan | ACTIVITY-WP-0025 | finished | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| workplan | ADHOC-2026-06-01 | finished | — | workplans/ADHOC-2026-06-01.md |
|
||||
| workplan | custodian-WP-0001 | done | — | workplans/custodian-WP-0001-temporal-backbone.md |
|
||||
| workplan | custodian-WP-0002 | done | — | workplans/custodian-WP-0002-triggers-ops.md |
|
||||
|
|
@ -148,7 +148,7 @@
|
|||
| task | ACTIVITY-WP-0025-T03 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| task | ACTIVITY-WP-0025-T04 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| task | ACTIVITY-WP-0025-T05 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| task | ACTIVITY-WP-0025-T06 | wait | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| task | ACTIVITY-WP-0025-T06 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| task | ACTIVITY-WP-0025-T07 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| task | ACTIVITY-WP-0025-T08 | done | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
|
||||
| task | ADHOC-2026-06-01-T01 | done | — | workplans/ADHOC-2026-06-01.md |
|
||||
|
|
|
|||
|
|
@ -47,16 +47,18 @@ Response headers trusted into the app:
|
|||
|
||||
### Access control policy
|
||||
|
||||
Authelia global `default_policy: one_factor` currently applies. MVP accepts any
|
||||
authenticated Authelia user. Follow-up (T06) is filed as work-record intakes
|
||||
in **net-kingdom** (not hub-only notes):
|
||||
Authelia `default_policy: one_factor` for the fleet; **restricted hosts** use
|
||||
domain rules (NK-WP-0021, finished):
|
||||
|
||||
| Intake | Scope |
|
||||
| Host | Rule |
|
||||
| --- | --- |
|
||||
| `NK-IN-0001` | LLDAP group `activity-core-operators` + membership runbook |
|
||||
| `NK-IN-0002` | Authelia domain rules for `activity` + `temporal` hosts |
|
||||
| `activity.coulomb.social` | allow `group:activity-core-operators`, else deny |
|
||||
| `temporal.coulomb.social` | allow `group:activity-core-operators`, else deny |
|
||||
|
||||
See `net-kingdom/docs/intakes/activity-core-ops-sso-operators.md`.
|
||||
Membership: `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`
|
||||
(`./manage-group-members.sh add <uid> activity-core-operators`).
|
||||
|
||||
Intakes NK-IN-0001/0002 closed → promoted to **NK-WP-0021**.
|
||||
|
||||
## Mutation identity
|
||||
|
||||
|
|
|
|||
|
|
@ -120,6 +120,17 @@ the UI** — change definition files and sync.
|
|||
Login via Authelia (`auth.coulomb.social`). Design: `docs/ops-sso-access.md`.
|
||||
Mutations use SSO identity; shared token is break-glass only.
|
||||
|
||||
**Who may log in:** LLDAP group `activity-core-operators` (Authelia domain
|
||||
rules — net-kingdom NK-WP-0021). Add/remove members:
|
||||
|
||||
```bash
|
||||
# from net-kingdom checkout
|
||||
cd sso-mfa/k8s/lldap
|
||||
./manage-group-members.sh add <uid> activity-core-operators
|
||||
./manage-group-members.sh list activity-core-operators
|
||||
# full runbook: OPERATOR-GROUPS.md
|
||||
```
|
||||
|
||||
**DNS (already set for TLS):**
|
||||
|
||||
```text
|
||||
|
|
|
|||
|
|
@ -129,10 +129,10 @@ kubectl -n activity-core set env deploy/actcore-temporal-ui \
|
|||
TEMPORAL_CORS_ORIGINS=https://temporal.coulomb.social,http://localhost:8080,http://127.0.0.1:8080
|
||||
```
|
||||
|
||||
- Ops: https://activity.coulomb.social/ops/ui (Authelia SSO)
|
||||
- Ops: https://activity.coulomb.social/ops/ui (Authelia SSO; group `activity-core-operators`)
|
||||
- Temporal: https://temporal.coulomb.social
|
||||
- Design: `docs/ops-sso-access.md`
|
||||
- Follow-up: LLDAP group `activity-core-operators` + Authelia domain rules (T06)
|
||||
- Membership: `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md` (NK-WP-0021)
|
||||
|
||||
### Break-glass port-forward
|
||||
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "SSO access control for ops console and Temporal UI"
|
||||
domain: infotech
|
||||
repo: activity-core
|
||||
status: active
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: activity-core
|
||||
created: "2026-07-22"
|
||||
|
|
@ -170,7 +170,7 @@ token not required for normal operator use.
|
|||
|
||||
```task
|
||||
id: ACTIVITY-WP-0025-T06
|
||||
status: wait
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
|
||||
```
|
||||
|
|
@ -182,6 +182,13 @@ state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
|
|||
**Done when:** login works for a test operator and fails for an unprivileged
|
||||
account.
|
||||
|
||||
**Disposition (2026-07-22):** No new KeyCape/Keycloak OIDC client — fleet path
|
||||
is Traefik ForwardAuth → Authelia. Least-privilege group work implemented in
|
||||
**net-kingdom** `NK-WP-0021` (finished): LLDAP `activity-core-operators`,
|
||||
Authelia domain allow/deny for both public hosts, membership runbook
|
||||
`sso-mfa/k8s/lldap/OPERATOR-GROUPS.md`. Intakes NK-IN-0001/0002 closed
|
||||
`promoted_to: NK-WP-0021`.
|
||||
|
||||
## Task: Docs and runbook cutover
|
||||
|
||||
```task
|
||||
|
|
@ -216,7 +223,7 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
|
|||
## Success criteria
|
||||
|
||||
- [x] HTTPS SSO URLs for ops console and Temporal UI (no port-forward required)
|
||||
- [ ] Only authorized IdP group can access — **MVP: any Authelia user; T06 residual**
|
||||
- [x] Only authorized IdP group can access (`activity-core-operators` via NK-WP-0021)
|
||||
- [x] Ops mutations attribute to SSO identity; audits show principal (`sso:<user>`)
|
||||
- [x] Ops nav Temporal link points at SSO Temporal URL
|
||||
- [x] Runbook documents SSO primary + break-glass port-forward
|
||||
|
|
@ -253,7 +260,7 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
|
|||
| T03 | done | Ingress + cert Ready; unauth → 302 auth.coulomb.social |
|
||||
| T04 | done | Temporal Ingress + cert Ready; `ACTIVITY_CORE_TEMPORAL_UI_URL` + CORS set |
|
||||
| T05 | done | SSO `Remote-User` preferred; token break-glass; tests + redeploy |
|
||||
| T06 | wait | LLDAP group activity-core-operators + Authelia domain rules (net-kingdom) |
|
||||
| T06 | done | NK-WP-0021 finished: LLDAP group + Authelia domain rules live |
|
||||
| T07 | done | Runbook + k8s README + design doc: SSO primary, port-forward break-glass |
|
||||
| T08 | done | See verification checklist below |
|
||||
|
||||
|
|
@ -275,23 +282,20 @@ state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
|
|||
| NetworkPolicy ingress→services | **skipped** (optional; ClusterIP + Authelia sufficient for MVP) |
|
||||
| Full browser login + Run now under real MFA session | **operator smoke** (credentials not in agent) |
|
||||
|
||||
### Residual (keeps WP active)
|
||||
### Closeout 2026-07-22
|
||||
|
||||
**T06** — restrict Authelia access to LLDAP group `activity-core-operators`
|
||||
(net-kingdom Authelia access_control rules). Until then any authenticated
|
||||
Authelia user can reach the UIs (org-wide SSO, not least-privilege).
|
||||
All tasks **done**. Workplan **finished**.
|
||||
|
||||
**Work-record handoff (implementer = net-kingdom):**
|
||||
| Cross-repo | Result |
|
||||
| --- | --- |
|
||||
| NK-IN-0001 / NK-IN-0002 | closed, `promoted_to: NK-WP-0021` |
|
||||
| NK-WP-0021 | **finished** (LLDAP group, Authelia rules, OPERATOR-GROUPS.md) |
|
||||
| Authelia rules | `group:activity-core-operators` allow + domain deny for both hosts |
|
||||
| Membership | `net-kingdom/sso-mfa/k8s/lldap/OPERATOR-GROUPS.md` + `manage-group-members.sh` |
|
||||
|
||||
| Intake | Owner repo | Scope |
|
||||
| --- | --- | --- |
|
||||
| `NK-IN-0001` | net-kingdom | LLDAP group `activity-core-operators` + membership runbook |
|
||||
| `NK-IN-0002` | net-kingdom | Authelia `access_control` domain rules for both public hosts |
|
||||
**Operator grant:** add users to `activity-core-operators` per net-kingdom runbook
|
||||
before first SSO login to the public UIs.
|
||||
|
||||
Source file (canonical):
|
||||
`net-kingdom/docs/intakes/activity-core-ops-sso-operators.md`
|
||||
|
||||
When both intakes are promoted/done, mark **T06** `done` and finish this WP.
|
||||
|
||||
**Operator:** open https://activity.coulomb.social/ops/ui once, confirm inventory
|
||||
loads and a safe mutation (or dry path) shows `sso:<you>` in `/ops/audits`.
|
||||
**activity-core ownership remaining (ops, not open WP work):** break-glass
|
||||
port-forward + `ACTIVITY_CORE_OPERATOR_TOKEN`; keep Ingress/middleware in
|
||||
`k8s/railiance/30–32`.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue