coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the Secret template-dump trap and the 2026-09-23 exposure.

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
This commit is contained in:
tegwick 2026-09-23 22:12:04 +02:00
parent 709790a533
commit 49565a345b
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/operations.md
View file

@ -145,6 +145,12 @@ read it first. The parts that apply to KeyCape's objects in `sso` and `mfa`:
with `kubectl replace`. To test for the annotation without printing it: with `kubectl replace`. To test for the annotation without printing it:
`kubectl get secret <n> -n sso -o go-template='{{ if index .metadata.annotations "kubectl.kubernetes.io/last-applied-configuration" }}HAS-ANNOTATION{{ else }}clean{{ end }}'`. `kubectl get secret <n> -n sso -o go-template='{{ if index .metadata.annotations "kubectl.kubernetes.io/last-applied-configuration" }}HAS-ANNOTATION{{ else }}clean{{ end }}'`.
- **Never run any other go-template or jsonpath against a Secret.** When a
template fails, for example `len` on an absent field, kubectl prints the whole
raw object as debugging output, `.data` included. The presence check above is
the only tested template. This leaked `sso/keycape-config` into an agent
session on 2026-09-23 (see below).
**Open finding, 2026-09-23:** `sso/keycape-config`, `sso/authelia-secrets`, **Open finding, 2026-09-23:** `sso/keycape-config`, `sso/authelia-secrets`,
`sso/lldap-secrets` and `mfa/privacyidea-config` all carry that annotation. The `sso/lldap-secrets` and `mfa/privacyidea-config` all carry that annotation. The
earlier rotation script wrote them with `apply`; it now uses `replace`. Anyone earlier rotation script wrote them with `apply`; it now uses `replace`. Anyone
@ -155,6 +161,13 @@ is a live change and waits for the founder's go-ahead:
for each of the four. It prints no value and leaves `.data` untouched, so pods for each of the four. It prints no value and leaves `.data` untouched, so pods
need no restart. Re-check with the template above afterwards. need no restart. Re-check with the template above afterwards.
**Superseded the same day by an exposure.** While checking these Secrets' owners
before the cleanup, an agent ran an untested template. It failed and printed
`keycape-config` in full into the session transcript: the signing key, the LLDAP
bind password and the Authelia client secret. The other three Secrets were
probably printed as well. All four must be treated as exposed and rotated; the
annotation cleanup folds into that rotation.
## Unreleased fail-closed startup changes (read before the next rollout) ## Unreleased fail-closed startup changes (read before the next rollout)
The deployed image at the time of writing is The deployed image at the time of writing is