coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: rotate exposed KeyCape credentials

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
This commit is contained in:
tegwick 2026-08-23 14:26:36 +02:00
parent c9fd9b1f9a
commit 6a996bd71e
5 changed files with 463 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

30
workplans/KEY-WP-0011-live-secret-exposure-recovery.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Recover from live KeyCape Secret output exposure"
domain: infotech
repo: key-cape
status: blocked
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-08-23"
@ -38,29 +38,31 @@ mutation was attempted.
```task
id: KEY-WP-0011-T02
status: wait
status: done
priority: high
state_hub_task_id: "9d60569c-a0f1-53a9-b4dc-01687ab92bcc"
```
Requires an approved owner-coordinated rotation plan. KeyCape signing-key
rollover must account for JWT/JWKS continuity or deliberate invalidation;
backend credential rotations must update each issuing system and every
consumer atomically enough to avoid an authentication outage. Secret values
must use approved custody transports and never enter Git, State Hub, chat,
arguments, or ordinary logs.
Approved by the operator on 2026-08-23, accepting deliberate invalidation of
active sessions and a brief SSO interruption. The RS256 key, LLDAP bind/admin
credential, Authelia-KeyCape client credential, and privacyIDEA application
signing secret were replaced without rendering values. The exposed
privacyIDEA admin JWT was removed from live use. Replacement material is
recoverable only through the NetKingdom age recipient in the encrypted
recovery overlay under `history/`.
## Verify recovery without values
```task
id: KEY-WP-0011-T03
status: wait
status: done
priority: high
state_hub_task_id: "a079573d-97fd-5c6c-b1f9-c0af65e2933a"
```
After rotation, verify new resource versions and non-secret fingerprints,
KeyCape readiness/discovery/JWKS, LLDAP lookup, Authelia authorization handoff,
privacyIDEA fail-closed MFA, and invalidation of the superseded credentials.
Verification must not render any Kubernetes Secret data or authentication
value.
Verified changed resource versions and public JWKS fingerprints, four Ready
deployments, successful replacement LLDAP and Authelia authentication,
wrong-secret rejection, explicit privacyIDEA fail-closed denial, issuer
discovery, and the OpenBao callback handoff to Authelia. The temporary LLDAP
force-reset flag was removed. No Kubernetes Secret payload or authentication
value was rendered during recovery.