From 93704fd2424503007c20b458b62a7f7d994bb288 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 14:42:44 +0200 Subject: [PATCH] ops: restart identity provisioner during keycape rotation Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c --- ...Y-WP-0011-live-secret-exposure-recovery.md | 22 +++++++++++-------- tools/rotate-live-exposed-secret.sh | 4 ++++ 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/history/KEY-WP-0011-live-secret-exposure-recovery.md b/history/KEY-WP-0011-live-secret-exposure-recovery.md index 99952c5..77233c2 100644 --- a/history/KEY-WP-0011-live-secret-exposure-recovery.md +++ b/history/KEY-WP-0011-live-secret-exposure-recovery.md @@ -43,8 +43,8 @@ The final archive was not decrypted during verification. - `sso/authelia-secrets`: `51346049` - `sso/lldap-secrets`: `51345775` - `mfa/privacyidea-config`: `51345601` -- KeyCape, Authelia, LLDAP, and privacyIDEA each reported one Ready, updated, - available replica. +- KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner each reported + one Ready, updated, available replica. - LLDAP accepted the replacement credential before and after removal of `LLDAP_FORCE_LDAP_USER_PASS_RESET`; the final deployment has zero copies of that emergency setting. @@ -57,15 +57,19 @@ The final archive was not decrypted during verification. - The registered OpenBao local callback returned HTTP 302 to `auth.coulomb.social`. -## Discovered operational gap +## Follow-up disposition -The NetKingdom manifest currently code-defines the Authelia client verifier in -`authelia-config`, while its legacy rotation script updates only -`authelia-secrets/keycape_client_secret_hash`. The live recovery synchronized -both sources. NetKingdom should migrate the client verifier to an actually -consumed secret-file setting or update its rotation procedure so a later -manifest apply cannot restore a stale verifier. +NetKingdom resolved the manifest mismatch in revision `c956ceb`: Authelia's +OIDC client list now uses the supported template filter to read the verifier +from the Secret-mounted file. The revision was applied live and Authelia +returned Ready with startup complete. The credential-routing catalog also has no concrete native rotation entries for these legacy KeyCape backend credentials; generic and interactive-login routes were insufficient for incident execution. + +The remaining cross-repository follow-up is the privacyIDEA +`lldap-coulomb` resolver. It needs an attended provider-admin operation to +replace its persisted LLDAP bind password and prove a user lookup; no +unattended provider-admin credential was retained after the exposed JWT was +disabled. diff --git a/tools/rotate-live-exposed-secret.sh b/tools/rotate-live-exposed-secret.sh index 46a948f..a534fdb 100755 --- a/tools/rotate-live-exposed-secret.sh +++ b/tools/rotate-live-exposed-secret.sh @@ -248,6 +248,10 @@ kubectl set env deployment/lldap -n sso LLDAP_FORCE_LDAP_USER_PASS_RESET- >/dev/ lldap_force_reset_active=false kubectl rollout status deployment/lldap -n sso --timeout=180s +echo "rotation: restarting identity-provisioner consumer" +kubectl rollout restart deployment/identity-provisioner -n sso >/dev/null +kubectl rollout status deployment/identity-provisioner -n sso --timeout=180s + echo "rotation: updating Authelia and KeyCape consumers" authelia_patch="$work_dir/patch-authelia.json" ldap_b64="$(base64 -w0 <"$work_dir/lldap-bind-password")"