coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops: restart identity provisioner during keycape rotation

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
This commit is contained in:
tegwick 2026-08-23 14:42:44 +02:00
parent 6a996bd71e
commit 93704fd242
2 changed files with 17 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
history/KEY-WP-0011-live-secret-exposure-recovery.md
View file

@ -43,8 +43,8 @@ The final archive was not decrypted during verification.
- `sso/authelia-secrets`: `51346049` - `sso/authelia-secrets`: `51346049`
- `sso/lldap-secrets`: `51345775` - `sso/lldap-secrets`: `51345775`
- `mfa/privacyidea-config`: `51345601` - `mfa/privacyidea-config`: `51345601`
- KeyCape, Authelia, LLDAP, and privacyIDEA each reported one Ready, updated, - KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner each reported
available replica. one Ready, updated, available replica.
- LLDAP accepted the replacement credential before and after removal of - LLDAP accepted the replacement credential before and after removal of
`LLDAP_FORCE_LDAP_USER_PASS_RESET`; the final deployment has zero copies of `LLDAP_FORCE_LDAP_USER_PASS_RESET`; the final deployment has zero copies of
that emergency setting. that emergency setting.
@ -57,15 +57,19 @@ The final archive was not decrypted during verification.
- The registered OpenBao local callback returned HTTP 302 to - The registered OpenBao local callback returned HTTP 302 to
`auth.coulomb.social`. `auth.coulomb.social`.
## Discovered operational gap ## Follow-up disposition
The NetKingdom manifest currently code-defines the Authelia client verifier in NetKingdom resolved the manifest mismatch in revision `c956ceb`: Authelia's
`authelia-config`, while its legacy rotation script updates only OIDC client list now uses the supported template filter to read the verifier
`authelia-secrets/keycape_client_secret_hash`. The live recovery synchronized from the Secret-mounted file. The revision was applied live and Authelia
both sources. NetKingdom should migrate the client verifier to an actually returned Ready with startup complete.
consumed secret-file setting or update its rotation procedure so a later
manifest apply cannot restore a stale verifier.
The credential-routing catalog also has no concrete native rotation entries The credential-routing catalog also has no concrete native rotation entries
for these legacy KeyCape backend credentials; generic and interactive-login for these legacy KeyCape backend credentials; generic and interactive-login
routes were insufficient for incident execution. routes were insufficient for incident execution.
The remaining cross-repository follow-up is the privacyIDEA
`lldap-coulomb` resolver. It needs an attended provider-admin operation to
replace its persisted LLDAP bind password and prove a user lookup; no
unattended provider-admin credential was retained after the exposed JWT was
disabled.

4
tools/rotate-live-exposed-secret.sh
View file

@ -248,6 +248,10 @@ kubectl set env deployment/lldap -n sso LLDAP_FORCE_LDAP_USER_PASS_RESET- >/dev/
lldap_force_reset_active=false lldap_force_reset_active=false
kubectl rollout status deployment/lldap -n sso --timeout=180s kubectl rollout status deployment/lldap -n sso --timeout=180s
echo "rotation: restarting identity-provisioner consumer"
kubectl rollout restart deployment/identity-provisioner -n sso >/dev/null
kubectl rollout status deployment/identity-provisioner -n sso --timeout=180s
echo "rotation: updating Authelia and KeyCape consumers" echo "rotation: updating Authelia and KeyCape consumers"
authelia_patch="$work_dir/patch-authelia.json" authelia_patch="$work_dir/patch-authelia.json"
ldap_b64="$(base64 -w0 <"$work_dir/lldap-bind-password")" ldap_b64="$(base64 -w0 <"$work_dir/lldap-bind-password")"