ops: restart identity provisioner during keycape rotation

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

history/KEY-WP-0011-live-secret-exposure-recovery.md

@@ -43,8 +43,8 @@ The final archive was not decrypted during verification.
   - `sso/authelia-secrets`: `51346049`
   - `sso/lldap-secrets`: `51345775`
   - `mfa/privacyidea-config`: `51345601`
-- KeyCape, Authelia, LLDAP, and privacyIDEA each reported one Ready, updated,
-  available replica.
+- KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner each reported
+  one Ready, updated, available replica.
 - LLDAP accepted the replacement credential before and after removal of
   `LLDAP_FORCE_LDAP_USER_PASS_RESET`; the final deployment has zero copies of
   that emergency setting.
@@ -57,15 +57,19 @@ The final archive was not decrypted during verification.
 - The registered OpenBao local callback returned HTTP 302 to
   `auth.coulomb.social`.
 
-## Discovered operational gap
+## Follow-up disposition
 
-The NetKingdom manifest currently code-defines the Authelia client verifier in
-`authelia-config`, while its legacy rotation script updates only
-`authelia-secrets/keycape_client_secret_hash`. The live recovery synchronized
-both sources. NetKingdom should migrate the client verifier to an actually
-consumed secret-file setting or update its rotation procedure so a later
-manifest apply cannot restore a stale verifier.
+NetKingdom resolved the manifest mismatch in revision `c956ceb`: Authelia's
+OIDC client list now uses the supported template filter to read the verifier
+from the Secret-mounted file. The revision was applied live and Authelia
+returned Ready with startup complete.
 
 The credential-routing catalog also has no concrete native rotation entries
 for these legacy KeyCape backend credentials; generic and interactive-login
 routes were insufficient for incident execution.
+
+The remaining cross-repository follow-up is the privacyIDEA
+`lldap-coulomb` resolver. It needs an attended provider-admin operation to
+replace its persisted LLDAP bind password and prove a user lookup; no
+unattended provider-admin credential was retained after the exposed JWT was
+disabled.

tools/rotate-live-exposed-secret.sh

@@ -248,6 +248,10 @@ kubectl set env deployment/lldap -n sso LLDAP_FORCE_LDAP_USER_PASS_RESET- >/dev/
 lldap_force_reset_active=false
 kubectl rollout status deployment/lldap -n sso --timeout=180s
 
+echo "rotation: restarting identity-provisioner consumer"
+kubectl rollout restart deployment/identity-provisioner -n sso >/dev/null
+kubectl rollout status deployment/identity-provisioner -n sso --timeout=180s
+
 echo "rotation: updating Authelia and KeyCape consumers"
 authelia_patch="$work_dir/patch-authelia.json"
 ldap_b64="$(base64 -w0 <"$work_dir/lldap-bind-password")"