tegwick
a140a4ab05
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
2.7 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | flavor | depends_on | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0046 | workplan | Directory bind password from the environment (KEYCAPE_LLDAP_BIND_PW) | infotech | key-cape | finished | claude-code | custodian | 2026-10-31 | 2026-10-31 | extension | 6feba59b-cd6f-5903-bc73-ed0241ce7f45 |
Accepted from net-kingdom NK-WP-0056-T04 (founder decision 2026-10-31: environment override, implemented by
claude-code in this repository). NetKingdom moves the LLDAP service binds from personal custody into OpenBao,
delivered by ESO. KeyCape reads lldap.bindPW only from config.yaml inside the keycape-config Secret, so
ESO cannot own that one value. With an environment override the bind is delivered from a dedicated Secret
key, as client secrets already are (secretRef: env:...).
Accept KEYCAPE_LLDAP_BIND_PW in config.Load
id: KEY-WP-0046-T01
status: done
priority: high
state_hub_task_id: "abc4b0d0-3b65-5dbb-9900-80ca17b9932a"
config.Load applies KEYCAPE_LLDAP_BIND_PW (the name lldap-export already reads): used when bindPW is
empty; accepted with a warning when equal to bindPW (migration state); startup refused when they differ,
with an error that names neither value. Config.LLDAPBindPWSource records the source; check-config reports
lldap_bind_pw_source and identity-facts reports password_source. Tests in
src/internal/config/config_test.go; docs/operations.md documents the variable.
Done when: the change is merged with tests and go vet/go test ./... pass.
Image through the owner pipeline
id: KEY-WP-0046-T02
status: done
priority: high
state_hub_task_id: "16e60917-d760-50b8-94b6-32b947f37dd9"
The Forgejo workflow builds the image from main. Record the digest here and in net-kingdom NK-WP-0056-T04;
net-kingdom pins it in sso-mfa/k8s/keycape/deployment.yaml together with the new environment entry.
Done when: an image built from a commit containing T01 is published, and its digest is recorded.
Done 2026-10-31: build-and-push succeeded for e2b5fa1; main-e2b5fa1 =
sha256:9e082dca78f65a4af3e92d3de3705b99e49ca9b298d9562ad0d37511c4306f8d, pinned in net-kingdom
sso-mfa/k8s/keycape/deployment.yaml (6c7c37a), not yet deployed. The acceptance job failed on this commit as
it did on a1ab8ff; provider-contract passed.
Deployed 2026-10-31: net-kingdom rolled out main-e2b5fa1 with KEYCAPE_LLDAP_BIND_PW from the ESO Secret
keycape-lldap-bind, then cleared bindPW from keycape-config; KeyCape runs on the environment value alone and
admin signs in (net-kingdom a656739, railiance-platform CCR-2026-0054). Workplan finished.