tegwick
a1ab8ff807
keycape identity-facts --config PATH and make identity-facts print client registry, directory bind and admin-surface facts without credential values or secret reference names. Fixture and committed-config tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
2.5 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | flavor | depends_on |
|---|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0045 | workplan | Value-safe identity facts export for the service-identity conformance check | infotech | key-cape | active | claude-code | custodian | 2026-10-28 | 2026-10-28 | extension |
Accepted from net-kingdom NK-WP-0054-T04 (State Hub message 74fdd863). NetKingdom's
tools/service-identity/validate.py compares declared identity facts with observed
ones under canon/standards/service-identity-privilege_v0.1.md; KeyCape supplies the
observed side as non-secret metadata. Nothing here reads a Secret, changes a live
deployment or registers anything.
Export identity facts from a KeyCape config
id: KEY-WP-0045-T01
status: done
priority: high
keycape identity-facts --config PATH (src/cmd/keycape/identityfacts.go) and
make identity-facts [IDENTITY_CONFIG=path] print schema
keycape-identity-facts/v0.1: per client the id, principal type, client type, grant
types, access-token audience (and whether it is registered or the client-id
default), scopes, service subject, tenant, roles, lifetime, MFA requirement and the
credential kind; the LLDAP bind DN, base DN and whether the bind is the directory
administrator; the privacyIDEA and Authelia credential kinds; and the fixed admin
surfaces. Credential fields and secret reference names are never copied. Tests:
src/cmd/keycape/identityfacts_test.go over a canary fixture and the committed
config/service-clients.example.yaml.
Live view of the deployed registry
id: KEY-WP-0045-T02
status: wait
priority: medium
The deployed config is the config.yaml key of Secret sso/keycape-config, and the
running image is distroless and predates this subcommand, so an agent cannot produce
the live view. Founder-run, streaming the config through the exporter without
writing it to disk:
kubectl -n sso get secret keycape-config -o jsonpath='{.data.config\.yaml}' \
| base64 -d | (cd ~/key-cape/src && go run ./cmd/keycape identity-facts --config /dev/stdin) \
> ~/keycape-identity-facts.live.json
The output is value-safe and can be handed to NetKingdom. Waiting on the founder.
Directory bind identity
id: KEY-WP-0045-T03
status: todo
priority: medium
The NetKingdom reference config binds LLDAP as uid=admin,ou=people,..., the
directory administrator; KeyCape only needs read access (internal/adapters/lldap).
A read-only bind account is a cross-repo change (LLDAP owner, custody, rollout) and
needs a NetKingdom/founder decision before any work.