bb6dc8d7fc
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
2.1 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0011 | workplan | Recover from live KeyCape Secret output exposure | infotech | key-cape | blocked | codex | netkingdom | 2026-08-23 | 2026-08-23 | 158aa957-8818-52ea-b7a5-3962cf30ba5e |
KEY-WP-0011 — Live KeyCape Secret exposure recovery
Recover safely after the base64 data map of Kubernetes Secret
sso/keycape-config was mistakenly rendered in agent tool output during a
metadata check. Never reproduce, decode, or store the exposed payload.
Contain and notify owners
id: KEY-WP-0011-T01
status: done
priority: high
state_hub_task_id: "a8f5e33d-c725-5181-849e-a42bba34d3d8"
Stopped live rollout work, treated the payload as exposed, and notified
railiance-platform and NetKingdom without values. The affected classes are the
KeyCape RS256 signing private key and credentials embedded in config.yaml
(LLDAP bind credential, Authelia client credential, and privacyIDEA admin
token). No value was decoded, reused, or intentionally repeated and no live
mutation was attempted.
Approve and execute coordinated rotation
id: KEY-WP-0011-T02
status: wait
priority: high
state_hub_task_id: "9d60569c-a0f1-53a9-b4dc-01687ab92bcc"
Requires an approved owner-coordinated rotation plan. KeyCape signing-key rollover must account for JWT/JWKS continuity or deliberate invalidation; backend credential rotations must update each issuing system and every consumer atomically enough to avoid an authentication outage. Secret values must use approved custody transports and never enter Git, State Hub, chat, arguments, or ordinary logs.
Verify recovery without values
id: KEY-WP-0011-T03
status: wait
priority: high
state_hub_task_id: "a079573d-97fd-5c6c-b1f9-c0af65e2933a"
After rotation, verify new resource versions and non-secret fingerprints, KeyCape readiness/discovery/JWKS, LLDAP lookup, Authelia authorization handoff, privacyIDEA fail-closed MFA, and invalidation of the superseded credentials. Verification must not render any Kubernetes Secret data or authentication value.