bb6dc8d7fc
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
66 lines
2.1 KiB
Markdown
66 lines
2.1 KiB
Markdown
---
|
|
id: KEY-WP-0011
|
|
type: workplan
|
|
title: "Recover from live KeyCape Secret output exposure"
|
|
domain: infotech
|
|
repo: key-cape
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
state_hub_workstream_id: "158aa957-8818-52ea-b7a5-3962cf30ba5e"
|
|
---
|
|
|
|
# KEY-WP-0011 — Live KeyCape Secret exposure recovery
|
|
|
|
Recover safely after the base64 data map of Kubernetes Secret
|
|
`sso/keycape-config` was mistakenly rendered in agent tool output during a
|
|
metadata check. Never reproduce, decode, or store the exposed payload.
|
|
|
|
## Contain and notify owners
|
|
|
|
```task
|
|
id: KEY-WP-0011-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "a8f5e33d-c725-5181-849e-a42bba34d3d8"
|
|
```
|
|
|
|
Stopped live rollout work, treated the payload as exposed, and notified
|
|
railiance-platform and NetKingdom without values. The affected classes are the
|
|
KeyCape RS256 signing private key and credentials embedded in `config.yaml`
|
|
(LLDAP bind credential, Authelia client credential, and privacyIDEA admin
|
|
token). No value was decoded, reused, or intentionally repeated and no live
|
|
mutation was attempted.
|
|
|
|
## Approve and execute coordinated rotation
|
|
|
|
```task
|
|
id: KEY-WP-0011-T02
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "9d60569c-a0f1-53a9-b4dc-01687ab92bcc"
|
|
```
|
|
|
|
Requires an approved owner-coordinated rotation plan. KeyCape signing-key
|
|
rollover must account for JWT/JWKS continuity or deliberate invalidation;
|
|
backend credential rotations must update each issuing system and every
|
|
consumer atomically enough to avoid an authentication outage. Secret values
|
|
must use approved custody transports and never enter Git, State Hub, chat,
|
|
arguments, or ordinary logs.
|
|
|
|
## Verify recovery without values
|
|
|
|
```task
|
|
id: KEY-WP-0011-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "a079573d-97fd-5c6c-b1f9-c0af65e2933a"
|
|
```
|
|
|
|
After rotation, verify new resource versions and non-secret fingerprints,
|
|
KeyCape readiness/discovery/JWKS, LLDAP lookup, Authelia authorization handoff,
|
|
privacyIDEA fail-closed MFA, and invalidation of the superseded credentials.
|
|
Verification must not render any Kubernetes Secret data or authentication
|
|
value.
|