115 lines
4 KiB
YAML
115 lines
4 KiB
YAML
|
apiVersion: netkingdom.io/playbook-capability/v0.1
|
||
|
|
kind: PlaybookCapabilityDeclaration
|
||
|
|
metadata:
|
||
|
|
id: net-kingdom.local-identity
|
||
|
|
name: NetKingdom local bootstrap identity
|
||
|
|
owner: net-kingdom
|
||
|
|
repo: net-kingdom
|
||
|
|
domain: infotech
|
||
|
|
contract_version: "0.1"
|
||
|
|
source_links:
|
||
|
|
- label: implementation
|
||
|
|
path: local-identity/
|
||
|
|
- label: workplan
|
||
|
|
path: workplans/archived/260702-NK-WP-0002-local-identity.md
|
||
|
|
spec:
|
||
|
|
playbook:
|
||
|
|
path: local-identity/
|
||
|
|
type: cli-sequence
|
||
|
|
invocation: uv run --project local-identity local-identity init
|
||
|
|
description: Initialize and serve the loopback-only bootstrap OIDC identity store.
|
||
|
|
capabilities:
|
||
|
|
- id: c0.bootstrap-identity
|
||
|
|
tier: C0
|
||
|
|
resource_kinds:
|
||
|
|
- identities
|
||
|
|
- secrets_credentials
|
||
|
|
description: Provide a local OIDC issuer before the managed runtime identity plane exists.
|
||
|
|
parameters:
|
||
|
|
- name: local_identity_home
|
||
|
|
type: string
|
||
|
|
required: false
|
||
|
|
default: .local/local-identity
|
||
|
|
constraints:
|
||
|
|
pattern: ^[^\n\r]+$
|
||
|
|
sensitivity: operational
|
||
|
|
tuning_authority: netkingdom_tunable
|
||
|
|
description: LOCAL_IDENTITY_HOME used by the owning execution environment.
|
||
|
|
- name: bootstrap_username
|
||
|
|
type: string
|
||
|
|
required: true
|
||
|
|
constraints:
|
||
|
|
pattern: ^[a-z_][a-z0-9_-]{0,31}$
|
||
|
|
sensitivity: operational
|
||
|
|
tuning_authority: netkingdom_tunable
|
||
|
|
description: Bootstrap username passed to local-identity init.
|
||
|
|
- name: bootstrap_fullname
|
||
|
|
type: string
|
||
|
|
required: true
|
||
|
|
constraints:
|
||
|
|
pattern: ^[^\n\r]{1,120}$
|
||
|
|
sensitivity: operational
|
||
|
|
tuning_authority: netkingdom_tunable
|
||
|
|
description: Display name passed to local-identity init.
|
||
|
|
- name: bootstrap_email
|
||
|
|
type: string
|
||
|
|
required: true
|
||
|
|
constraints:
|
||
|
|
pattern: ^[^@\s]+@[^@\s]+$
|
||
|
|
sensitivity: operational
|
||
|
|
tuning_authority: netkingdom_tunable
|
||
|
|
description: Bootstrap email passed to local-identity init.
|
||
|
|
- name: listen_port
|
||
|
|
type: integer
|
||
|
|
required: false
|
||
|
|
default: 8443
|
||
|
|
constraints:
|
||
|
|
minimum: 1024
|
||
|
|
maximum: 65535
|
||
|
|
sensitivity: operational
|
||
|
|
tuning_authority: netkingdom_tunable
|
||
|
|
description: Loopback port passed to local-identity serve.
|
||
|
|
- name: token_ttl_seconds
|
||
|
|
type: integer
|
||
|
|
required: false
|
||
|
|
default: 3600
|
||
|
|
constraints:
|
||
|
|
minimum: 60
|
||
|
|
maximum: 3600
|
||
|
|
sensitivity: security_sensitive
|
||
|
|
tuning_authority: platform_only
|
||
|
|
description: Maximum bootstrap access-token lifetime.
|
||
|
|
responsibilities:
|
||
|
|
- resource_kind: identities
|
||
|
|
owner: net-kingdom
|
||
|
|
resources:
|
||
|
|
- local-identity:bootstrap-store
|
||
|
|
- local-identity:loopback-oidc-issuer
|
||
|
|
repo_owns: Local store initialization, loopback issuer behavior, token lifecycle, and security checks.
|
||
|
|
netkingdom_orchestrates: Select C0, provide non-secret bootstrap identity inputs, and require readiness evidence.
|
||
|
|
- resource_kind: secrets_credentials
|
||
|
|
owner: net-kingdom
|
||
|
|
resources:
|
||
|
|
- local-identity:signing-key
|
||
|
|
- local-identity:filesystem-permissions
|
||
|
|
repo_owns: Generate local signing material and enforce private filesystem permissions.
|
||
|
|
netkingdom_orchestrates: Constrain the store location and retain secret values outside the scenario plan.
|
||
|
|
trust:
|
||
|
|
requires:
|
||
|
|
- state: bare_host_trust
|
||
|
|
readiness_checks: []
|
||
|
|
satisfies:
|
||
|
|
- state: bootstrap_identity_trust
|
||
|
|
readiness_checks:
|
||
|
|
- id: local-identity-permissions
|
||
|
|
description: The local identity store and signing material have private permissions.
|
||
|
|
evidence: local-identity security-check exits zero
|
||
|
|
- id: local-identity-discovery
|
||
|
|
description: The loopback issuer serves OIDC discovery at the planned issuer URL.
|
||
|
|
evidence: discovery document is fetched from loopback and its issuer matches the planned port
|
||
|
|
catalog:
|
||
|
|
publish: capabilities/playbooks/net-kingdom.local-identity.yaml
|
||
|
|
maturity: implemented-reference
|
||
|
|
consumers:
|
||
|
|
- netkingdom-security-scenario-composer
|