NK-WP-0054-T03: service identity schema, offline validator and first declarations
Schema, validator (30 tests), make targets and eight declarations authored from the
inventory, all unconfirmed by their owners. First run: 0 non-conformant, 12 unknown,
2 excepted, 5 planned, 6 conformant. Provisional: built against draft-1 before the
founder's review. Building it changed the draft: custody is a list, SI-X1 now covers
SI-9 and NAMING, and the reserved-name rule applies only to credential-holding
identities (open question 7). Unknown is a finding for every class.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2026-10-24 22:38:23 +02:00
|
|
|
schema_version: "0.1"
|
|
|
|
|
service: postgresql
|
|
|
|
|
owner: "railiance-platform (platform data services)"
|
|
|
|
|
declared_at: 2026-10-24
|
|
|
|
|
attestation:
|
|
|
|
|
authored_by: claude-code
|
|
|
|
|
basis: [sso-mfa/k8s/postgresql/cluster.yaml]
|
|
|
|
|
owner_confirmed: false
|
|
|
|
|
complete: false
|
|
|
|
|
identities:
|
|
|
|
|
- name: privacyidea
|
2026-10-24 23:35:30 +02:00
|
|
|
principal_type: SERVICE
|
|
|
|
|
purpose: "Database role owning privacyidea_db in the net-kingdom-pg cluster"
|
|
|
|
|
grants:
|
|
|
|
|
- {mode: USE, scope: privacyidea_db, activation: STANDING, environments: [PRODUCTION]}
|
|
|
|
|
- {mode: ADMINISTER, scope: privacyidea_db, activation: STANDING, environments: [PRODUCTION], note: "database owner"}
|
NK-WP-0054-T03: service identity schema, offline validator and first declarations
Schema, validator (30 tests), make targets and eight declarations authored from the
inventory, all unconfirmed by their owners. First run: 0 non-conformant, 12 unknown,
2 excepted, 5 planned, 6 conformant. Provisional: built against draft-1 before the
founder's review. Building it changed the draft: custody is a list, SI-X1 now covers
SI-9 and NAMING, and the reserved-name rule applies only to credential-holding
identities (open question 7). Unknown is a finding for every class.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
2026-10-24 22:38:23 +02:00
|
|
|
interactive_login: false
|
|
|
|
|
second_factor: not_applicable
|
|
|
|
|
custody: [delivered-secret]
|
|
|
|
|
consumers: [{name: privacyidea, kind: service}]
|
|
|
|
|
owner: "railiance-platform"
|
|
|
|
|
rotation: {path: "PI_DB_PASSWORD: atomic update of database and pod (Credential Management section 6)", coupling: [privacyidea]}
|
|
|
|
|
status: active
|
