coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T05 phase 3b: restore launchers follow the archived identities; startup proof
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-29 22:11:19 +01:00
parent e6f4e28164
commit 05a9aefaed
4 changed files with 81 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -326,6 +326,22 @@ rotations `lldap LLDAP_LDAP_USER_PASS` and `authelia LLDAP_SVC_AUTHELIA_PASS ->
existing Secrets are switched only by explicit, conditional rotation (97 tests). Left: 3b (backup
profile and the three restore launchers), then phase 4.
**2026-10-29 phase 3b (restore path):** no launcher change is needed, which corrects this task's
earlier assumption. `isolated-lldap.py` takes the configured super-admin name from the archived
deployment's `LLDAP_LDAP_USER_DN` and its password from the archived `lldap-secrets`, and prompts for
the password of the user under test; `isolated-authelia.py` binds with the archived configmap user and
`authelia-secrets`; `isolated-privacyidea-mfa.py` rewrites only the resolver `LDAPURI` and keeps the
archived bind DN and password. After the split all three therefore follow `ld-admin`, `svc-authelia`
and `svc-privacyidea` from the backup itself. Regression test: the configured admin follows the archived
deployment (`tests/test_isolated_lldap_recovery.py`). `bind-split-rehearsal.py --stage startup`
([receipt](../docs/evidence/2026-10-28-nk54-bind-split-rehearsal/synthetic-startup.json)) proves on
v0.6.2 that once `lldap_admin` has a member, LLDAP ignores the configured admin password and does not
create a missing configured admin: a backup taken at any point of the switch restores, and
**`bind-split.py accounts` must run before the LLDAP deployment switch**. The backup profile is
unchanged: its components carry their own Secrets with the new values, and identity-provisioner is not
an identity-restore component (its password is re-derivable from custody). Phase 3 is complete;
phase 4 (runbook, founder rehearsal on a restored backup, live run) remains.
## Disposition of per-service admin accounts
```task