coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T05 phase 2b: each directory consumer binds with its own account
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Identity provider journey acceptance / provider (push) Failing after 12s
Details
Build and Publish identity-provisioner / build-and-push (push) Successful in 50s
Details

Browse source 
Custody gains LLDAP_SVC_{AUTHELIA,KEYCAPE,PRIVACYIDEA,PROVISIONER}_PASS and
LLDAP_LDAP_USER_PASS becomes ld-admin's. Authelia, KeyCape, the privacyIDEA
resolver and identity-provisioner (new Secret identity-provisioner-ldap) switch
to svc-* accounts; LLDAP's configured super-admin is ld-admin. The LLDAP image
pin waits for the running digest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-28 20:33:04 +01:00
parent 2ebc4f0ae8
commit 145ca8e08c
17 changed files with 76 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -289,6 +289,20 @@ commands, a founder-run rehearsal on a restored backup, then the live run.
2026-10-28 founder decision: `svc-provisioner` gets its own account in `lldap_admin`, recorded as
exception SI-X6 (SI-3, expires 2027-04-30) in the standard and `declarations/lldap.yaml`.
**2026-10-28 phase 2 (source switch), parts a and b:** `identity-provisioner` logs in as
`LLDAP_ADMIN_USERNAME` (default `admin`) and refuses chosen usernames starting `svc-` or ending
`-admin` (`2ebc4f0`; its image needs a rebuild through the owner pipeline). Custody: the LLDAP
custody file now carries `LLDAP_LDAP_USER_PASS` as the `ld-admin` password plus
`LLDAP_SVC_{AUTHELIA,KEYCAPE,PRIVACYIDEA,PROVISIONER}_PASS`; the human `admin` password leaves
custody. Consumers: Authelia binds as `svc-authelia` (`ldap_password` from its own key), KeyCape as
`svc-keycape` (`create-secrets.py`, `bootstrap-config.json`), the privacyIDEA resolver as
`svc-privacyidea` (`realm_bootstrap.py`), the provisioner from the new Secret
`identity-provisioner-ldap` (`create-secrets.sh`, deployment, `identity-provisioner-reconcile.py`).
LLDAP's deployment sets `LLDAP_LDAP_USER_DN=ld-admin`. The image is **not** pinned yet: production
runs `lldap/lldap:stable`, and pinning to v0.6.2 could downgrade the database; the runbook reads the
running digest first. Service-account emails use `@service.netkingdom.invalid`. Left: 2c (Authelia
users filter requiring `net-kingdom-users`, synthetic check), then phases 3 and 4.
## Disposition of per-service admin accounts
```task