coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T05: rehearsal findings and remaining phases recorded; lint fixes
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-28 19:01:40 +01:00
parent 84cc7bf13c
commit 3a83fed2c6
2 changed files with 236 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -265,6 +265,27 @@ then the founder runs the live steps as soon as the rehearsal passes. KeyCape's
as the directory admin from source (key-cape `a1ab8ff`, KEY-WP-0045-T03). The rotation lane is
`lldap-directory-bind` / `lldap-service-binds` in `tools/rotation-lanes/lanes.yaml`.
**2026-10-28 synthetic rehearsal (phase 1 of 4):** `sso-mfa/k8s/lldap/bind-split-rehearsal.py` (agent-run,
pinned LLDAP v0.6.2, generated passwords, 127.0.0.1 only, removed afterwards;
[receipt](../docs/evidence/2026-10-28-nk54-bind-split-rehearsal/synthetic-rehearsal.json)). Proven:
`ld-admin` can be introduced into a directory whose super-admin is `admin` and made the configured
super-admin by restart on the same data; `admin` keeps its rights through `lldap_admin` with its
password unchanged; `lldap_strict_readonly` binds read all users and groups and cannot write.
Findings: (1) `lldap_password_manager` cannot create users or add members, so the provisioner's
narrowest working group is `lldap_admin` (own account, but super-admin rights: needs an exception or
a provisioner redesign); (2) SI-3: every `svc-*` account can sign in to the LLDAP web UI; the UI is
IP-restricted, and Authelia's user filter must require `net-kingdom-users` membership; (3) production
`deployment.yaml` runs the unpinned `lldap/lldap:stable`, while the rehearsal and the restore tools pin
v0.6.2: pin production before the live run.
Remaining phases, each its own budgeted task: **(2)** consumer switch in source (Authelia configmap user
and users filter, KeyCape `create-secrets.py` bind, privacyIDEA `realm_bootstrap.py` resolver,
identity-provisioner deployment, LLDAP image pin) with a synthetic Authelia check of the filter;
**(3)** the guarded live helper (plan/apply/verify, value-free receipts, passwords only by hidden
prompt or fd) plus the backup profile and the restore adapters `isolated-lldap.py`,
`isolated-authelia.py`, `isolated-privacyidea-mfa.py`; **(4)** the founder runbook with filled-in
commands, a founder-run rehearsal on a restored backup, then the live run.
## Disposition of per-service admin accounts
```task