From 4815c58dce3dca9f79aa819fcbdb88035c52eb97 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 19:02:09 +0100 Subject: [PATCH] NK-WP-0056-T10: examples re-pinned at 1cdc18f; gaps fixed, what is left Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- .../bind-rotation-svc-authelia.yaml | 14 +++++------ .../bind-split-create-service-accounts.yaml | 4 ++-- .../bind-split-read-only-verify.yaml | 4 ++-- .../bind-split-switch-super-admin.yaml | 4 ++-- .../invalid/human-intrinsic-step.yaml | 4 ++-- workplans/NK-WP-0056-bounded-executor-path.md | 24 ++++++++++++++++++- 6 files changed, 38 insertions(+), 16 deletions(-) diff --git a/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml b/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml index 1797edf..af94235 100644 --- a/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml +++ b/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml @@ -49,12 +49,12 @@ spec: plan: source: repo: net-kingdom - commit: fe18096aa398 + commit: 1cdc18f75f7e files: - path: bounded-executor/executor.py sha256: d724f4f831640c92b8b542dd2adab2e77f40d87d88f46d9482bff9fdcc4f6c70 - path: bounded-executor/operations.py - sha256: f6deabb65ee308b70b9adaa07f0449cd880534ef8c603c6e278c999bdb4106c8 + sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13 - path: sso-mfa/k8s/synthetic-journey/journey.py sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c steps: @@ -151,30 +151,30 @@ spec: scope: k8s/sso/deployment/authelia checks_after: - synthetic-journey - plan_digest: sha256:7e5a93a864110dcde76df56bbb890b5642306fd506940323eedd62155dcab364 + plan_digest: sha256:4d9dee9c88fe49fee1b93f462ccf00bdfa9fa3c197ac0400998792b91992843f checks: - id: kv-advanced description: KV svc-authelia has exactly one new version, CAS on the previous one ref: bounded-executor/operations.py - sha256: f6deabb65ee308b70b9adaa07f0449cd880534ef8c603c6e278c999bdb4106c8 + sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13 timeout_seconds: 30 expect: pass - id: bind-signs-in description: the new KV value signs in to LLDAP as svc-authelia ref: bounded-executor/operations.py - sha256: f6deabb65ee308b70b9adaa07f0449cd880534ef8c603c6e278c999bdb4106c8 + sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13 timeout_seconds: 30 expect: pass - id: eso-synced description: the ExternalSecret is Ready with a refresh after the step started; the executor never reads the Secret ref: bounded-executor/operations.py - sha256: f6deabb65ee308b70b9adaa07f0449cd880534ef8c603c6e278c999bdb4106c8 + sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13 timeout_seconds: 120 expect: pass - id: synthetic-journey description: syn-journey signs in through KeyCape, Authelia and privacyIDEA at aal2 ref: bounded-executor/operations.py - sha256: f6deabb65ee308b70b9adaa07f0449cd880534ef8c603c6e278c999bdb4106c8 + sha256: fbabed4f051978b8202d390455e07d374d171d02197d87fcefd9394982934f13 timeout_seconds: 90 expect: pass stop_and_revert: diff --git a/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml b/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml index 437f1e0..d97b116 100644 --- a/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml +++ b/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml @@ -43,7 +43,7 @@ spec: plan: source: repo: net-kingdom - commit: fe18096aa398 + commit: 1cdc18f75f7e files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -97,7 +97,7 @@ spec: scope: openbao/platform/workloads/net-kingdom/directory-binds checks_after: - accounts-sign-in - plan_digest: sha256:ad9f23b9ba366b9749e17b290e9583973463afcec021aa6ed9c2ce7bf9706bac + plan_digest: sha256:775ea5a7f0bdef09112c9646bd473931551be0911b70901ab607c424587595a5 checks: - id: accounts-read-only description: each account exists in lldap_strict_readonly only and cannot write diff --git a/examples/bounded-execution-admission/bind-split-read-only-verify.yaml b/examples/bounded-execution-admission/bind-split-read-only-verify.yaml index d3f9ac5..9f5709d 100644 --- a/examples/bounded-execution-admission/bind-split-read-only-verify.yaml +++ b/examples/bounded-execution-admission/bind-split-read-only-verify.yaml @@ -46,7 +46,7 @@ spec: plan: source: repo: net-kingdom - commit: fe18096aa398 + commit: 1cdc18f75f7e files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -73,7 +73,7 @@ spec: scope: k8s/sso checks_after: - split-shape - plan_digest: sha256:fe39d7f0eb2d04369e505dbd6a4ed8e028ec4263ef6bff10a3d1d41db9ddb6da + plan_digest: sha256:2e31c9dfdccd4e3d6320dd0616ae778df94438ea4a64e602a12781da9ad9dcc3 checks: - id: split-shape description: every consumer binds as its own svc- account; no service binds as admin diff --git a/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml b/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml index 5dc1de1..6f3c17f 100644 --- a/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml +++ b/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml @@ -43,7 +43,7 @@ spec: plan: source: repo: net-kingdom - commit: fe18096aa398 + commit: 1cdc18f75f7e files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -97,7 +97,7 @@ spec: scope: k8s/sso/deployment/lldap checks_after: - synthetic-journey - plan_digest: sha256:f9ff4e81d9e998e709a2aa41b938d595cf671a1bbd0a43e157de572889b07218 + plan_digest: sha256:fb8c00c3cd580b365cd9ce49fb952c861e92fb6bcf0102b37c2bc7620da3899d checks: - id: ld-admin-administers description: ld-admin signs in and administers; admin keeps lldap_admin membership diff --git a/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml b/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml index e8ba3b1..811ebc7 100644 --- a/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml +++ b/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml @@ -42,7 +42,7 @@ spec: plan: source: repo: net-kingdom - commit: fe18096aa398 + commit: 1cdc18f75f7e files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -108,7 +108,7 @@ spec: scope: k8s/sso/deployment/lldap checks_after: - synthetic-journey - plan_digest: sha256:dd7e679008345e0d36d09c065b3fdf92dab5c4c5d5bd48eb048844df24a0de13 + plan_digest: sha256:20b40b06bae8386877f24eb2450e9582c041e198802bd0356b12113d4b5c9660 checks: - id: ld-admin-administers description: ld-admin signs in and administers; admin keeps lldap_admin membership diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 39b7dd3..078db0a 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -412,7 +412,7 @@ against a deliberately broken bind on a synthetic directory (T08). - Done: the `sso` ingress rules for executor pods were applied by the founder and read back live. - Done: railiance-platform CCR-2026-0059 drafted (`c9b68ea`, `proposed`). It is the journey read with its own role, - `net-kingdom-bind-executor-syn-journey-read`. It widens CCR-2026-0057 and proposes a standing reader. + `net-kingdom-bind-executor-syn-journey-read`. It widens CCR-2026-0057; standing reader (founder decision). - Two executor gaps found while drafting it: 1. **Two roles.** The executor logs in to OpenBao once (`openbao.k8s_role`) and reads the bind and the journey with that token. railiance-platform keeps one role per lane and never combines policies, so the executor needs a @@ -422,6 +422,28 @@ against a deliberately broken bind on a synthetic directory (T08). to it. - Both need an executor change, a new image and a new pin. +**2026-10-31, gaps fixed** ([evidence](../docs/evidence/2026-10-31-nk56-t10-openbao-lanes/README.md)): + +- `1cdc18f`: one OpenBao client per lane, and one role for both lanes is refused. +- Every login is revoked at exit, also when setup fails. +- A third gap was found and fixed: the 15m token is shorter than the 20m budget, so clients now log in again before + the lease ends, re-reading the rotating JWT. +- Synthetic pilot with per-lane tokens: completed and reverted, `all_met`. Examples re-pinned. +- rapp `368fee4`: + - a second projected token with audience `openbao`; + - the config names both CCR roles; + - the renderer refuses other roles and the API token; + - tests tie the roles to the platform CCRs. +- The founder chose a standing journey reader. CCR-2026-0059 records it (railiance-platform `98a8b08`). + +Left: + +- the image for the new commit, and its pin in the rapp; +- founder approval of CCR-2026-0059; +- `make deploy` of the standing objects, then `confirm-binding`; +- applying the policy and roles (platform-admin); +- the approval-engine and audit-core replies and the token Secret. + ## Executor runtime: core runner ```task