coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T05 phase 4: founder runbook for the LLDAP bind split
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-29 22:20:09 +01:00
parent e556af8571
commit 59aa0eeebb
2 changed files with 168 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -342,6 +342,19 @@ unchanged: its components carry their own Secrets with the new values, and ident
an identity-restore component (its password is re-derivable from custody). Phase 3 is complete;
phase 4 (runbook, founder rehearsal on a restored backup, live run) remains.
**2026-10-29 phase 4 (runbook and remaining consumer tools):** `sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md`
gives the founder-run order with checks and rollbacks: preconditions (restore drill on the current
backup, LLDAP pinned to the running digest only if it is v0.6.2, rebuilt provisioner image), prepare
custody, plan, accounts, verify, then one consumer at a time (provisioner, Authelia, KeyCape, privacyIDEA
resolver, LLDAP), then the human `admin` password change and `verify --old-admin-retired`, then the
restore drill on the next generation. New tools: `sso-mfa/k8s/keycape/directory-bind-rollout.py`
(`028a7a9`; edits only `lldap.bindDN`/`bindPW` in `sso/keycape-config`, inspect/dry-run/attended
apply with uid and resourceVersion test, `--operation revert`; 8 tests) and
`realm_bootstrap.py --switch-bind` (`e556af8`; only from the legacy `uid=admin` bind, only
`BINDDN`/`BINDPW`; 3 tests). Since phase 2b, `realm_bootstrap.py` refuses the live resolver until
`--switch-bind` runs. The founder's restore-drill rehearsal is the NK-WP-0053 run on the current
backup (precondition), and the post-split drill closes this task. Agent preparation is complete.
## Disposition of per-service admin accounts
```task