coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0033 add attended resolver reconciliation receipt
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
This commit is contained in:
tegwick 2026-08-23 15:18:29 +02:00
parent eec7007c21
commit 5b0a521c9a
3 changed files with 225 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
View file

@ -117,11 +117,13 @@ clients are a list, so the verifier now uses Authelia's supported template
filter over the Secret-mounted file. The revision was applied live and
Authelia returned Ready with startup complete.
NetKingdom also added the unattended-safe shape of the remaining provider
operation in `sso-mfa/k8s/privacyidea/update-lldap-resolver-live.sh`. It is
explicitly gated by `--apply`, requires an interactive terminal, uses protected
0600 files, updates only `lldap-coulomb`, and emits no credential values. It
has not been run; the exact attended runbook is pinned in
NetKingdom now provides the supported one-command attended operation in
`sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh`. It is explicitly
gated by `--apply`, requires an interactive terminal, uses protected 0600
files, updates only `lldap-coulomb`, proves replacement resolver lookup and
privacyIDEA MFA, proves predecessor LLDAP denial with explicit 401/403 status,
rechecks readiness/health, and emits one sanitized PASS/FAIL receipt after
cleanup. It has not been run; the exact attended runbook is pinned in
`docs/keycape-exposure-resolver-reconciliation.md`.
Do not use `sso-mfa/bootstrap/creds-rotate.sh` through an agent as currently