coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T04: svc-keycape delivery design proposal (KeyCape env override, dedicated ESO Secret)
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
tegwick 2026-10-31 10:21:30 +01:00
parent 76573deea2
commit 6aae759043
1 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/NK-WP-0056-bounded-executor-path.md
View file

@ -167,6 +167,23 @@ ESO apply (Ready first time), verify and Authelia restart passed, and an `admin`
Remaining: `svc-keycape` (bind inside `sso/keycape-config`), `svc-privacyidea` (resolver password stored in the
privacyIDEA database, not a Secret key).
**2026-10-31, `svc-keycape` design proposal (for founder decision):** KeyCape's server reads `lldap.bindPW` only
from `config.yaml` inside `sso/keycape-config` (`internal/config/config.go`); unlike client secrets (`secretRef:
env:...` via `secretKeyRef`) it has no environment indirection. ESO Merge cannot own one field inside a YAML
document, and rendering all of `config.yaml` from OpenBao would move every KeyCape value at once. Proposed:
1. key-cape (owner change, new KEY-WP): `config.Load` takes `KEYCAPE_LLDAP_BIND_PW` (the name `lldap-export`
already uses). Env set and `bindPW` empty: use env. Both set and equal: use it and log that `bindPW` is
redundant. Both set and different: refuse to start. This allows a staged switch with a clean rollback.
Image through the owner pipeline; `check-config` reports which source is used, without the value.
2. NetKingdom: CCR-2026-0054 and a `svc-keycape` lane; ESO creates a new dedicated Secret `keycape-lldap-bind`
(`creationPolicy: Owner`, key `password`), so no Secret has two writers. Setup compares custody with the live
`bindPW` in `keycape-config`.
3. Deployment: add the env from `secretKeyRef keycape-lldap-bind/password` with the new image; values are
equal, so behaviour is unchanged. Verify, restart, admin login.
4. Remove `bindPW` from `keycape-config` (`directory-bind-rollout.py --operation clear-password`, guarded on
uid/resourceVersion); `create-secrets.py` stops writing it. Rollback at any step: re-add the value or drop
the env.
## Synthetic verification instead of a founder sign-in
```task