From 6aae75904301dbcd6dfdb275203ec0aadc07bc73 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 10:21:30 +0100 Subject: [PATCH] NK-WP-0056-T04: svc-keycape delivery design proposal (KeyCape env override, dedicated ESO Secret) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2 --- workplans/NK-WP-0056-bounded-executor-path.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 414c819..68d0aac 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -167,6 +167,23 @@ ESO apply (Ready first time), verify and Authelia restart passed, and an `admin` Remaining: `svc-keycape` (bind inside `sso/keycape-config`), `svc-privacyidea` (resolver password stored in the privacyIDEA database, not a Secret key). +**2026-10-31, `svc-keycape` design proposal (for founder decision):** KeyCape's server reads `lldap.bindPW` only +from `config.yaml` inside `sso/keycape-config` (`internal/config/config.go`); unlike client secrets (`secretRef: +env:...` via `secretKeyRef`) it has no environment indirection. ESO Merge cannot own one field inside a YAML +document, and rendering all of `config.yaml` from OpenBao would move every KeyCape value at once. Proposed: +1. key-cape (owner change, new KEY-WP): `config.Load` takes `KEYCAPE_LLDAP_BIND_PW` (the name `lldap-export` + already uses). Env set and `bindPW` empty: use env. Both set and equal: use it and log that `bindPW` is + redundant. Both set and different: refuse to start. This allows a staged switch with a clean rollback. + Image through the owner pipeline; `check-config` reports which source is used, without the value. +2. NetKingdom: CCR-2026-0054 and a `svc-keycape` lane; ESO creates a new dedicated Secret `keycape-lldap-bind` + (`creationPolicy: Owner`, key `password`), so no Secret has two writers. Setup compares custody with the live + `bindPW` in `keycape-config`. +3. Deployment: add the env from `secretKeyRef keycape-lldap-bind/password` with the new image; values are + equal, so behaviour is unchanged. Verify, restart, admin login. +4. Remove `bindPW` from `keycape-config` (`directory-bind-rollout.py --operation clear-password`, guarded on + uid/resourceVersion); `create-secrets.py` stops writing it. Rollback at any step: re-add the value or drop + the env. + ## Synthetic verification instead of a founder sign-in ```task