NK-WP-0056-T01 done: Bounded Execution Admission v0.1 (proposed)
Standard, schema and validator for the founder's admission of one bounded executor run: exact plan by digest, window by risk class, SI MODE @ SCOPE ceiling with least-privilege coverage, blast radius by consumer, named source-pinned checks, revert per mutating step, budget, single use, and the NK-WP-0040 receipt. check-approval verifies a carrier record (Approval Engine or founder SSH signature): aal2 human approver, not the executor, consumed at most once in the window. Examples express the bind split; step 10 is refused as human-intrinsic. 22 tests; make targets; tool index. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
parent
27b4ea6933
commit
989d5d4f5d
15 changed files with 2237 additions and 2 deletions
|
|
@ -0,0 +1,197 @@
|
|||
# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
|
||||
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
|
||||
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
|
||||
kind: BoundedExecutionAdmission
|
||||
spec:
|
||||
id: BEA-2026-0001
|
||||
title: Rotate the svc-authelia directory bind (bind-split steps 5-8, one consumer)
|
||||
purpose: 'Pilot shape for NK-WP-0056-T06: generate a new bind password into OpenBao, set it in LLDAP, let ESO deliver it,
|
||||
restart Authelia, prove sign-in with the synthetic journey; revert on any failed check.'
|
||||
work_ref: NK-WP-0056-T01 example
|
||||
risk_class: medium
|
||||
window:
|
||||
not_before: '2026-11-03T09:00:00Z'
|
||||
not_after: '2026-11-03T11:00:00Z'
|
||||
approval:
|
||||
approvers:
|
||||
- admin
|
||||
principal_type: HUMAN
|
||||
assurance: aal2
|
||||
carriers:
|
||||
- approval-engine
|
||||
- founder-ssh-signature
|
||||
executor:
|
||||
identity: service:nk-bind-executor
|
||||
principal_type: WORKLOAD
|
||||
runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
|
||||
scope_ceiling:
|
||||
- mode: OPERATE
|
||||
scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
|
||||
environments: &id001
|
||||
- PRODUCTION
|
||||
- mode: ADMINISTER
|
||||
scope: lldap/people/svc-authelia
|
||||
environments: *id001
|
||||
- mode: OPERATE
|
||||
scope: k8s/sso/externalsecret/authelia-secrets
|
||||
environments: *id001
|
||||
- mode: OPERATE
|
||||
scope: k8s/sso/deployment/authelia
|
||||
environments: *id001
|
||||
blast_radius:
|
||||
unit: consumer
|
||||
consumers:
|
||||
- authelia
|
||||
max_concurrent: 1
|
||||
trust_requires:
|
||||
- runtime_secret_trust
|
||||
- runtime_identity_trust
|
||||
plan:
|
||||
source:
|
||||
repo: net-kingdom
|
||||
commit: b8d3dacc4195
|
||||
files:
|
||||
- path: tools/service-binds/bind-lane.py
|
||||
sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
|
||||
- path: sso-mfa/k8s/synthetic-journey/journey.py
|
||||
sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
|
||||
steps:
|
||||
- id: generate
|
||||
operation: openbao.kv.write-next-version
|
||||
target: openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
|
||||
checks_after:
|
||||
- kv-advanced
|
||||
revert: restore-kv
|
||||
- id: set-directory
|
||||
operation: lldap.user.set-password-from-kv
|
||||
target: lldap:svc-authelia
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: ADMINISTER
|
||||
scope: lldap/people/svc-authelia
|
||||
checks_after:
|
||||
- bind-signs-in
|
||||
revert: restore-directory
|
||||
- id: deliver
|
||||
operation: eso.force-sync
|
||||
target: k8s:sso/externalsecret/authelia-secrets
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: k8s/sso/externalsecret/authelia-secrets
|
||||
checks_after:
|
||||
- secret-equals-kv
|
||||
revert: redeliver
|
||||
- id: restart
|
||||
operation: k8s.rollout-restart
|
||||
target: k8s:sso/deployment/authelia
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: k8s/sso/deployment/authelia
|
||||
checks_after:
|
||||
- synthetic-journey
|
||||
revert: restart-again
|
||||
revert_steps:
|
||||
- id: restore-kv
|
||||
operation: openbao.kv.write-previous-value-as-next-version
|
||||
target: openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
|
||||
- id: restore-directory
|
||||
operation: lldap.user.set-password-from-kv
|
||||
target: lldap:svc-authelia
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: ADMINISTER
|
||||
scope: lldap/people/svc-authelia
|
||||
- id: redeliver
|
||||
operation: eso.force-sync
|
||||
target: k8s:sso/externalsecret/authelia-secrets
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: k8s/sso/externalsecret/authelia-secrets
|
||||
- id: restart-again
|
||||
operation: k8s.rollout-restart
|
||||
target: k8s:sso/deployment/authelia
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: k8s/sso/deployment/authelia
|
||||
plan_digest: sha256:33129ab753da95f549fb27cfb5ba622e36fcba3c197f28b08fe3d4f9ff1d64a4
|
||||
checks:
|
||||
- id: kv-advanced
|
||||
description: KV svc-authelia has exactly one new version, CAS on the previous one
|
||||
ref: tools/service-binds/bind-lane.py
|
||||
sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
|
||||
timeout_seconds: 30
|
||||
expect: pass
|
||||
- id: bind-signs-in
|
||||
description: the new KV value signs in to LLDAP as svc-authelia
|
||||
ref: tools/service-binds/bind-lane.py
|
||||
sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
|
||||
timeout_seconds: 30
|
||||
expect: pass
|
||||
- id: secret-equals-kv
|
||||
description: 'bind-lane verify: ESO Ready and the delivered Secret equals KV, compared in memory'
|
||||
ref: tools/service-binds/bind-lane.py
|
||||
sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
|
||||
timeout_seconds: 120
|
||||
expect: pass
|
||||
- id: synthetic-journey
|
||||
description: syn-journey signs in through KeyCape, Authelia and privacyIDEA at aal2
|
||||
ref: sso-mfa/k8s/synthetic-journey/journey.py
|
||||
sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
|
||||
timeout_seconds: 90
|
||||
expect: pass
|
||||
stop_and_revert:
|
||||
on_check_failure: revert
|
||||
on_budget_exhausted: revert
|
||||
on_unknown: stop
|
||||
on_revert_failure: stop-and-alert
|
||||
alert: founder via State Hub message and audit-core
|
||||
budget:
|
||||
wall_time_seconds: 1200
|
||||
attempts: 2
|
||||
cost:
|
||||
compute_cpu_seconds: 120
|
||||
egress_bytes: 5000000
|
||||
currency: EUR
|
||||
amount: 0.05
|
||||
consumption:
|
||||
single_use: true
|
||||
consume_before_first_step: true
|
||||
receipt:
|
||||
schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
|
||||
emit_to: audit-core
|
||||
retain: by-hash-no-secret-values
|
||||
independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
|
||||
not_authorized:
|
||||
- any bind other than svc-authelia
|
||||
- any LLDAP group change
|
||||
- changing LLDAP's configured super-admin
|
||||
- reading or changing any human account
|
||||
- any change outside the sso namespace
|
||||
|
|
@ -0,0 +1,135 @@
|
|||
# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
|
||||
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
|
||||
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
|
||||
kind: BoundedExecutionAdmission
|
||||
spec:
|
||||
id: BEA-2026-0002
|
||||
title: Create the service bind accounts (bind-split step 3, root-class)
|
||||
purpose: 'Create svc-authelia, svc-keycape and svc-privacyidea in LLDAP as read-only binds. Needs lldap_admin: LLDAP has
|
||||
no narrower grant that can create users (SI-X6), so the founder admits this run and the executor runs it.'
|
||||
work_ref: NK-WP-0056-T01 example
|
||||
risk_class: high
|
||||
window:
|
||||
not_before: '2026-11-03T09:00:00Z'
|
||||
not_after: '2026-11-03T12:00:00Z'
|
||||
approval:
|
||||
approvers:
|
||||
- admin
|
||||
principal_type: HUMAN
|
||||
assurance: aal2
|
||||
carriers:
|
||||
- approval-engine
|
||||
- founder-ssh-signature
|
||||
executor:
|
||||
identity: service:nk-bind-executor
|
||||
principal_type: WORKLOAD
|
||||
runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
|
||||
scope_ceiling:
|
||||
- mode: ADMINISTER
|
||||
scope: lldap
|
||||
environments: &id001
|
||||
- PRODUCTION
|
||||
- mode: OPERATE
|
||||
scope: openbao/platform/workloads/net-kingdom/directory-binds
|
||||
environments: *id001
|
||||
blast_radius:
|
||||
unit: account
|
||||
consumers:
|
||||
- lldap
|
||||
max_concurrent: 1
|
||||
trust_requires:
|
||||
- runtime_secret_trust
|
||||
- runtime_identity_trust
|
||||
plan:
|
||||
source:
|
||||
repo: net-kingdom
|
||||
commit: b8d3dacc4195
|
||||
files:
|
||||
- path: sso-mfa/k8s/lldap/bind-split.py
|
||||
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
||||
- path: tools/service-binds/bind-lane.py
|
||||
sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
|
||||
steps:
|
||||
- id: create-accounts
|
||||
operation: lldap.user.create-read-only-binds
|
||||
target: lldap:svc-authelia,svc-keycape,svc-privacyidea
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: ADMINISTER
|
||||
scope: lldap
|
||||
checks_after:
|
||||
- accounts-read-only
|
||||
revert: delete-accounts
|
||||
- id: hold-passwords
|
||||
operation: openbao.kv.write-cas0
|
||||
target: openbao:platform/workloads/net-kingdom/directory-binds
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: openbao/platform/workloads/net-kingdom/directory-binds
|
||||
checks_after:
|
||||
- accounts-sign-in
|
||||
revert: destroy-kv
|
||||
revert_steps:
|
||||
- id: delete-accounts
|
||||
operation: lldap.user.delete-created
|
||||
target: lldap:svc-authelia,svc-keycape,svc-privacyidea
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: ADMINISTER
|
||||
scope: lldap
|
||||
- id: destroy-kv
|
||||
operation: openbao.kv.destroy-created
|
||||
target: openbao:platform/workloads/net-kingdom/directory-binds
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: openbao/platform/workloads/net-kingdom/directory-binds
|
||||
plan_digest: sha256:94910771c288437dbaeeba80e32a4f61ef1cdb7d438e7352d21a5e10fe92e77e
|
||||
checks:
|
||||
- id: accounts-read-only
|
||||
description: each account exists in lldap_strict_readonly only and cannot write
|
||||
ref: sso-mfa/k8s/lldap/bind-split.py
|
||||
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
||||
timeout_seconds: 60
|
||||
expect: pass
|
||||
- id: accounts-sign-in
|
||||
description: each KV value signs in to LLDAP as its account
|
||||
ref: tools/service-binds/bind-lane.py
|
||||
sha256: 5b31b3567af07bba09530c6d3b0ed8b5c947df22bd13ac0442dc33c0d9b420c0
|
||||
timeout_seconds: 60
|
||||
expect: pass
|
||||
stop_and_revert:
|
||||
on_check_failure: revert
|
||||
on_budget_exhausted: revert
|
||||
on_unknown: stop
|
||||
on_revert_failure: stop-and-alert
|
||||
alert: founder via State Hub message
|
||||
budget:
|
||||
wall_time_seconds: 900
|
||||
attempts: 1
|
||||
cost:
|
||||
compute_cpu_seconds: 60
|
||||
egress_bytes: 1000000
|
||||
currency: EUR
|
||||
amount: 0.02
|
||||
consumption:
|
||||
single_use: true
|
||||
consume_before_first_step: true
|
||||
receipt:
|
||||
schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
|
||||
emit_to: audit-core
|
||||
retain: by-hash-no-secret-values
|
||||
independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
|
||||
not_authorized:
|
||||
- switching any consumer to the new accounts
|
||||
- any human account
|
||||
- changing LLDAP's configured super-admin
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
|
||||
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
|
||||
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
|
||||
kind: BoundedExecutionAdmission
|
||||
spec:
|
||||
id: BEA-2026-0004
|
||||
title: Read-only verification of the directory split (bind-split steps 2, 4 and 10 verify)
|
||||
purpose: 'Plan and verify reads that the founder used to do signed in as admin: account inventory, group membership, bind
|
||||
identities of the consumers. No mutation, so nothing to revert.'
|
||||
work_ref: NK-WP-0056-T01 example
|
||||
risk_class: low
|
||||
window:
|
||||
not_before: '2026-11-03T09:00:00Z'
|
||||
not_after: '2026-11-04T09:00:00Z'
|
||||
approval:
|
||||
approvers:
|
||||
- admin
|
||||
principal_type: HUMAN
|
||||
assurance: aal2
|
||||
carriers:
|
||||
- approval-engine
|
||||
- founder-ssh-signature
|
||||
executor:
|
||||
identity: service:nk-bind-executor
|
||||
principal_type: WORKLOAD
|
||||
runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
|
||||
scope_ceiling:
|
||||
- mode: OBSERVE
|
||||
scope: lldap/people
|
||||
environments: &id001
|
||||
- PRODUCTION
|
||||
- mode: OBSERVE
|
||||
scope: k8s/sso
|
||||
environments: *id001
|
||||
blast_radius:
|
||||
unit: consumer
|
||||
consumers:
|
||||
- lldap
|
||||
- authelia
|
||||
- keycape
|
||||
- privacyidea
|
||||
max_concurrent: 4
|
||||
trust_requires:
|
||||
- runtime_secret_trust
|
||||
- runtime_identity_trust
|
||||
plan:
|
||||
source:
|
||||
repo: net-kingdom
|
||||
commit: b8d3dacc4195
|
||||
files:
|
||||
- path: sso-mfa/k8s/lldap/bind-split.py
|
||||
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
||||
steps:
|
||||
- id: inventory
|
||||
operation: lldap.read.users-and-groups
|
||||
target: lldap:people
|
||||
consumer: lldap
|
||||
class: delegable
|
||||
mutates: false
|
||||
requires:
|
||||
mode: OBSERVE
|
||||
scope: lldap/people
|
||||
checks_after:
|
||||
- split-shape
|
||||
- id: consumer-binds
|
||||
operation: k8s.read.bind-identities
|
||||
target: k8s:sso
|
||||
consumer: authelia
|
||||
class: delegable
|
||||
mutates: false
|
||||
requires:
|
||||
mode: OBSERVE
|
||||
scope: k8s/sso
|
||||
checks_after:
|
||||
- split-shape
|
||||
plan_digest: sha256:e4867e97a9957d543d5a7e265e56678ce22f3bb87bab64022b381dbee3e2610a
|
||||
checks:
|
||||
- id: split-shape
|
||||
description: every consumer binds as its own svc- account; no service binds as admin
|
||||
ref: sso-mfa/k8s/lldap/bind-split.py
|
||||
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
||||
timeout_seconds: 60
|
||||
expect: pass
|
||||
stop_and_revert:
|
||||
on_check_failure: stop
|
||||
on_budget_exhausted: stop
|
||||
on_unknown: stop
|
||||
on_revert_failure: stop-and-alert
|
||||
budget:
|
||||
wall_time_seconds: 300
|
||||
attempts: 3
|
||||
cost:
|
||||
compute_cpu_seconds: 30
|
||||
egress_bytes: 500000
|
||||
currency: EUR
|
||||
amount: 0.01
|
||||
consumption:
|
||||
single_use: true
|
||||
consume_before_first_step: true
|
||||
receipt:
|
||||
schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
|
||||
emit_to: audit-core
|
||||
retain: by-hash-no-secret-values
|
||||
independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
|
||||
not_authorized:
|
||||
- any write to LLDAP, Kubernetes or OpenBao
|
||||
|
|
@ -0,0 +1,136 @@
|
|||
# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
|
||||
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
|
||||
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
|
||||
kind: BoundedExecutionAdmission
|
||||
spec:
|
||||
id: BEA-2026-0003
|
||||
title: Switch LLDAP's configured super-admin to ld-admin (bind-split step 9, root-class)
|
||||
purpose: Change LLDAP_LDAP_USER_DN from admin to ld-admin and restart LLDAP; admin keeps its rights through lldap_admin
|
||||
membership. Changes who administers the directory, so the founder admits the run.
|
||||
work_ref: NK-WP-0056-T01 example
|
||||
risk_class: high
|
||||
window:
|
||||
not_before: '2026-11-03T09:00:00Z'
|
||||
not_after: '2026-11-03T11:00:00Z'
|
||||
approval:
|
||||
approvers:
|
||||
- admin
|
||||
principal_type: HUMAN
|
||||
assurance: aal2
|
||||
carriers:
|
||||
- approval-engine
|
||||
- founder-ssh-signature
|
||||
executor:
|
||||
identity: service:nk-bind-executor
|
||||
principal_type: WORKLOAD
|
||||
runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
|
||||
scope_ceiling:
|
||||
- mode: ADMINISTER
|
||||
scope: lldap
|
||||
environments: &id001
|
||||
- PRODUCTION
|
||||
- mode: OPERATE
|
||||
scope: k8s/sso/deployment/lldap
|
||||
environments: *id001
|
||||
blast_radius:
|
||||
unit: consumer
|
||||
consumers:
|
||||
- lldap
|
||||
max_concurrent: 1
|
||||
trust_requires:
|
||||
- runtime_secret_trust
|
||||
- runtime_identity_trust
|
||||
plan:
|
||||
source:
|
||||
repo: net-kingdom
|
||||
commit: b8d3dacc4195
|
||||
files:
|
||||
- path: sso-mfa/k8s/lldap/bind-split.py
|
||||
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
||||
- path: sso-mfa/k8s/synthetic-journey/journey.py
|
||||
sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
|
||||
steps:
|
||||
- id: switch-user-dn
|
||||
operation: lldap.config.set-ldap-user-dn
|
||||
target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: ADMINISTER
|
||||
scope: lldap
|
||||
checks_after:
|
||||
- ld-admin-administers
|
||||
revert: switch-back
|
||||
- id: restart-lldap
|
||||
operation: k8s.rollout-restart
|
||||
target: k8s:sso/deployment/lldap
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: k8s/sso/deployment/lldap
|
||||
checks_after:
|
||||
- synthetic-journey
|
||||
revert: restart-lldap-again
|
||||
revert_steps:
|
||||
- id: switch-back
|
||||
operation: lldap.config.set-ldap-user-dn
|
||||
target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: ADMINISTER
|
||||
scope: lldap
|
||||
- id: restart-lldap-again
|
||||
operation: k8s.rollout-restart
|
||||
target: k8s:sso/deployment/lldap
|
||||
consumer: lldap
|
||||
class: root-class
|
||||
mutates: true
|
||||
requires:
|
||||
mode: OPERATE
|
||||
scope: k8s/sso/deployment/lldap
|
||||
plan_digest: sha256:c15793ccaad212eaf24de12a1d13709970be84ee917a994463b68880e905dedf
|
||||
checks:
|
||||
- id: ld-admin-administers
|
||||
description: ld-admin signs in and administers; admin keeps lldap_admin membership
|
||||
ref: sso-mfa/k8s/lldap/bind-split.py
|
||||
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
||||
timeout_seconds: 60
|
||||
expect: pass
|
||||
- id: synthetic-journey
|
||||
description: 'all three binds still serve sign-in: syn-journey reaches aal2'
|
||||
ref: sso-mfa/k8s/synthetic-journey/journey.py
|
||||
sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
|
||||
timeout_seconds: 90
|
||||
expect: pass
|
||||
settle_seconds: 125
|
||||
stop_and_revert:
|
||||
on_check_failure: revert
|
||||
on_budget_exhausted: revert
|
||||
on_unknown: stop
|
||||
on_revert_failure: stop-and-alert
|
||||
alert: founder via State Hub message; crisis list item for ld-admin
|
||||
budget:
|
||||
wall_time_seconds: 900
|
||||
attempts: 1
|
||||
cost:
|
||||
compute_cpu_seconds: 60
|
||||
egress_bytes: 1000000
|
||||
currency: EUR
|
||||
amount: 0.02
|
||||
consumption:
|
||||
single_use: true
|
||||
consume_before_first_step: true
|
||||
receipt:
|
||||
schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
|
||||
emit_to: audit-core
|
||||
retain: by-hash-no-secret-values
|
||||
independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
|
||||
not_authorized:
|
||||
- changing admin's own password
|
||||
- sealing ld-admin's password (human-intrinsic, step 10)
|
||||
- any service bind change
|
||||
Loading…
Add table
Add a link
Reference in a new issue