diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json new file mode 100644 index 0000000..d2294f2 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json @@ -0,0 +1,14 @@ +{ + "action": "setup", + "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110", + "coding_agents_denied": true, + "custody_equals_live": true, + "external_secret_apply_and_verify_pending": true, + "kv_version": 1, + "lane": "svc-keycape", + "phase": "done", + "source_ccr": "CCR-2026-0054", + "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5", + "status": "custody_and_reader_prepared", + "values_recorded": false +} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json new file mode 100644 index 0000000..448ecb7 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json @@ -0,0 +1,18 @@ +{ + "action": "verify", + "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110", + "eso_delivery_equality_verified": true, + "exact_policy_and_ttl_verified": true, + "external_secret_ready": true, + "kv_version": 1, + "lane": "svc-keycape", + "phase": "done", + "sibling_metadata_and_token_create_denied": true, + "source_ccr": "CCR-2026-0054", + "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5", + "status": "reader_and_delivery_verified", + "temporary_reader_revoked": true, + "values_recorded": false, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json new file mode 100644 index 0000000..e1af090 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json @@ -0,0 +1 @@ +{"after": {"resource_version": "83122244", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "before": {"resource_version": "82820316", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "change_needed": true, "changed": true, "mode": "apply", "operation": "clear-password", "other_secret_data_unchanged": true, "prior_bind": "service", "restart_required": true, "schema": "netkingdom.keycape-directory-bind.v1", "target": "sso/keycape-config", "task": "NK-WP-0056-T04", "unrelated_config_bytes_preserved": true, "values_emitted": false} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json new file mode 100644 index 0000000..448ecb7 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json @@ -0,0 +1,18 @@ +{ + "action": "verify", + "ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110", + "eso_delivery_equality_verified": true, + "exact_policy_and_ttl_verified": true, + "external_secret_ready": true, + "kv_version": 1, + "lane": "svc-keycape", + "phase": "done", + "sibling_metadata_and_token_create_denied": true, + "source_ccr": "CCR-2026-0054", + "source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5", + "status": "reader_and_delivery_verified", + "temporary_reader_revoked": true, + "values_recorded": false, + "wrong_audience_denied": true, + "wrong_service_account_denied": true +} diff --git a/docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md new file mode 100644 index 0000000..8694906 --- /dev/null +++ b/docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md @@ -0,0 +1,21 @@ +# NK-WP-0056-T04 — svc-keycape bind in platform custody (2026-10-31) + +Founder-run in the founder's terminal under railiance-platform CCR-2026-0054 (approved by +platform-owner and net-kingdom-owner, binding confirmed, `5d87acd`; sha256 `e255807f…b110`). KeyCape reads +the bind from `KEYCAPE_LLDAP_BIND_PW` since key-cape `e2b5fa1` (KEY-WP-0046; image `main-e2b5fa1`, +`sha256:9e082dca…6f8d`). All receipts are value-free. + +| Step | Result | Receipt | +| --- | --- | --- | +| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | live `keycape-config` binds `uid=svc-keycape`; custody equal to its `bindPW`; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` | +| apply `sso-mfa/k8s/keycape/bind-eso.yaml` | dedicated Secret `keycape-lldap-bind` created by ESO (`creationPolicy: Owner`), Ready | operator output | +| verify (env and config) | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, other bind paths and token create denied; KV equals the delivered Secret and the config `bindPW` | `02-verify-env-and-config.json` | +| apply `deployment.yaml` (image `main-e2b5fa1` + `KEYCAPE_LLDAP_BIND_PW`) | server dry-run, apply, rolled out; log reports `bindPW` redundant once (both sources equal); `admin` portal sign-in with OTP (aal2) | operator output | +| `directory-bind-rollout.py clear-password` (dry-run, attended apply on uid/resourceVersion) | `bindPW` emptied; bind stays `svc-keycape`; unrelated config bytes and other Secret data unchanged | `03-clear-password.json` | +| restart KeyCape, verify (env only) | rolled out; no redundancy warning; KV equals the delivered Secret; `admin` portal sign-in with OTP (aal2) | `04-verify-env-only.json` | + +`svc-keycape`'s bind password now lives only in OpenBao +(`platform/workloads/net-kingdom/directory-binds/svc-keycape`), the ESO Secret and the founder's custody copy +(fallback); `keycape-config` no longer holds it. Rotation: change the password in LLDAP, write the next KV +version with CAS, restart KeyCape. Rollback: `directory-bind-rollout.py --operation switch` restores +`bindPW` from custody; the previous image is `sha256:cdec9dd7…f010` (then remove the env). diff --git a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age index 26b018e..4c5f910 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age index 8c7ddf4..bf20872 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age index 8945919..823e66e 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age and b/sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age index 92b9a51..efa233d 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age and b/sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age index 196cd7a..2fa3340 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age index 420494f..ba01232 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age index ef227fb..06768e8 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age index d365e83..f52b5ee 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age index f0c93a2..598585f 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age index 815e68f..f56887b 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age differ diff --git a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age index 0d431a2..b8a7e68 100644 Binary files a/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age and b/sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age differ diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 2a99638..4b9adf0 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -193,6 +193,13 @@ verify reads the dedicated Secret and requires it to equal `bindPW` while presen `deployment.yaml` pinned to the new image with the `KEYCAPE_LLDAP_BIND_PW` env. The new image also carries key-cape 67a0869..e2c5a94 (online token status, inactive while `tokenStatus` is unset) and identity-facts. Founder order: approve, setup, ESO apply, verify, deployment apply (image + env), login, clear-password, restart, login. + +**2026-10-31, `svc-keycape` live and verified:** CCR-2026-0054 approved and binding confirmed; founder-run setup, ESO +apply, verify, deployment rollout (image `main-e2b5fa1` + env; both sources equal), `admin` login, `clear-password`, +restart, env-only verify and a second `admin` login all passed +([evidence](../docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md)). Three of four binds are ESO-delivered; +`keycape-config` no longer holds the bind password. Remaining: `svc-privacyidea` (resolver password stored in the +privacyIDEA database, not a Secret key: needs its own design). the env. ## Synthetic verification instead of a founder sign-in