coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T04: svc-keycape bind delivered from OpenBao; bindPW cleared from keycape-config
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Founder-run under CCR-2026-0054: setup, ESO apply, verify, rollout of KeyCape
main-e2b5fa1 with KEYCAPE_LLDAP_BIND_PW, clear-password, restart, env-only verify;
admin signed in with OTP before and after the clear. Custody re-sealed after setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
tegwick 2026-10-31 10:52:05 +01:00
parent 6c7c37aa70
commit a65673985c
17 changed files with 79 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/evidence/2026-10-31-nk56-svc-keycape-bind/01-setup.json Normal file
View file

@ -0,0 +1,14 @@
{
"action": "setup",
"ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110",
"coding_agents_denied": true,
"custody_equals_live": true,
"external_secret_apply_and_verify_pending": true,
"kv_version": 1,
"lane": "svc-keycape",
"phase": "done",
"source_ccr": "CCR-2026-0054",
"source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5",
"status": "custody_and_reader_prepared",
"values_recorded": false
}

18
docs/evidence/2026-10-31-nk56-svc-keycape-bind/02-verify-env-and-config.json Normal file
View file

@ -0,0 +1,18 @@
{
"action": "verify",
"ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110",
"eso_delivery_equality_verified": true,
"exact_policy_and_ttl_verified": true,
"external_secret_ready": true,
"kv_version": 1,
"lane": "svc-keycape",
"phase": "done",
"sibling_metadata_and_token_create_denied": true,
"source_ccr": "CCR-2026-0054",
"source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5",
"status": "reader_and_delivery_verified",
"temporary_reader_revoked": true,
"values_recorded": false,
"wrong_audience_denied": true,
"wrong_service_account_denied": true
}

1
docs/evidence/2026-10-31-nk56-svc-keycape-bind/03-clear-password.json Normal file
View file

@ -0,0 +1 @@
{"after": {"resource_version": "83122244", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "before": {"resource_version": "82820316", "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"}, "change_needed": true, "changed": true, "mode": "apply", "operation": "clear-password", "other_secret_data_unchanged": true, "prior_bind": "service", "restart_required": true, "schema": "netkingdom.keycape-directory-bind.v1", "target": "sso/keycape-config", "task": "NK-WP-0056-T04", "unrelated_config_bytes_preserved": true, "values_emitted": false}

18
docs/evidence/2026-10-31-nk56-svc-keycape-bind/04-verify-env-only.json Normal file
View file

@ -0,0 +1,18 @@
{
"action": "verify",
"ccr_sha256": "e255807f1c98daa14a5848c1bf754f706f9080c86a6f258d192d24d33934b110",
"eso_delivery_equality_verified": true,
"exact_policy_and_ttl_verified": true,
"external_secret_ready": true,
"kv_version": 1,
"lane": "svc-keycape",
"phase": "done",
"sibling_metadata_and_token_create_denied": true,
"source_ccr": "CCR-2026-0054",
"source_sha256": "1a414342289b3e8e9b50c93ae27f7a442e5a0acb5bf90109e0069424730eaad5",
"status": "reader_and_delivery_verified",
"temporary_reader_revoked": true,
"values_recorded": false,
"wrong_audience_denied": true,
"wrong_service_account_denied": true
}

21
docs/evidence/2026-10-31-nk56-svc-keycape-bind/README.md Normal file
View file

@ -0,0 +1,21 @@
# NK-WP-0056-T04 — svc-keycape bind in platform custody (2026-10-31)
Founder-run in the founder's terminal under railiance-platform CCR-2026-0054 (approved by
platform-owner and net-kingdom-owner, binding confirmed, `5d87acd`; sha256 `e255807f…b110`). KeyCape reads
the bind from `KEYCAPE_LLDAP_BIND_PW` since key-cape `e2b5fa1` (KEY-WP-0046; image `main-e2b5fa1`,
`sha256:9e082dca…6f8d`). All receipts are value-free.
| Step | Result | Receipt |
| --- | --- | --- |
| setup (attended platform-admin, custody decrypted, re-sealed and shredded after) | live `keycape-config` binds `uid=svc-keycape`; custody equal to its `bindPW`; coding agents fenced; KV version 1 (CAS=0); policy and role in place | `01-setup.json` |
| apply `sso-mfa/k8s/keycape/bind-eso.yaml` | dedicated Secret `keycape-lldap-bind` created by ESO (`creationPolicy: Owner`), Ready | operator output |
| verify (env and config) | exact policy/TTL; wrong ServiceAccount and audience denied; metadata, other bind paths and token create denied; KV equals the delivered Secret and the config `bindPW` | `02-verify-env-and-config.json` |
| apply `deployment.yaml` (image `main-e2b5fa1` + `KEYCAPE_LLDAP_BIND_PW`) | server dry-run, apply, rolled out; log reports `bindPW` redundant once (both sources equal); `admin` portal sign-in with OTP (aal2) | operator output |
| `directory-bind-rollout.py clear-password` (dry-run, attended apply on uid/resourceVersion) | `bindPW` emptied; bind stays `svc-keycape`; unrelated config bytes and other Secret data unchanged | `03-clear-password.json` |
| restart KeyCape, verify (env only) | rolled out; no redundancy warning; KV equals the delivered Secret; `admin` portal sign-in with OTP (aal2) | `04-verify-env-only.json` |
`svc-keycape`'s bind password now lives only in OpenBao
(`platform/workloads/net-kingdom/directory-binds/svc-keycape`), the ESO Secret and the founder's custody copy
(fallback); `keycape-config` no longer holds it. Rotation: change the password in LLDAP, write the next KV
version with CAS, restart KeyCape. Rollback: `directory-bind-rollout.py --operation switch` restores
`bindPW` from custody; the previous image is `sha256:cdec9dd7…f010` (then remove the env).