coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T07: conventions lint, server-side applies, one cluster route
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 1m25s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
tools/conventions/lint.py (make conventions-lint, contract suite): server-side-apply, one-wait-condition,
one-cluster-route, tool-numbered-receipts, managing-controller (Argo-owned paths from railiance-platform),
with reasoned exceptions. 21 runbook applies made server-side. portal-client-rollout.py (and so
keycape-client.py and the rollout tools) and identity-provisioner-reconcile.py use NK_KUBECONFIG,
default ~/.kube/config-railiance01, without a second kubeconfig or --server override.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 00:34:00 +01:00
parent 80d280a340
commit cd265b84a4
13 changed files with 226 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

8
sso-mfa/k8s/authelia/README.md
View file

@ -25,10 +25,10 @@ chmod +x create-secrets.sh
./create-secrets.sh
# 2. Apply manifests (order matters)
kubectl apply -f pvc.yaml
kubectl apply -f configmap.yaml
kubectl apply -f deployment.yaml
kubectl apply -f ingress.yaml
kubectl apply --server-side -f pvc.yaml
kubectl apply --server-side -f configmap.yaml
kubectl apply --server-side -f deployment.yaml
kubectl apply --server-side -f ingress.yaml
# 3. Wait for pod to be ready
# The startup probe allows 90 s for the initial LLDAP connection.

4
sso-mfa/k8s/bounded-executor/T06-PILOT-RUNBOOK.md
View file

@ -30,7 +30,7 @@ is not in its file. Applying the whole file would therefore be a broader change
K="kubectl --kubeconfig $HOME/.kube/config-railiance01"
cd ~/approval-engine && git pull --ff-only
python3 -c "import yaml,sys; yaml.safe_dump([d for d in yaml.safe_load_all(open('deploy/networkpolicies.yaml')) if d and d['metadata']['name']=='approval-engine-bounded-executor'][0], sys.stdout)" > /tmp/ae-bx.yaml
$K apply --dry-run=server -f /tmp/ae-bx.yaml && $K apply -f /tmp/ae-bx.yaml
$K apply --server-side --dry-run=server -f /tmp/ae-bx.yaml && $K apply --server-side -f /tmp/ae-bx.yaml
```
audit-core: run steps 1 and 2 of audit-core `docs/bounded-executor-receipts.md`, "Founder runbook —
@ -86,7 +86,7 @@ C=$(mktemp); python3 sso-mfa/k8s/keycape/keycape-client.py client-from-case secu
B=$HOME/.local/share/key-cape/verified-bin/e2b5fa1 # check-config binary from the deployed image (T09 runbook)
test -x "$B/keycape" || { mkdir -p "$B"; cid=$(docker create forgejo.coulomb.social/coulomb/key-cape@sha256:9e082dca78f65a4af3e92d3de3705b99e49ca9b298d9562ad0d37511c4306f8d); docker cp "$cid:/keycape" "$B/keycape"; docker rm "$cid"; }
# keycape-client.py uses its built-in kubeconfig through 127.0.0.1:16444, exactly as in the T09 runbook;
# keycape-client.py uses the same route as $K (NK_KUBECONFIG, default ~/.kube/config-railiance01; NK-WP-0058-T07);
# it pins the cluster identity and refuses another cluster.
$K -n sso rollout pause deployment/keycape
$K -n sso patch deployment keycape --type=json -p '[

9
sso-mfa/k8s/keycape/portal-client-rollout.py
View file

@ -8,6 +8,7 @@ import copy
import importlib.util
import json
from pathlib import Path
import os
import subprocess
import yaml
@ -91,9 +92,13 @@ def replacement(secret):
return base64.b64encode(updated.encode()).decode(), True
# The runbooks' cluster route (NK-WP-0058-T07): NK_KUBECONFIG, else the admin kubeconfig they name. No second file and
# no --server override: until 2026-11-06 this used a second kubeconfig file with a server override to the same API.
KUBECONFIG = os.environ.get('NK_KUBECONFIG', os.path.expanduser('~/.kube/config-railiance01'))
def kubectl(arguments, payload=None):
args = ['kubectl', '--kubeconfig', '/home/worsch/.kube/config-hosteurope',
'--server', 'https://127.0.0.1:16444', '--request-timeout=20s', *arguments]
args = ['kubectl', '--kubeconfig', KUBECONFIG, '--request-timeout=20s', *arguments]
result = subprocess.run(args, input=None if payload is None else json.dumps(payload),
text=True, capture_output=True, timeout=30)
require(result.returncode == 0, 'kubernetes_operation_failed')

10
sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
View file

@ -23,7 +23,7 @@ receipts under `~/nk54/`; they are value-free and go to `docs/evidence/` afterwa
```bash
cd ~/net-kingdom && git pull --ff-only
bridge up k3s-api-railiance01
K="kubectl --kubeconfig $HOME/.kube/config-hosteurope --server https://127.0.0.1:16444"
K="kubectl --kubeconfig $HOME/.kube/config-railiance01" # one route for runbooks and tools (NK-WP-0058-T07)
# The Secret scripts call plain kubectl; the default config is the limited ops-mason-builder.
export KUBECONFIG=$HOME/.kube/config-railiance01
kubectl auth can-i create secrets -n sso # must print yes
@ -94,7 +94,7 @@ python3 sso-mfa/k8s/lldap/bind-split.py verify --endpoint https://lldap.coulomb.
```bash
bash sso-mfa/k8s/identity-provisioner/create-secrets.sh "$CUSTODY"
$K apply -f sso-mfa/k8s/identity-provisioner/deployment.yaml
$K apply --server-side -f sso-mfa/k8s/identity-provisioner/deployment.yaml
$K -n sso rollout status deploy/identity-provisioner --timeout=180s
```
Its readiness includes a directory login, so `rollout status` succeeding means `svc-provisioner`
@ -104,13 +104,13 @@ works. Rollback: `$K -n sso rollout undo deploy/identity-provisioner`.
```bash
bash sso-mfa/k8s/authelia/create-secrets.sh "$CUSTODY" --rotate-key LLDAP_SVC_AUTHELIA_PASS
$K apply -f sso-mfa/k8s/authelia/configmap.yaml
$K apply --server-side -f sso-mfa/k8s/authelia/configmap.yaml
$K -n sso rollout restart deploy/authelia && $K -n sso rollout status deploy/authelia --timeout=180s
```
Check: sign in at `https://auth.coulomb.social` as yourself (password and OTP).
Rollback (the `admin` password still works until step 10):
```bash
git show 145ca8e~1:sso-mfa/k8s/authelia/configmap.yaml | $K apply -f -
git show 145ca8e~1:sso-mfa/k8s/authelia/configmap.yaml | $K apply --server-side -f -
read -rsp 'admin password: ' P; echo
printf '[{"op":"replace","path":"/data/ldap_password","value":"%s"}]' "$(printf %s "$P" | base64 -w0)" \
| $K -n sso patch secret authelia-secrets --type=json --patch-file=/dev/stdin; unset P
@ -148,7 +148,7 @@ automated rollback; the old bind is the `admin` account, which still works, so t
```bash
bash sso-mfa/k8s/lldap/create-secrets.sh "$CUSTODY" --rotate-key LLDAP_LDAP_USER_PASS
$K apply -f sso-mfa/k8s/lldap/deployment.yaml
$K apply --server-side -f sso-mfa/k8s/lldap/deployment.yaml
$K -n sso rollout status deploy/lldap --timeout=180s
```
The configured super-admin is now `ld-admin`. Check: sign in to the LLDAP UI as `ld-admin` once, then

8
sso-mfa/k8s/lldap/README.md
View file

@ -24,10 +24,10 @@ chmod +x create-secrets.sh
./create-secrets.sh
# 3. Apply manifests (order matters)
kubectl apply -f pvc.yaml
kubectl apply -f middleware.yaml
kubectl apply -f deployment.yaml
kubectl apply -f ingress.yaml
kubectl apply --server-side -f pvc.yaml
kubectl apply --server-side -f middleware.yaml
kubectl apply --server-side -f deployment.yaml
kubectl apply --server-side -f ingress.yaml
# 4. Wait for pod to be ready
kubectl rollout status deployment/lldap -n sso --timeout=120s

6
sso-mfa/k8s/lldap/identity-provisioner-reconcile.py
View file

@ -8,14 +8,16 @@ from __future__ import annotations
import argparse
import base64
import getpass
import os
import json
import re
import subprocess
import sys
CLUSTER_UID = 'a553c742-0115-43d4-99a4-a5ca56fe0786'
KUBE = ['kubectl', '--kubeconfig', '/home/worsch/.kube/config-hosteurope',
'--server', 'https://127.0.0.1:16444', '--request-timeout=20s']
# The runbooks' cluster route (NK-WP-0058-T07): NK_KUBECONFIG, else the admin kubeconfig they name; no override.
KUBE = ['kubectl', '--kubeconfig', os.environ.get('NK_KUBECONFIG', os.path.expanduser('~/.kube/config-railiance01')),
'--request-timeout=20s']
NAMESPACE = 'sso'
# The provisioner's own directory account (NK-WP-0054-T05); needs the image with LLDAP_ADMIN_USERNAME.
SECRET = 'identity-provisioner-ldap'

4
sso-mfa/k8s/postgresql/README.md
View file

@ -54,7 +54,7 @@ kubectl create secret generic net-kingdom-pg-privacyidea-app \
### 3. Deploy the cluster
```bash
kubectl apply -f cluster.yaml
kubectl apply --server-side -f cluster.yaml
```
Wait for cluster to become ready (this provisions PVCs and runs initdb — allow 2–3 minutes):
@ -100,7 +100,7 @@ kubectl create secret generic net-kingdom-pg-backup-s3 \
Apply the updated cluster.yaml, then:
```bash
kubectl apply -f scheduled-backup.yaml
kubectl apply --server-side -f scheduled-backup.yaml
```
### 6. Run the restore drill

12
sso-mfa/k8s/privacyidea/README.md
View file

@ -34,11 +34,11 @@ PI_SQLALCHEMY_DATABASE_URI).
```bash
# From sso-mfa/k8s/privacyidea/
kubectl apply -f pvc.yaml
kubectl apply -f configmap.yaml
kubectl apply -f middleware.yaml
kubectl apply -f deployment.yaml
kubectl apply -f ingress.yaml
kubectl apply --server-side -f pvc.yaml
kubectl apply --server-side -f configmap.yaml
kubectl apply --server-side -f middleware.yaml
kubectl apply --server-side -f deployment.yaml
kubectl apply --server-side -f ingress.yaml
```
**Wait for the pod to reach Running state** (DB migrations run on first start —
@ -185,7 +185,7 @@ Update `middleware.yaml` `privacyidea-admin-allowlist.spec.ipWhiteList.sourceRan
to your actual VPN/office CIDRs and reapply:
```bash
kubectl apply -f middleware.yaml
kubectl apply --server-side -f middleware.yaml
```
### Self-service portal