coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T07: conventions lint, server-side applies, one cluster route
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 1m25s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
tools/conventions/lint.py (make conventions-lint, contract suite): server-side-apply, one-wait-condition,
one-cluster-route, tool-numbered-receipts, managing-controller (Argo-owned paths from railiance-platform),
with reasoned exceptions. 21 runbook applies made server-side. portal-client-rollout.py (and so
keycape-client.py and the rollout tools) and identity-provisioner-reconcile.py use NK_KUBECONFIG,
default ~/.kube/config-railiance01, without a second kubeconfig or --server override.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 00:34:00 +01:00
parent 80d280a340
commit cd265b84a4
13 changed files with 226 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

10
sso-mfa/k8s/lldap/BIND-SPLIT-RUNBOOK.md
View file

@ -23,7 +23,7 @@ receipts under `~/nk54/`; they are value-free and go to `docs/evidence/` afterwa
```bash
cd ~/net-kingdom && git pull --ff-only
bridge up k3s-api-railiance01
K="kubectl --kubeconfig $HOME/.kube/config-hosteurope --server https://127.0.0.1:16444"
K="kubectl --kubeconfig $HOME/.kube/config-railiance01" # one route for runbooks and tools (NK-WP-0058-T07)
# The Secret scripts call plain kubectl; the default config is the limited ops-mason-builder.
export KUBECONFIG=$HOME/.kube/config-railiance01
kubectl auth can-i create secrets -n sso # must print yes
@ -94,7 +94,7 @@ python3 sso-mfa/k8s/lldap/bind-split.py verify --endpoint https://lldap.coulomb.
```bash
bash sso-mfa/k8s/identity-provisioner/create-secrets.sh "$CUSTODY"
$K apply -f sso-mfa/k8s/identity-provisioner/deployment.yaml
$K apply --server-side -f sso-mfa/k8s/identity-provisioner/deployment.yaml
$K -n sso rollout status deploy/identity-provisioner --timeout=180s
```
Its readiness includes a directory login, so `rollout status` succeeding means `svc-provisioner`
@ -104,13 +104,13 @@ works. Rollback: `$K -n sso rollout undo deploy/identity-provisioner`.
```bash
bash sso-mfa/k8s/authelia/create-secrets.sh "$CUSTODY" --rotate-key LLDAP_SVC_AUTHELIA_PASS
$K apply -f sso-mfa/k8s/authelia/configmap.yaml
$K apply --server-side -f sso-mfa/k8s/authelia/configmap.yaml
$K -n sso rollout restart deploy/authelia && $K -n sso rollout status deploy/authelia --timeout=180s
```
Check: sign in at `https://auth.coulomb.social` as yourself (password and OTP).
Rollback (the `admin` password still works until step 10):
```bash
git show 145ca8e~1:sso-mfa/k8s/authelia/configmap.yaml | $K apply -f -
git show 145ca8e~1:sso-mfa/k8s/authelia/configmap.yaml | $K apply --server-side -f -
read -rsp 'admin password: ' P; echo
printf '[{"op":"replace","path":"/data/ldap_password","value":"%s"}]' "$(printf %s "$P" | base64 -w0)" \
| $K -n sso patch secret authelia-secrets --type=json --patch-file=/dev/stdin; unset P
@ -148,7 +148,7 @@ automated rollback; the old bind is the `admin` account, which still works, so t
```bash
bash sso-mfa/k8s/lldap/create-secrets.sh "$CUSTODY" --rotate-key LLDAP_LDAP_USER_PASS
$K apply -f sso-mfa/k8s/lldap/deployment.yaml
$K apply --server-side -f sso-mfa/k8s/lldap/deployment.yaml
$K -n sso rollout status deploy/lldap --timeout=180s
```
The configured super-admin is now `ld-admin`. Check: sign in to the LLDAP UI as `ld-admin` once, then