Record off-host database recovery and prepare identity backup coverage
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
This commit is contained in:
parent
a1939a7d06
commit
dca999222f
13 changed files with 596 additions and 29 deletions
|
|
@ -1,8 +1,8 @@
|
|||
{
|
||||
"schema": "netkingdom.bootstrap-caller-inventory.v1",
|
||||
"observed_at": "2026-10-15T22:08:27.470032+00:00",
|
||||
"scope": "all current .sh/.py non-test files under sso-mfa/bootstrap and sso-mfa/k8s, Makefile, console, delivery copier and recovery transport tool plus two bounded provider metadata inventory helpers plus bounded fixed-object ciphertext fetch and isolated PostgreSQL recovery check",
|
||||
"entry_count": 91,
|
||||
"observed_at": "2026-10-15T22:29:09.131605+00:00",
|
||||
"scope": "all current .sh/.py non-test files under sso-mfa/bootstrap and sso-mfa/k8s, Makefile, console, delivery copier and recovery transport tool plus two bounded provider metadata inventory helpers plus bounded fixed-object ciphertext fetch and isolated PostgreSQL recovery check plus proposed full identity backup profile and metadata-only preparer",
|
||||
"entry_count": 93,
|
||||
"entries": [
|
||||
{
|
||||
"path": "Makefile",
|
||||
|
|
@ -458,6 +458,16 @@
|
|||
"path": "tools/bootstrap-recovery/check-privacyidea-database.py",
|
||||
"sha256": "90f454c87998d7f5d625e3c6656c3418f8f56275dc1879a9d19ed605431b94a4",
|
||||
"classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution"
|
||||
},
|
||||
{
|
||||
"path": "tools/bootstrap-recovery/prepare-identity-coverage.py",
|
||||
"sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1",
|
||||
"classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability"
|
||||
},
|
||||
{
|
||||
"path": "tools/bootstrap-recovery/identity-backup-profile.json",
|
||||
"sha256": "176c1f2f9111c2c51503212deb162274609d5e53bfe03d7319e19e44c5e09500",
|
||||
"classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability"
|
||||
}
|
||||
],
|
||||
"source_inventory_complete_for_declared_scope": true,
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
"observed_at": "2026-10-15T22:08:27.470032+00:00",
|
||||
"operator_reported_key_check_passed": true,
|
||||
"private_key_received_by_agent": false,
|
||||
"actual_ciphertext_decryption_verified": false,
|
||||
"actual_ciphertext_decryption_verified": true,
|
||||
"transfer_receipt": "privacyidea-transfer-r1.json",
|
||||
"transfer_envelope_exit_code": 0,
|
||||
"transfer_session_revoked_and_cleaned": true,
|
||||
|
|
@ -13,7 +13,7 @@
|
|||
"data": "synthetic database and fresh disposable age keys only",
|
||||
"includes_native_postgres_restore_and_cleanup": true
|
||||
},
|
||||
"pending_human_command": "docs/bootstrap-recovery-ceremony.md: Prepared bounded privacyIDEA database drill",
|
||||
"pending_human_command": null,
|
||||
"native_identity_recovery_proven": false,
|
||||
"sources": [
|
||||
{
|
||||
|
|
@ -28,5 +28,6 @@
|
|||
"path": "tests/test_privacyidea_offhost_recovery.py",
|
||||
"sha256": "ea977b0d3368fb14f6a7a252c24cc5cb9915022afa3dca61c80952e7489bd0e5"
|
||||
}
|
||||
]
|
||||
],
|
||||
"execution_receipt": "privacyidea-database-drill-r1.json"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"observed_at": "2026-10-15T22:24:49.717396+00:00",
|
||||
"receipt": "privacyidea-database-drill-r1.json",
|
||||
"receipt_sha256": "c72dc3ababcc3ef3d7485a434128daf71e0ee58a8118e633fb09fed516f4b980",
|
||||
"source_and_transfer_binding_verified": true,
|
||||
"retained_ciphertext_digest_rechecked": true,
|
||||
"operator_reported_success": true,
|
||||
"independent_custody_basis": "Operator reports independently held railiance-backup key; attended temporary-key drill decrypted the fetched ciphertext. Agent never received private key material.",
|
||||
"docker_nk49_container_inventory_empty": true,
|
||||
"full_identity_recovery_proven": false,
|
||||
"operator_reports_no_known_full_identity_bundle": true,
|
||||
"next_work_authorized": "Prepare missing backup coverage; no blanket production restore or credential rotation.",
|
||||
"coverage_preparation": "identity-backup-preparation-r1.json",
|
||||
"operator_coverage_decision_id": "ed20023f-0168-421d-be86-460391339876"
|
||||
}
|
||||
|
|
@ -0,0 +1,106 @@
|
|||
{
|
||||
"schema": "netkingdom.identity-backup-preparation.v1",
|
||||
"status": "prepared_not_admitted",
|
||||
"observed_at": "2026-10-15T22:32:41.149409+00:00",
|
||||
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
||||
"profile_sha256": "176c1f2f9111c2c51503212deb162274609d5e53bfe03d7319e19e44c5e09500",
|
||||
"source_sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1",
|
||||
"bindings": [
|
||||
{
|
||||
"namespace": "sso",
|
||||
"deployment": "lldap",
|
||||
"uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
|
||||
"generation": 7,
|
||||
"pvc_bindings": [
|
||||
{
|
||||
"name": "lldap-data",
|
||||
"uid": "0a06b65a-e7b3-42d3-916e-e74dbe5fc7da"
|
||||
}
|
||||
],
|
||||
"secret_names_only": [
|
||||
"lldap-secrets"
|
||||
],
|
||||
"configmap_names_only": []
|
||||
},
|
||||
{
|
||||
"namespace": "sso",
|
||||
"deployment": "authelia",
|
||||
"uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
|
||||
"generation": 28,
|
||||
"pvc_bindings": [
|
||||
{
|
||||
"name": "authelia-data",
|
||||
"uid": "86826554-b014-4df4-8b28-866aa64f6413"
|
||||
}
|
||||
],
|
||||
"secret_names_only": [
|
||||
"authelia-secrets",
|
||||
"authelia-smtp"
|
||||
],
|
||||
"configmap_names_only": [
|
||||
"authelia-config"
|
||||
]
|
||||
},
|
||||
{
|
||||
"namespace": "sso",
|
||||
"deployment": "keycape",
|
||||
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
|
||||
"generation": 65,
|
||||
"pvc_bindings": [
|
||||
{
|
||||
"name": "keycape-authentication-policy",
|
||||
"uid": "423f558f-8c11-4edf-956b-243559df4a8e"
|
||||
}
|
||||
],
|
||||
"secret_names_only": [
|
||||
"keycape-approval-engine-operator-client",
|
||||
"keycape-config",
|
||||
"keycape-factor-read",
|
||||
"keycape-informed-decision-sitting-requester-client",
|
||||
"keycape-rapp-qonto-client",
|
||||
"keycape-secrets-engine-approval-client",
|
||||
"keycape-secrets-engine-openbao-client",
|
||||
"keycape-secrets-engine-requester-client"
|
||||
],
|
||||
"configmap_names_only": []
|
||||
},
|
||||
{
|
||||
"namespace": "mfa",
|
||||
"deployment": "privacyidea",
|
||||
"uid": "58c7f96d-61cb-4dd4-bca2-54661c0ac375",
|
||||
"generation": 11,
|
||||
"pvc_bindings": [
|
||||
{
|
||||
"name": "privacyidea-data",
|
||||
"uid": "65650fc1-02d8-4c0f-84fc-e0015c8f3ed9"
|
||||
},
|
||||
{
|
||||
"name": "privacyidea-logs",
|
||||
"uid": "39fa90d9-bc54-4a03-a0d6-ae85165e0cb9"
|
||||
}
|
||||
],
|
||||
"secret_names_only": [
|
||||
"privacyidea-config"
|
||||
],
|
||||
"configmap_names_only": [
|
||||
"factor-recovery-01119187d90d7b76",
|
||||
"keycape-onboarding-9465e5e0b98f7986",
|
||||
"privacyidea-cfg"
|
||||
]
|
||||
}
|
||||
],
|
||||
"secret_values_read": false,
|
||||
"backup_captured": false,
|
||||
"uploaded": false,
|
||||
"runtime_changed": false,
|
||||
"credential_grant_created": false,
|
||||
"owner_admission_required": [
|
||||
"Railiance owner accepts exact read/capture executor, immutable helper images, PVC access and task-scoped caller attribution; no production stop/restart inferred",
|
||||
"NetKingdom/service owners accept full asset manifest, original key preservation, consistency interval, bounded recovery environment and native acceptance",
|
||||
"Platform/reef-storage admits both new archive prefixes, immutable create/readback, scoped publisher custody and current quota/headroom; current application archive profiles do not include net-kingdom",
|
||||
"Resolve every referenced credential through encrypted recovery or an independent owner reissue path; no undocumented grant propagation",
|
||||
"Implement and test capture/sealing/transfer adapters against this new profile before live execution; existing bootstrap tar checker is insufficient",
|
||||
"Retrieve by immutable object/version from each admitted provider; digest check, attended independent-key decryption, native service recovery, failed-key case and verified cleanup",
|
||||
"Only then enable recurring capture/alerts and measured retention; preserve T02 legacy provider-credential and deferred-rotation boundaries"
|
||||
]
|
||||
}
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
"observed_at": "2026-10-15T22:08:27.470032+00:00",
|
||||
"operator_reports_holding_railiance_backup_age_key": true,
|
||||
"private_key_received_or_read": false,
|
||||
"candidate_key_match_verified": false,
|
||||
"candidate_key_match_verified": true,
|
||||
"storage_share": {
|
||||
"inventory": "storage-share-inventory-r1.json",
|
||||
"status": "metadata_inventory_complete",
|
||||
|
|
@ -14,7 +14,9 @@
|
|||
"bootstrap_identity_file_bundle_found_in_inspected_scope": false,
|
||||
"transfer_receipt": "privacyidea-transfer-r1.json",
|
||||
"attended_transfer_envelope_exit_code": 0,
|
||||
"transfer_session_self_revocation_and_cleanup_confirmed": true
|
||||
"transfer_session_self_revocation_and_cleanup_confirmed": true,
|
||||
"candidate_decryption_and_database_restore_verified": true,
|
||||
"database_drill_receipt": "privacyidea-database-drill-r1.json"
|
||||
},
|
||||
"scaleway": {
|
||||
"inventory": "scaleway-inventory-r1.json",
|
||||
|
|
@ -38,5 +40,6 @@
|
|||
"command": "python3 -m pytest -q tests/test_scaleway_backup_inventory.py tests/test_storage_share_inventory.py"
|
||||
},
|
||||
"native_recovery_proven": false,
|
||||
"production_mutations_performed": false
|
||||
"production_mutations_performed": false,
|
||||
"private_key_received_or_read_scope": "Agent custody: false; attended human recovery child used the temporary explicit key."
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"schema": "netkingdom.privacyidea-database-drill.v1",
|
||||
"status": "isolated_database_drill_passed",
|
||||
"started_at": "2026-10-15T22:18:55.858354+00:00",
|
||||
"source_sha256": "90f454c87998d7f5d625e3c6656c3418f8f56275dc1879a9d19ed605431b94a4",
|
||||
"production_contacted": false,
|
||||
"secret_values_exported": false,
|
||||
"native_identity_recovery_proven": false,
|
||||
"token_decryption_proven": false,
|
||||
"audit_signature_continuity_proven": false,
|
||||
"full_identity_file_coverage_proven": false,
|
||||
"container_cleanup_verified": true,
|
||||
"temporary_plaintext_cleanup_verified": true,
|
||||
"ciphertext_sha256": "cc81da442755928171d2c51bce93eda7de4392a0a1aa9d0ffb83a25ba34e5ead",
|
||||
"registered_recipient_match": true,
|
||||
"wrong_key_refused": true,
|
||||
"offhost_ciphertext_decryption_verified": true,
|
||||
"image": "postgres@sha256:ff23cdce56cac62ada6f66013e1a50864c0abbe79d132d40b6e05bd80f378a70",
|
||||
"image_id": "sha256:ff23cdce56cac62ada6f66013e1a50864c0abbe79d132d40b6e05bd80f378a70",
|
||||
"pg_restore_version": "pg_restore (PostgreSQL) 16.14 (Debian 16.14-1.pgdg13+1)",
|
||||
"aggregate_row_counts": {
|
||||
"token": 5,
|
||||
"resolver": 2,
|
||||
"realm": 2
|
||||
},
|
||||
"database_restore_and_readback_passed": true,
|
||||
"finished_at": "2026-10-15T22:19:05.279736+00:00"
|
||||
}
|
||||
|
|
@ -1,13 +1,13 @@
|
|||
{
|
||||
"workplan": "NK-WP-0049",
|
||||
"observed_at": "2026-10-15T22:08:27.470032+00:00",
|
||||
"status": "source_prepared_pending_owner_inputs_and_native_acceptance",
|
||||
"observed_at": "2026-10-15T22:24:49.717396+00:00",
|
||||
"status": "offhost_privacyidea_database_recovered_full_identity_coverage_open",
|
||||
"backup_destinations_operator_reported": [
|
||||
"Scaleway",
|
||||
"Storage Share"
|
||||
],
|
||||
"exact_offhost_artifact_confirmed": true,
|
||||
"independently_held_matching_key_confirmed": false,
|
||||
"independently_held_matching_key_confirmed": true,
|
||||
"recovery_key_or_backup_contents_retrieved": true,
|
||||
"legacy_token_secret_present": true,
|
||||
"legacy_trigger_secret_present": true,
|
||||
|
|
@ -18,15 +18,14 @@
|
|||
"verification": "source-verification.json",
|
||||
"ceremony": "../../bootstrap-recovery-ceremony.md",
|
||||
"outstanding": [
|
||||
"Matching off-host identity data/key/config set remains unlocated in inspected scopes; selected existing PI database ciphertext is now fetched and digest-bound",
|
||||
"Operator reports matching-recipient key check passed; actual ciphertext decryption/native database drill is prepared and pending operator hidden-key invocation",
|
||||
"Full identity service recovery, token decryption, audit signature continuity and cleanup evidence",
|
||||
"Prepare and admit missing encrypted identity data/key/config backup coverage; operator confirms no known full identity bundle",
|
||||
"Retrieve new off-host bundle and prove original token decryption, audit continuity, directory and issuer recovery with safe negative cases and cleanup",
|
||||
"T02 current caller/provider source admission and exact legacy provider credential disposition; retain existing deferred-rotation boundary"
|
||||
],
|
||||
"operator_reports_holding_railiance_backup_age_key": true,
|
||||
"operator_report_recorded_at": "2026-10-15T21:52:22.549430+00:00",
|
||||
"key_material_received": false,
|
||||
"key_matches_selected_ciphertext_verified": false,
|
||||
"key_matches_selected_ciphertext_verified": true,
|
||||
"offsite_discovery": "offsite-discovery-summary.json",
|
||||
"privacyidea_database_ciphertext_identified": true,
|
||||
"required_full_asset_coverage_confirmed": false,
|
||||
|
|
@ -36,5 +35,14 @@
|
|||
"ciphertext_fetched": true,
|
||||
"transfer_receipt": "privacyidea-transfer-r1.json",
|
||||
"prepared_database_drill": "../../bootstrap-recovery-ceremony.md",
|
||||
"age_private_key_retrieved_by_agent": false
|
||||
"age_private_key_retrieved_by_agent": false,
|
||||
"offhost_database_restore_proven": true,
|
||||
"database_drill_receipt": "privacyidea-database-drill-r1.json",
|
||||
"database_drill_review": "database-drill-review.json",
|
||||
"operator_reports_no_known_full_identity_bundle": true,
|
||||
"identity_backup_profile": "../../../tools/bootstrap-recovery/identity-backup-profile.json",
|
||||
"identity_coverage_preparation": "identity-backup-preparation-r1.json",
|
||||
"coverage_preparation_status": "prepared_not_admitted",
|
||||
"coverage_preparation_tests_passed": 14,
|
||||
"coverage_decision_id": "ed20023f-0168-421d-be86-460391339876"
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue