From e830238746cc3a5f67eaf7ec705719a516e00bf8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 20:33:28 +0100 Subject: [PATCH] NK-WP-0056-T10: examples re-pinned at 15c9cdb Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 --- .../bind-rotation-svc-authelia.yaml | 14 +++++++------- .../bind-split-create-service-accounts.yaml | 4 ++-- .../bind-split-read-only-verify.yaml | 4 ++-- .../bind-split-switch-super-admin.yaml | 4 ++-- .../fixtures/invalid/human-intrinsic-step.yaml | 4 ++-- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml b/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml index 74836e6..5cc850a 100644 --- a/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml +++ b/examples/bounded-execution-admission/bind-rotation-svc-authelia.yaml @@ -49,12 +49,12 @@ spec: plan: source: repo: net-kingdom - commit: abed4360d495 + commit: 15c9cdbef881 files: - path: bounded-executor/executor.py sha256: d724f4f831640c92b8b542dd2adab2e77f40d87d88f46d9482bff9fdcc4f6c70 - path: bounded-executor/operations.py - sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084 + sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041 - path: sso-mfa/k8s/synthetic-journey/journey.py sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c steps: @@ -151,30 +151,30 @@ spec: scope: k8s/sso/deployment/authelia checks_after: - synthetic-journey - plan_digest: sha256:9dadc34d8186937d98bd6dd6ed5858d4fbcabda45359838bb2c2378237443502 + plan_digest: sha256:df214e02c24e70c6ac799bee873862f0d24d9bd537bf77cfb845a7b880c7565b checks: - id: kv-advanced description: KV svc-authelia has exactly one new version, CAS on the previous one ref: bounded-executor/operations.py - sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084 + sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041 timeout_seconds: 30 expect: pass - id: bind-signs-in description: the new KV value signs in to LLDAP as svc-authelia ref: bounded-executor/operations.py - sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084 + sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041 timeout_seconds: 30 expect: pass - id: eso-synced description: the ExternalSecret is Ready with a refresh after the step started; the executor never reads the Secret ref: bounded-executor/operations.py - sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084 + sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041 timeout_seconds: 120 expect: pass - id: synthetic-journey description: syn-journey signs in through KeyCape, Authelia and privacyIDEA at aal2 ref: bounded-executor/operations.py - sha256: c597eb6db6592902ea9b4a6dbb0cc6f987f32ddb821d9f4b153bc4c3bf184084 + sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041 timeout_seconds: 90 expect: pass stop_and_revert: diff --git a/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml b/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml index 2e0e9cc..2df33f6 100644 --- a/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml +++ b/examples/bounded-execution-admission/bind-split-create-service-accounts.yaml @@ -43,7 +43,7 @@ spec: plan: source: repo: net-kingdom - commit: abed4360d495 + commit: 15c9cdbef881 files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -97,7 +97,7 @@ spec: scope: openbao/platform/workloads/net-kingdom/directory-binds checks_after: - accounts-sign-in - plan_digest: sha256:23dcb8d6f356c5183affa05f149825579ccc2c078a2efd82795caad26384b414 + plan_digest: sha256:0005f239aa3f917eff68557f2124180d13e086adb8ead70a59b6c0168f241f87 checks: - id: accounts-read-only description: each account exists in lldap_strict_readonly only and cannot write diff --git a/examples/bounded-execution-admission/bind-split-read-only-verify.yaml b/examples/bounded-execution-admission/bind-split-read-only-verify.yaml index 26e08c8..7f9d927 100644 --- a/examples/bounded-execution-admission/bind-split-read-only-verify.yaml +++ b/examples/bounded-execution-admission/bind-split-read-only-verify.yaml @@ -46,7 +46,7 @@ spec: plan: source: repo: net-kingdom - commit: abed4360d495 + commit: 15c9cdbef881 files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -73,7 +73,7 @@ spec: scope: k8s/sso checks_after: - split-shape - plan_digest: sha256:673d9614f1c347c8015fb3b1d42e122c855f58323d403b78a934a807656d7fa8 + plan_digest: sha256:840d296ed7d27209f21c4e00500409fba80e2b85e4ce2e828663d8b0d4ca11e0 checks: - id: split-shape description: every consumer binds as its own svc- account; no service binds as admin diff --git a/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml b/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml index 19243fe..346d1c3 100644 --- a/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml +++ b/examples/bounded-execution-admission/bind-split-switch-super-admin.yaml @@ -43,7 +43,7 @@ spec: plan: source: repo: net-kingdom - commit: abed4360d495 + commit: 15c9cdbef881 files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -97,7 +97,7 @@ spec: scope: k8s/sso/deployment/lldap checks_after: - synthetic-journey - plan_digest: sha256:cd134501fa62b18b54b9b0d1ec6ab9acd35556c995813e8487223189482cc196 + plan_digest: sha256:4469ab1b15f9e8d631ca213b6b949befd2f252434f91f2e8fa5846d893d95eaf checks: - id: ld-admin-administers description: ld-admin signs in and administers; admin keeps lldap_admin membership diff --git a/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml b/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml index 5467ceb..f03b4dc 100644 --- a/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml +++ b/tools/bounded-execution-admission/fixtures/invalid/human-intrinsic-step.yaml @@ -42,7 +42,7 @@ spec: plan: source: repo: net-kingdom - commit: abed4360d495 + commit: 15c9cdbef881 files: - path: sso-mfa/k8s/lldap/bind-split.py sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3 @@ -108,7 +108,7 @@ spec: scope: k8s/sso/deployment/lldap checks_after: - synthetic-journey - plan_digest: sha256:860c7a7cf8478a096190312ae303c4403ec483372274a28471c2f74677a68f63 + plan_digest: sha256:189346b479dc9920c296087ec1a182e2425f4b0596d2995a00ec12ffe61ec615 checks: - id: ld-admin-administers description: ld-admin signs in and administers; admin keeps lldap_admin membership