NK-WP-0055: correlation contract accepted; T13 break-glass findings in the backup docs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
parent
56f2aa9a3a
commit
f2956334bf
4 changed files with 38 additions and 12 deletions
|
|
@ -2,13 +2,13 @@
|
|||
id: NK-STD-AUDIT-CORRELATION
|
||||
title: "Audit Correlation Contract"
|
||||
version: "0.1"
|
||||
status: proposed
|
||||
status: accepted
|
||||
owner: net-kingdom
|
||||
created: "2026-10-27"
|
||||
work: NK-WP-0055-T11
|
||||
---
|
||||
|
||||
# Audit Correlation Contract v0.1 (proposed)
|
||||
# Audit Correlation Contract v0.1
|
||||
|
||||
## Purpose
|
||||
|
||||
|
|
|
|||
|
|
@ -31,13 +31,13 @@ circular dependency and is recorded as a gap, not as custody.
|
|||
| --- | --- | --- | --- | --- | --- | --- |
|
||||
| 1 | Custodian/backup age private key (recipient `age1zvry…50syr3tsz`, labelled `railiance-backup`) | Decrypts the identity backup bundle and the SOPS custody files | Founder, independently held password safe or offline packet (Standard §4) | Yes, offline | Entered by the founder at hidden prompts 2026-10-24 (LLDAP, Authelia, privacyIDEA stages) | `TO CONFIRM`: number of copies, who else could recover if the founder cannot |
|
||||
| 2 | Storage Share `Backup` account app password | Downloads the protected ciphertext without OpenBao or SSO | Founder, independent custody `TO CONFIRM` | Yes, provider is outside the platform | Fresh retrieval 2026-10-24 | One provider copy only; residual risk accepted until 2027-01-31 (G1, NK-WP-0053) |
|
||||
| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao | Holders `TO CONFIRM` (custody doc: escrow holders "to be named") | Yes, offline | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | Name the three holders and where each share is kept; confirm none depends on SSO |
|
||||
| 3 | OpenBao unseal shares (2 of 3 required in the restore drill) | Unseals a restored or production OpenBao; with the shares, `generate-root` can mint a root token for break-glass (ceremony not yet documented) | Founder as `platform-root` holds all three shares (single-holder custody: accepted exception, hub decision `37464824`, 2026-10-27) | Yes, offline | Original shares used in the isolated restore RPF-WP-0064-T07, 2026-10-24 | `TO CONFIRM` where the shares are kept and that the place opens with SSO down; single holder = single point of loss (reviewed at NK-WP-0055-T09) |
|
||||
| 4 | `platform-root` / king account and factors | Final authority; break-glass | Independently held password safe or offline packet (Standard §4; custody doc) | **No if used through KeyCape**: its login and OTP are validated by the services being recovered | OTP validated against restored privacyIDEA 2026-10-24 (isolated) | `TO CONFIRM` the offline path that works with SSO down (OpenBao shares, item 3) and record it |
|
||||
| 5 | Founder admission signing key (SSH, principal `bernd`) | Signs attempt and restore admissions | Founder, workstation key; verifier anchor `/etc/secrets-engine/admission/allowed_signers` | Yes | Signed the T40 admission 2026-10-23 | `TO CONFIRM` which identity this key belongs to; the anchor is workstation-bound, so a backup of key and anchor is needed |
|
||||
| 6 | `admin` password and OTP token | Day-to-day platform administration and, per intent, recovery operation | Founder; OTP enrolled 2026-10-24 | **No**: login and token checks need KeyCape, LLDAP and privacyIDEA | Token not yet in any restored backup; first restore proof after the 2026-10-25 03:45 UTC capture | Same account as the directory bind used by Authelia and privacyIDEA until the split in NK-WP-0054-T05 |
|
||||
| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's personal password safe (stated 2026-10-24) | Custody yes if the safe opens offline; use needs a running privacyIDEA | Not yet drilled | Confirm the safe is reachable offline and mirrored; add a pi-admin check to the drill |
|
||||
| 7 | `pi-admin` credentials (privacyIDEA internal admin) | Token repair and re-enrolment | Founder's personal password safe (confirmed 2026-10-27) | Custody yes if the safe opens offline; use needs a running privacyIDEA | Not yet drilled | `TO CONFIRM` the safe opens offline and has a second copy; add a pi-admin check to the drill (NK-WP-0053-T04) |
|
||||
| 8 | Ops bundle (age-encrypted tar of service secrets, `make creds-bundle`) | Point-in-time service secrets | Offsite location `TO CONFIRM` (Standard §7) | Yes, needs item 1 | Not drilled | Confirm location and age; decide whether it duplicates the identity bundle |
|
||||
| 9 | Operator access to the production host or cluster for a real restore (SSH certificate or kubeconfig) | Applying a restore to production | `TO CONFIRM` | `TO CONFIRM`: ops-warden issues SSH certificates; whether that works with SSO down is unknown | Not drilled | Establish the crisis path and record it |
|
||||
| 9 | Operator access to the production host or cluster for a real restore | Applying a restore to production | Today (observed 2026-10-27): ops-bridge tunnel `k3s-api-railiance01` (SSH as `tegwick` to `92.205.62.239` with a **static key file**, local port 16444) plus the attended admin kubeconfig `~/.kube/config-railiance01` (route `kubernetes-railiance01-admin`, client-certificate user). Both live only on the founder workstation | Yes for this path: neither the static SSH key nor the kubeconfig client certificate needs KeyCape or OpenBao. **No** for ops-warden SSH certificates: warden's production backend is OpenBao (`backend: vault`) | Used 2026-10-27 (founder deleted two historical Secrets) | Gaps: workstation-only, no second copy; the path runs as the developer identity `tegwick` under an agent-labelled tunnel actor; provider console/rescue access `TO CONFIRM`. Decide the crisis-operator path (NK-WP-0055-T13) |
|
||||
|
||||
## Non-secret recovery assets
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# NetKingdom disaster recovery — start here
|
||||
|
||||
Updated 2026-10-16. Owner: NetKingdom with Railiance Platform and the individual
|
||||
Updated 2026-10-27. Owner: NetKingdom with Railiance Platform and the individual
|
||||
identity service owners. This guide covers the identity backup, not whole-host,
|
||||
OpenBao, Forgejo, User Engine or application recovery.
|
||||
|
||||
|
|
@ -101,10 +101,13 @@ ordinary persistent recovery media. The age private key is never in the bundle.
|
|||
|
||||
## Restoring working services
|
||||
|
||||
**Archive recovery passed on 2026-10-16. Full restored-service acceptance remains
|
||||
open.** The archive verifier deletes its plaintext and is not a service importer.
|
||||
Follow `docs/identity-service-restore-packet.md` with service owners before an
|
||||
isolated service drill. Its pending target and image fields must be resolved.
|
||||
**Archive recovery passed on 2026-10-16. Isolated restored-service recovery passed
|
||||
for LLDAP, Authelia, privacyIDEA (MFA and audit), KeyCape (issuer side) and OpenBao
|
||||
by 2026-10-24, and was owner-accepted in builder mode on 2026-10-27 (NK-WP-0049).**
|
||||
A joint restore with a live consumer login is still a pre-production drill
|
||||
(NK-WP-0055-T02/T03). The archive verifier deletes its plaintext and is not a
|
||||
service importer. Follow `docs/identity-service-restore-packet.md` and the
|
||||
[identity restore drill](identity-restore-drill.md) for a service drill.
|
||||
|
||||
Restore the exact matching data/config/original keys into an isolated recovery
|
||||
environment first. Keep production ingress, public DNS, notifications, external
|
||||
|
|
@ -120,6 +123,26 @@ approve a production cutover, including target identity, rollback, DNS/ingress,
|
|||
current consumers, credential dispositions and monitoring. This guide does not
|
||||
authorize a production restore or automatic credential rotation.
|
||||
|
||||
## Reaching the platform when SSO and OpenBao are down
|
||||
|
||||
The normal admin paths need the services being recovered: KeyCape OIDC with
|
||||
privacyIDEA MFA for OpenBao and portals, and ops-warden SSH certificates, which
|
||||
are signed by OpenBao. With those down, only paths built on offline material work:
|
||||
|
||||
- **Cluster:** the attended admin kubeconfig (`~/.kube/config-railiance01`,
|
||||
client certificate) through the `k3s-api-railiance01` tunnel, which uses a
|
||||
static SSH key. Both are on the founder workstation only.
|
||||
- **OpenBao:** unseal with the shares (crisis list item 3). If an admin token is
|
||||
needed while OIDC is down, the shares can mint a short-lived root token with
|
||||
`generate-root`. **That ceremony is not documented yet**:
|
||||
`railiance-platform/docs/openbao.md` covers only the initial root token.
|
||||
Writing it down and drilling it is NK-WP-0055-T13.
|
||||
- **Host:** `TO CONFIRM` provider console or rescue access.
|
||||
|
||||
Every use is a break-glass event: record what was done and why for review.
|
||||
Item-level custody and open gaps are in the crisis custody list; drilling this
|
||||
path is NK-WP-0055-T13.
|
||||
|
||||
## Who and what unlocks recovery
|
||||
|
||||
The [crisis custody list](crisis-custody-list.md) names every item that unlocks recovery, who holds
|
||||
|
|
@ -137,5 +160,6 @@ Existing Scaleway database backups do not establish a second full identity copy.
|
|||
Host-local health cannot report a dead host. Full service login/MFA/audit proofs,
|
||||
an independently executed outage-path retrieval drill, a second provider copy
|
||||
and external host-loss monitoring must not be assumed from an upload or this
|
||||
guide. Track remaining acceptance in NK-WP-0049; current task state lives in the
|
||||
repository and may be newer than this offline guide.
|
||||
guide. Track remaining drills in NK-WP-0053 and production readiness in
|
||||
NK-WP-0055; current task state lives in the repository and may be newer than
|
||||
this offline guide.
|
||||
|
|
|
|||
|
|
@ -300,6 +300,8 @@ state_hub_task_id: "6dfdf2be-e87a-5368-b2b6-45dcb92fe6e4"
|
|||
**Done when:** the crisis custody list items 4, 7, 8 and 9 are confirmed (kept current by NK-WP-0054-T07); a path that works with
|
||||
KeyCape/Authelia down is recorded and drilled by the founder; and use produces a post-event review record.
|
||||
|
||||
|
||||
2026-10-27 documentation pass: the crisis custody list (items 3, 7, 9) and the disaster recovery guide (new section "Reaching the platform when SSO and OpenBao are down") now record what is known. Findings: ops-warden SSH certificates do **not** work with OpenBao down (warden backend is OpenBao); the working path today is the static-key tunnel `k3s-api-railiance01` as `tegwick` plus the admin kubeconfig client certificate, workstation-only with no second copy; the OpenBao `generate-root` break-glass ceremony is undocumented; provider console access, the ops bundle location (item 8) and offline/mirror status of the password safe are `TO CONFIRM`.
|
||||
## Policy import pipeline and platform/tenant package split
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue