6 commits

Author	SHA1	Message	Date
tegwick	6c7c37aa70	NK-WP-0056-T04: svc-keycape bind lane (source only, CCR-2026-0054) ... KeyCape takes KEYCAPE_LLDAP_BIND_PW (key-cape KEY-WP-0046). ESO creates the dedicated Secret keycape-lldap-bind. bind-lane setup reads the current bindPW from keycape-config and requires the svc-keycape bindDN; verify compares the delivered Secret, and the config value while it is present. directory-bind-rollout gains clear-password, which runs only with the service bind and the delivered env (switch restores). deployment.yaml pins image main-e2b5fa1 and adds the env. Nothing is applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2	2026-10-31 10:31:30 +01:00
tegwick	034634ac5f	NK-WP-0056-T04: svc-authelia bind lane (source only, CCR-2026-0053) ... bind-lane.py gains per-lane Secret keys. Authelia keeps its bind user in authelia-config, so setup refuses unless the live configuration binds uid=svc-authelia, and only the ldap_password key is decoded. The ESO manifest merges ldap_password alone into authelia-secrets. The tests are parametrized per lane (12). tools/service-binds is now listed in security-tools.json, which fixes the index test that failed after the pilot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2	2026-10-31 09:20:53 +01:00
tegwick	985cfc37de	NK-WP-0056-T04: bind ESO sets explicit target metadata so the last-applied annotation is not copied ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 673304@bnt-lap001 Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e	2026-10-30 23:16:21 +01:00
tegwick	57369779e2	NK-WP-0056-T04: bind-lane requires a confirmed Kubernetes binding, as the CCR apply gate does ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 673304@bnt-lap001 Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e	2026-10-30 23:05:26 +01:00
tegwick	e0719ff663	NK-WP-0056-T04: bind-lane test reads the CCR as YAML ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 673304@bnt-lap001 Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e	2026-10-30 23:00:31 +01:00
tegwick	c6df34c4de	NK-WP-0056-T04: svc-provisioner bind lane into OpenBao/ESO (source only, CCR-2026-0052) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 673304@bnt-lap001 Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e	2026-10-30 22:54:25 +01:00