6 commits

Author	SHA1	Message	Date
tegwick	cd265b84a4	NK-WP-0058-T07: conventions lint, server-side applies, one cluster route ... tools/conventions/lint.py (make conventions-lint, contract suite): server-side-apply, one-wait-condition, one-cluster-route, tool-numbered-receipts, managing-controller (Argo-owned paths from railiance-platform), with reasoned exceptions. 21 runbook applies made server-side. portal-client-rollout.py (and so keycape-client.py and the rollout tools) and identity-provisioner-reconcile.py use NK_KUBECONFIG, default ~/.kube/config-railiance01, without a second kubeconfig or --server override. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0	2026-11-06 00:34:00 +01:00
tegwick	ae6861dec2	NK-WP-0052-T01: prepare wave-2 requests for sso, mfa and net-kingdom-pg ... Requests lowered per the 2026-10-21 node budget; lldap (53.7% throttled) CPU limit 200m -> 1000m. kubectl diff against live: resources only. No apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c	2026-10-22 00:08:06 +02:00
tegwick	b01a30bd49	fix(security): make service Secret updates private and conditional ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 20:20:42 +02:00
tegwick	4e07d60ff1	Validate cadence contract and require functional MFA verification ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd	2026-09-05 01:28:05 +02:00
Bernd Worsch	6d25d088d7	feat(sso-mfa): T02/T03 live apply — age-encrypted secrets, CNPG cluster (NK-WP-0001-T02/T03) ... - Add encrypt-secrets.sh / decrypt-secrets.sh: age-based secrets workflow replaces KeePassXC dependency; encrypted .env.age files committed to repo - Add bootstrap/secrets.enc/: all component secrets encrypted to age pubkey - Fix .gitignore: allow secrets.enc/**/*.age while blocking plaintext - Fix verify-t02.sh: update netpol names for Authelia+LLDAP+KeyCape stack - Fix verify-t03.sh: remove keycloak_db/role checks; fix ((PASS++)) set-e bug - Update postgresql/cluster.yaml: drop keycloak_db, bootstrap privacyidea_db only - Update postgresql/create-secrets.sh: remove keycloak secret - Fix netpol-databases.yaml: add port 8000 for CNPG instance manager HTTP API - T02 COMPLETE: namespaces, network policies, cert-manager issuers applied - T03 COMPLETE: CNPG operator installed, net-kingdom-pg cluster healthy Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-20 02:57:41 +00:00
tegwick	8929bf65bc	feat(sso-mfa): T03 PostgreSQL manifests (NK-WP-0001-T03) ... CloudNativePG Cluster CR (net-kingdom-pg, PostgreSQL 16) with two application databases: keycloak_db (owner: keycloak) and privacyidea_db (owner: privacyidea). Passwords managed continuously via managed.roles. WAL archiving section stubbed and commented; activate when object storage is available. ScheduledBackup CR included (daily 02:00 UTC, 7d retention). Also: sync workplan status for T01 (Phase 0a done), T02 (manifests done), T03 (manifests done, restore drill pending); close NK-WP-0002. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-05 09:22:13 +01:00