{
  "schema": "netkingdom.identity-capture-plan.v1",
  "status": "requires_owner_execution_admission",
  "created_at": "2026-10-15T23:33:14.370426+00:00",
  "run_id": "35ffd825063d",
  "binding": {
    "schema": "netkingdom.identity-backup-preparation.v1",
    "status": "prepared_not_admitted",
    "observed_at": "2026-10-15T23:33:13.858371+00:00",
    "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
    "profile_sha256": "dff567f594826628544bb2252c77ccb8daf8a34fd2095026663cc948ffeff63a",
    "source_sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1",
    "bindings": [
      {
        "namespace": "sso",
        "deployment": "lldap",
        "uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
        "generation": 7,
        "pvc_bindings": [
          {
            "name": "lldap-data",
            "uid": "0a06b65a-e7b3-42d3-916e-e74dbe5fc7da"
          }
        ],
        "secret_names_only": [
          "lldap-secrets"
        ],
        "configmap_names_only": []
      },
      {
        "namespace": "sso",
        "deployment": "authelia",
        "uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
        "generation": 28,
        "pvc_bindings": [
          {
            "name": "authelia-data",
            "uid": "86826554-b014-4df4-8b28-866aa64f6413"
          }
        ],
        "secret_names_only": [
          "authelia-secrets",
          "authelia-smtp"
        ],
        "configmap_names_only": [
          "authelia-config"
        ]
      },
      {
        "namespace": "sso",
        "deployment": "keycape",
        "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
        "generation": 65,
        "pvc_bindings": [
          {
            "name": "keycape-authentication-policy",
            "uid": "423f558f-8c11-4edf-956b-243559df4a8e"
          }
        ],
        "secret_names_only": [
          "keycape-approval-engine-operator-client",
          "keycape-config",
          "keycape-factor-read",
          "keycape-informed-decision-sitting-requester-client",
          "keycape-rapp-qonto-client",
          "keycape-secrets-engine-approval-client",
          "keycape-secrets-engine-openbao-client",
          "keycape-secrets-engine-requester-client"
        ],
        "configmap_names_only": []
      },
      {
        "namespace": "mfa",
        "deployment": "privacyidea",
        "uid": "58c7f96d-61cb-4dd4-bca2-54661c0ac375",
        "generation": 11,
        "pvc_bindings": [
          {
            "name": "privacyidea-data",
            "uid": "65650fc1-02d8-4c0f-84fc-e0015c8f3ed9"
          },
          {
            "name": "privacyidea-logs",
            "uid": "39fa90d9-bc54-4a03-a0d6-ae85165e0cb9"
          }
        ],
        "secret_names_only": [
          "privacyidea-config"
        ],
        "configmap_names_only": [
          "factor-recovery-01119187d90d7b76",
          "keycape-onboarding-9465e5e0b98f7986",
          "privacyidea-cfg"
        ]
      }
    ],
    "secret_values_read": false,
    "backup_captured": false,
    "uploaded": false,
    "runtime_changed": false,
    "credential_grant_created": false,
    "owner_admission_required": [
      "Approve exact CCR-2026-0048/0049 grants and node runtime packet; three required owner reviews, confirmed native SA/namespace/audience boundaries before acceptance",
      "Exclude helper capture label from existing broad DNS allow policies; validate read-only helper manifests and cluster/PVC/source bindings before private capture",
      "Preserve every referenced credential encrypted with original keys; fresh native SQLite/PG snapshots and exact manifest, with documented omissions and no global atomicity claim",
      "Create fresh ciphertext and exact Storage Share object, read back ciphertext and receipt by strong ETag/hash, independently retrieve using operator custody",
      "Attended independent age-key proof: wrong-key denial, complete archive hashes, SQLite/RSA checks, disposable native PostgreSQL restore and verified cleanup before timer activation",
      "Full NK49 closure separately requires native directory/issuer/MFA authentication, retained token decryption, audit signature continuity, current callers and legacy credential dispositions; archive acceptance does not close those gates",
      "Host-local health cannot report a dead host; external outage monitoring and second-provider copy remain separate coverage gaps"
    ]
  },
  "kubeconfig": "/home/worsch/.kube/config",
  "sources": [
    {
      "path": "capture-identity.py",
      "sha256": "47dca7c4dc96fa7eb9fb02c81fca9ca8dc5281aac918979eb7367148168ba705"
    },
    {
      "path": "identity-files.py",
      "sha256": "d0063a9eedd3610e3d45bd2d834aae83cff74e4b3504d138b3548f427e89331d"
    },
    {
      "path": "identity-bundle.py",
      "sha256": "491f6f9f074dd0f73a26b16f32d81dbf70e049569e65c9dcee1cbcd1305dc8dc"
    },
    {
      "path": "prepare-identity-coverage.py",
      "sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1"
    },
    {
      "path": "identity-backup-profile.json",
      "sha256": "dff567f594826628544bb2252c77ccb8daf8a34fd2095026663cc948ffeff63a"
    }
  ],
  "database": {
    "namespace": "databases",
    "cluster": "net-kingdom-pg",
    "cluster_uid": "0cd04a7c-a183-48ac-975a-9f244ea82c73",
    "pod": "net-kingdom-pg-1",
    "pod_uid": "0404c66b-338b-4446-a767-622d248ab0d3",
    "database": "privacyidea_db"
  },
  "create_resources": [
    {
      "apiVersion": "networking.k8s.io/v1",
      "kind": "NetworkPolicy",
      "metadata": {
        "name": "nk49-capture-35ffd825063d",
        "namespace": "sso"
      },
      "spec": {
        "podSelector": {
          "matchLabels": {
            "net-kingdom/capture": "35ffd825063d"
          }
        },
        "policyTypes": [
          "Ingress",
          "Egress"
        ],
        "ingress": [],
        "egress": []
      }
    },
    {
      "apiVersion": "v1",
      "kind": "Pod",
      "metadata": {
        "name": "nk49-capture-35ffd825063d",
        "namespace": "sso",
        "labels": {
          "net-kingdom/capture": "35ffd825063d"
        }
      },
      "spec": {
        "restartPolicy": "Never",
        "activeDeadlineSeconds": 900,
        "automountServiceAccountToken": false,
        "securityContext": {
          "runAsUser": 0,
          "runAsGroup": 0
        },
        "containers": [
          {
            "name": "capture",
            "image": "ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473",
            "imagePullPolicy": "IfNotPresent",
            "command": [
              "python3",
              "-c",
              "import time; time.sleep(900)"
            ],
            "securityContext": {
              "allowPrivilegeEscalation": false,
              "readOnlyRootFilesystem": true,
              "capabilities": {
                "drop": [
                  "ALL"
                ],
                "add": [
                  "DAC_OVERRIDE"
                ]
              }
            },
            "resources": {
              "requests": {
                "cpu": "50m",
                "memory": "128Mi"
              },
              "limits": {
                "cpu": "1",
                "memory": "2Gi"
              }
            },
            "volumeMounts": [
              {
                "name": "lldap",
                "mountPath": "/source/lldap",
                "readOnly": true
              },
              {
                "name": "authelia",
                "mountPath": "/source/authelia",
                "readOnly": true
              },
              {
                "name": "keycape",
                "mountPath": "/source/keycape",
                "readOnly": true
              },
              {
                "name": "scratch",
                "mountPath": "/scratch"
              }
            ]
          }
        ],
        "volumes": [
          {
            "name": "lldap",
            "persistentVolumeClaim": {
              "claimName": "lldap-data",
              "readOnly": true
            }
          },
          {
            "name": "authelia",
            "persistentVolumeClaim": {
              "claimName": "authelia-data",
              "readOnly": true
            }
          },
          {
            "name": "keycape",
            "persistentVolumeClaim": {
              "claimName": "keycape-authentication-policy",
              "readOnly": true
            }
          },
          {
            "name": "scratch",
            "emptyDir": {
              "medium": "Memory",
              "sizeLimit": "512Mi"
            }
          }
        ]
      }
    },
    {
      "apiVersion": "networking.k8s.io/v1",
      "kind": "NetworkPolicy",
      "metadata": {
        "name": "nk49-capture-35ffd825063d",
        "namespace": "mfa"
      },
      "spec": {
        "podSelector": {
          "matchLabels": {
            "net-kingdom/capture": "35ffd825063d"
          }
        },
        "policyTypes": [
          "Ingress",
          "Egress"
        ],
        "ingress": [],
        "egress": []
      }
    },
    {
      "apiVersion": "v1",
      "kind": "Pod",
      "metadata": {
        "name": "nk49-capture-35ffd825063d",
        "namespace": "mfa",
        "labels": {
          "net-kingdom/capture": "35ffd825063d"
        }
      },
      "spec": {
        "restartPolicy": "Never",
        "activeDeadlineSeconds": 900,
        "automountServiceAccountToken": false,
        "securityContext": {
          "runAsUser": 0,
          "runAsGroup": 0
        },
        "containers": [
          {
            "name": "capture",
            "image": "ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473",
            "imagePullPolicy": "IfNotPresent",
            "command": [
              "python3",
              "-c",
              "import time; time.sleep(900)"
            ],
            "securityContext": {
              "allowPrivilegeEscalation": false,
              "readOnlyRootFilesystem": true,
              "capabilities": {
                "drop": [
                  "ALL"
                ],
                "add": [
                  "DAC_OVERRIDE"
                ]
              }
            },
            "resources": {
              "requests": {
                "cpu": "50m",
                "memory": "128Mi"
              },
              "limits": {
                "cpu": "1",
                "memory": "2Gi"
              }
            },
            "volumeMounts": [
              {
                "name": "privacyidea",
                "mountPath": "/source/privacyidea",
                "readOnly": true
              },
              {
                "name": "scratch",
                "mountPath": "/scratch"
              }
            ]
          }
        ],
        "volumes": [
          {
            "name": "privacyidea",
            "persistentVolumeClaim": {
              "claimName": "privacyidea-data",
              "readOnly": true
            }
          },
          {
            "name": "scratch",
            "emptyDir": {
              "medium": "Memory",
              "sizeLimit": "512Mi"
            }
          }
        ]
      }
    }
  ],
  "service_changes": false,
  "credential_grants": false,
  "matching_network_allow_policies": [
    {
      "namespace": "sso",
      "name": "allow-egress-dns",
      "uid": "d2a1bd49-7035-437b-9b8e-e9e66b203365",
      "spec_sha256": "c22e3a30891f0fa3cdcde97d26c91a09d11a8e94f7dfc66641d8be1cbd976f15"
    },
    {
      "namespace": "mfa",
      "name": "allow-egress-dns",
      "uid": "1d23ed08-bb6f-4959-b72e-3f03af40f136",
      "spec_sha256": "c22e3a30891f0fa3cdcde97d26c91a09d11a8e94f7dfc66641d8be1cbd976f15"
    }
  ],
  "network_policy_enforcement_requires_owner_confirmation": true,
  "offsite_delivery_included": false,
  "global_atomic_snapshot_claimed": false,
  "finished_at": "2026-10-15T23:33:14.927800+00:00"
}