tegwick
1fbebb2d94
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 6969@bnt-lap001 Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0
78 lines
2.9 KiB
YAML
78 lines
2.9 KiB
YAML
spec: runbook-pack/v0.2
|
|
id: nk.user-lifecycle-dry-run
|
|
title: Non-root user lifecycle dry-run
|
|
owner: net-kingdom
|
|
outcome: A non-root user is created, verified, locked and offboarded, LLDAP, groups, MFA and KeyCape claims are checked, and non-secret evidence validates.
|
|
engine: native
|
|
framing:
|
|
- Uses a throwaway subject; no real account is touched.
|
|
- Evidence is non-secret; passwords and codes never appear in it.
|
|
- Ported from the security bootstrap console runbook "User lifecycle dry-run (T06)"; see NET-WP-0019.
|
|
actors:
|
|
- id: custodian
|
|
role: Platform custodian
|
|
description: Runs the dry-run and reviews the evidence.
|
|
privileges: [lldap-admin, keycape-read]
|
|
datapoints:
|
|
- id: subject
|
|
label: Dry-run subject
|
|
type: string
|
|
default: dryrun-user
|
|
pattern: "[a-z0-9-]+"
|
|
dimensions: {actor: custodian, kind: identity, subsystem: LLDAP}
|
|
ask_in: run
|
|
- id: email
|
|
label: Dry-run email
|
|
type: string
|
|
default: dryrun-user@example.com
|
|
dimensions: {actor: custodian, kind: identity, subsystem: LLDAP}
|
|
ask_in: run
|
|
- id: display
|
|
label: Display name
|
|
type: string
|
|
default: Dry Run
|
|
dimensions: {actor: custodian, kind: identity, subsystem: LLDAP}
|
|
ask_in: run
|
|
- id: evidence_path
|
|
label: Evidence file
|
|
type: path
|
|
default: /tmp/netkingdom-onboarding-dry-run/evidence.json
|
|
dimensions: {actor: custodian, kind: location, subsystem: LLDAP}
|
|
ask_in: run
|
|
stages:
|
|
- id: run
|
|
title: Run the lifecycle
|
|
goal: Create, verify, lock and offboard completed for the subject.
|
|
steps:
|
|
- id: template
|
|
title: Print the evidence template
|
|
actor: custodian
|
|
owner: net-kingdom
|
|
command: make security-bootstrap-onboarding-dry-run-template
|
|
idempotent: idempotent
|
|
verify:
|
|
done_when: A non-secret evidence JSON template is printed
|
|
expect: manual
|
|
- id: dry-run
|
|
title: Run the dry-run orchestrator
|
|
actor: custodian
|
|
owner: LLDAP
|
|
requires: [template]
|
|
uses: [subject, email, display]
|
|
command: make security-bootstrap-onboarding-dry-run SUBJECT={{subject}} EMAIL={{email}} DISPLAY="{{display}}"
|
|
idempotent: non-idempotent
|
|
auto_confirm: manual-only
|
|
rollback: Offboard the subject (the orchestrator's final step); delete it in LLDAP if that step did not run.
|
|
verify:
|
|
done_when: The orchestrator finished create, verify, lock and offboard
|
|
expect: manual
|
|
gates:
|
|
- id: evidence-valid
|
|
title: The dry-run evidence validates
|
|
goal: governed-lifecycle
|
|
blocking: true
|
|
downstream_risk: Onboarding is trusted without proof that offboarding works.
|
|
checks:
|
|
- done_when: The evidence validator accepts the file
|
|
command: make security-bootstrap-validate-onboarding-dry-run ONBOARDING_DRY_RUN_EVIDENCE={{evidence_path}}
|
|
expect: exit-0
|