tegwick
ce198fc290
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c
143 lines
3.9 KiB
Markdown
143 lines
3.9 KiB
Markdown
---
|
|
id: NK-WP-0009
|
|
type: workplan
|
|
title: NetKingdom Security Pattern Tutorials
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: backlog
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
planning_priority: medium
|
|
planning_order: 9
|
|
created: 2026-05-17
|
|
updated: 2026-07-08
|
|
depends_on:
|
|
- NK-WP-0008
|
|
state_hub_workstream_id: "d4d02dbf-3974-502d-8b87-b776fc63e17e"
|
|
---
|
|
|
|
# NK-WP-0009 - NetKingdom Security Pattern Tutorials
|
|
|
|
## Goal
|
|
|
|
Build practical tutorials that show operators and developers how to
|
|
implement canonical NetKingdom security architecture patterns in
|
|
NetKingdom-enabled IT infrastructures.
|
|
|
|
Where NK-WP-0008 is the pattern library, this workplan is the hands-on
|
|
path: runnable examples, checklists, commands, manifests, verification
|
|
steps, and failure-mode exercises.
|
|
|
|
## Context
|
|
|
|
The platform needs more than architecture statements. A new deployment
|
|
should be able to answer:
|
|
|
|
- How do I issue identity tokens in lightweight mode versus expanded
|
|
mode?
|
|
- How do I ask flex-auth for a resource decision?
|
|
- How do I vend temporary object-storage credentials?
|
|
- How do I deploy OpenBao and avoid secret zero traps?
|
|
- How do I use short-lived SSH certificates for agents and automations?
|
|
- How do I verify audit records and break-glass behavior?
|
|
|
|
Tutorials turn canonical patterns into repeatable implementation
|
|
practice without forcing every application repo to rediscover the same
|
|
steps.
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
|
|
- tutorial structure and style guide
|
|
- runnable or copy-pasteable examples
|
|
- local/dev and production variants where appropriate
|
|
- verification and rollback steps
|
|
- integration references to key-cape, flex-auth, ops-warden,
|
|
ops-bridge, railiance-platform, and artifact-store
|
|
|
|
Out of scope:
|
|
|
|
- deploying live services directly from this repo
|
|
- replacing repo-specific operator runbooks
|
|
- hiding provider-specific security differences behind one generic
|
|
command
|
|
|
|
## Tasks
|
|
|
|
```task
|
|
id: NK-WP-0009-T01
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "3c6824a0-39e6-51f5-b46f-5861a9375439"
|
|
```
|
|
|
|
Create a tutorial template with prerequisites, architecture context,
|
|
commands, manifests, verification, rollback, threat checks, and
|
|
cross-repo ownership notes.
|
|
|
|
```task
|
|
id: NK-WP-0009-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "d13760fd-2527-5a39-acb1-11c8091d65a1"
|
|
```
|
|
|
|
Write the first tutorial: "Vend temporary S3 credentials from a
|
|
NetKingdom identity token", covering key-cape/Keycloak identity,
|
|
flex-auth authorization, object-store STS exchange, and SDK consumer
|
|
configuration.
|
|
|
|
```task
|
|
id: NK-WP-0009-T03
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "16cf51a4-0763-59e9-9b4c-d486f5bde908"
|
|
```
|
|
|
|
Write "Deploy OpenBao as the canonical secrets manager for a
|
|
NetKingdom-enabled Railiance platform", linking to the Railiance
|
|
Platform workplan and covering auth methods, secret engines, CSI/ESO
|
|
integration, leases, unseal, backup, and break-glass.
|
|
|
|
```task
|
|
id: NK-WP-0009-T04
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "1d28e3f1-fb39-5d0e-a7ee-ce2e9bc16ed5"
|
|
```
|
|
|
|
Write "Use short-lived SSH credentials for admins, agents, and
|
|
automations", using ops-warden and ops-bridge as the reference
|
|
implementation.
|
|
|
|
```task
|
|
id: NK-WP-0009-T05
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "c380ef19-4bc2-5ade-b127-baf18c64bf35"
|
|
```
|
|
|
|
Write "Add a protected system to flex-auth", covering resource
|
|
manifests, action vocabulary, claim envelopes, policy packages,
|
|
decision envelopes, and delegated PDP options.
|
|
|
|
```task
|
|
id: NK-WP-0009-T06
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "5b6a1670-a283-56e9-892e-ef8b91194a7b"
|
|
```
|
|
|
|
Add tutorial verification fixtures or checklists so each tutorial has a
|
|
clear "done when" outcome and does not become prose-only guidance.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- Tutorials are grouped under a stable docs path with a repeatable
|
|
format.
|
|
- Each tutorial maps back to one or more NK-WP-0008 patterns.
|
|
- Tutorials name the owning repo for every concrete implementation
|
|
step.
|
|
- Tutorials include verification and rollback guidance, not just happy
|
|
path commands.
|