net-kingdom/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	planning_priority	planning_order	created	updated	depends_on	state_hub_workstream_id
NK-WP-0009	workplan	NetKingdom Security Pattern Tutorials	infotech	net-kingdom	backlog	implementation	codex	netkingdom	medium	9	2026-05-17	2026-09-28	NK-WP-0008	d4d02dbf-3974-502d-8b87-b776fc63e17e

NK-WP-0009 - NetKingdom Security Pattern Tutorials

Goal

Build practical tutorials that show operators and developers how to implement canonical NetKingdom security architecture patterns in NetKingdom-enabled IT infrastructures.

Where NK-WP-0008 is the pattern library, this workplan is the hands-on path: runnable examples, checklists, commands, manifests, verification steps, and failure-mode exercises.

Context

The platform needs more than architecture statements. A new deployment should be able to answer:

• How do I issue identity tokens in lightweight mode versus expanded mode?
• How do I ask flex-auth for a resource decision?
• How do I vend temporary object-storage credentials?
• How do I deploy OpenBao and avoid secret zero traps?
• How do I use short-lived SSH certificates for agents and automations?
• How do I verify audit records and break-glass behavior?

Tutorials turn canonical patterns into repeatable implementation practice without forcing every application repo to rediscover the same steps.

Scope

In scope:

• tutorial structure and style guide
• runnable or copy-pasteable examples
• local/dev and production variants where appropriate
• verification and rollback steps
• integration references to key-cape, flex-auth, ops-warden, ops-bridge, railiance-platform, and artifact-store

Out of scope:

• deploying live services directly from this repo
• replacing repo-specific operator runbooks
• hiding provider-specific security differences behind one generic command

Create the tutorial template

id: NK-WP-0009-T01
status: todo
priority: high
state_hub_task_id: "3c6824a0-39e6-51f5-b46f-5861a9375439"

Create a tutorial template with prerequisites, architecture context, commands, manifests, verification, rollback, threat checks, and cross-repo ownership notes.

Demonstrate temporary object credentials

id: NK-WP-0009-T02
status: todo
priority: high
state_hub_task_id: "d13760fd-2527-5a39-acb1-11c8091d65a1"

Write the first tutorial: "Vend temporary S3 credentials from a NetKingdom identity token", covering key-cape/Keycloak identity, flex-auth authorization, object-store STS exchange, and SDK consumer configuration.

Document the existing OpenBao operating path

id: NK-WP-0009-T03
status: todo
priority: high
state_hub_task_id: "16cf51a4-0763-59e9-9b4c-d486f5bde908"

Write "Deploy OpenBao as the canonical secrets manager for a NetKingdom-enabled Railiance platform", linking to the Railiance Platform workplan and covering auth methods, secret engines, CSI/ESO integration, leases, unseal, backup, and break-glass.

Document SSH certificates and tunnels

id: NK-WP-0009-T04
status: todo
priority: medium
state_hub_task_id: "1d28e3f1-fb39-5d0e-a7ee-ce2e9bc16ed5"

Write "Use short-lived SSH credentials for admins, agents, and automations", using ops-warden and ops-bridge as the reference implementation.

Integrate a protected flex-auth consumer

id: NK-WP-0009-T05
status: todo
priority: medium
state_hub_task_id: "c380ef19-4bc2-5ade-b127-baf18c64bf35"

Write "Add a protected system to flex-auth", covering resource manifests, action vocabulary, claim envelopes, policy packages, decision envelopes, and delegated PDP options.

Verify the tutorial outcomes

id: NK-WP-0009-T06
status: todo
priority: medium
state_hub_task_id: "5b6a1670-a283-56e9-892e-ef8b91194a7b"

Add tutorial verification fixtures or checklists so each tutorial has a clear "done when" outcome and does not become prose-only guidance.

Acceptance Criteria

• Tutorials are grouped under a stable docs path with a repeatable format.
• Each tutorial maps back to one or more NK-WP-0008 patterns.
• Tutorials name the owning repo for every concrete implementation step.
• Tutorials include verification and rollback guidance, not just happy path commands.

Infrastructure review — 2026-09-28

Keep this plan in backlog, with the first implementation slice T01 + T03 + T04 + T06: document the paths already operated and capture safe verification and recovery outcomes. OpenBao is already deployed and private; T03 should teach consumption, attended access and recovery, with greenfield deployment kept as an isolated lab exercise. Use the named openbao-ui-railiance01 tunnel and owner runbooks, not a public Bao URL or copied runtime manifest.

T02 is conditional on an owner-backed object-store STS issuer and refusal/lease proof; ADR-0008 is architecture, not evidence that the endpoint is live. T05 must include projected caller identity, audience, binding and unauthorized caller rejection: all six live consumers now enforce caller authentication. Use accepted IAM v0.3 and owner package declarations under ADR-0015. T06 requires executable safe fixtures or repeatable outcome checks; never teach operators to apply the stale tenant-engine reference YAML.

Evidence and cross-plan priorities: estate review.