tegwick 6c7c37aa70 NK-WP-0056-T04: svc-keycape bind lane (source only, CCR-2026-0054) ... KeyCape takes KEYCAPE_LLDAP_BIND_PW (key-cape KEY-WP-0046). ESO creates the dedicated Secret keycape-lldap-bind. bind-lane setup reads the current bindPW from keycape-config and requires the svc-keycape bindDN; verify compares the delivered Secret, and the config value while it is present. directory-bind-rollout gains clear-password, which runs only with the service bind and the delivered env (switch restores). deployment.yaml pins image main-e2b5fa1 and adds the env. Nothing is applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2		2026-10-31 10:31:30 +01:00
..
bootstrap	NK-WP-0056-T04: svc-authelia bind delivered from OpenBao; setup and verify receipts	2026-10-31 10:11:07 +01:00
k8s	NK-WP-0056-T04: svc-keycape bind lane (source only, CCR-2026-0054)	2026-10-31 10:31:30 +01:00
WORKPLAN.md	security: repair LDAP group callers and fail incomplete T07 acceptance	2026-10-14 01:17:35 +02:00