tegwick
634b3a41df
tools/service-binds/executor-lanes.py (bind-lane.py shape): under both sha256-bound, approved, binding-confirmed CCRs (0058 write, 0059 journey) and an attended platform-admin, apply both policies, set cas_required on the svc-authelia key, create the standing journey-read role, refuse if the window-scoped write role exists, prove the agent fence; verify proves the journey token reads only its path (<=15m) and denies wrong SA, wrong audience and write-role login. Value-free receipts. 12 tests on a fake OpenBao (real helpers), in make bounded-executor-test. Founder runbook: sso-mfa/k8s/bounded-executor/T10-LANES-RUNBOOK.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196 |
||
|---|---|---|
| .. | ||
| authelia | ||
| backup | ||
| bounded-executor | ||
| cert-manager | ||
| identity-provisioner | ||
| keycape | ||
| lldap | ||
| namespaces | ||
| network-policies | ||
| postgresql | ||
| privacyidea | ||
| storage | ||
| synthetic-journey | ||
| tenant-engine | ||
| user-engine | ||
| FOUNDATIONS-HISTORICAL.md | ||
| README.md | ||
| verify-identity-cutover-dependencies.sh | ||
| verify-t02.sh | ||
| verify-t03.sh | ||
| verify-t04.sh | ||
| verify-t05.sh | ||
| verify-t06.sh | ||
| verify-t07.sh | ||
| verify-t08.sh | ||
NetKingdom Kubernetes integration guidance
This directory holds bootstrap tooling, integration references and migration history. Current managed deployment belongs to the service/package owners under ADR-0015. The original foundation procedure is retained as historical material, including its old prerequisites and apply commands.
Operating baseline
The September 28 review
observed one Ready Railiance01 node at 92.205.62.239, healthy lightweight
identity components and single-instance CNPG databases. This is a dated
inventory, not an HA, recovery or user-login acceptance claim.
| Surface | Current role and owner |
|---|---|
KeyCape / Authelia / LLDAP (sso) and privacyIDEA (mfa) |
Lightweight identity composition; issuer implementation in key-cape, integration contracts here |
| User Engine | rapp-user-engine owns managed manifests, rollout and rollback |
| Tenant Engine | rapp-tenant-engine owns managed runtime and database-consumption configuration |
| flex-auth consumer services | Owner values and chart pointers; caller authentication is enforced by the owner declarations |
| OpenBao and database custody | railiance-platform, with managed packages and consumer declarations in their owning repositories |
| Kubernetes and host substrate | railiance-cluster operator runbook and railiance-infra |
OpenBao's public browser endpoint bao.coulomb.social is retired. Operators
use the named openbao-ui-railiance01 tunnel at http://127.0.0.1:18200;
workloads use the internal Service. Follow the platform's
operator-only cutover record
and credential routing in AGENTS.md. Route access before
requesting credentials; never copy tokens or Secret values into evidence.
Read-only orientation
Check the context before interpreting these results. All commands below read resource metadata and readiness; none applies manifests or initiates login.
kubectl config current-context
kubectl get nodes -o wide
kubectl -n sso get deployments
kubectl -n mfa get deployments
kubectl -n user-engine get deployments
kubectl -n tenant-engine get deployments
kubectl -n flex-auth get deployments
kubectl -n openbao get statefulsets,deployments,services,ingresses
kubectl get clusters.postgresql.cnpg.io -A
Ready replicas do not prove negative authorization, actual-user MFA, successful backup restoration or independent failure domains. Use the relevant owner's verification and recovery procedure for those claims.
Deployment and recovery
Start with the owning package's current declaration, immutable image and
reviewed rollout/rollback procedure. Do not recursively apply this tree.
tenant-engine/runtime.yaml is retired (NK-WP-0039-T04) and holds owner pointers only, no
objects; the Tenant Engine and flex-auth declarations live with their owners.
The scripts and manifests elsewhere in this directory have individual scopes; their presence here does not make them current production repair commands. The attended procedure inventory records their exercise limits. Use the custody model and current owner runbooks to prepare recovery. A database-only drill does not prove restoration of LLDAP, Authelia, privacyIDEA and its matching encryption material, or all identity database state.
CoulombCore identity cutover and retained cluster deletion completed on 2026-10-15 under the recorded approval and passing restart gate in NK-WP-0022. Railiance01 is authoritative. Recover through current owner runbooks and protected independent backups; the old cluster and its local PVCs are gone.
Identity-provisioner service group provenance
The owner storage and request migration contract
describes the durable journal required by governed service-group ensure/revoke.
The existing reference identity-provisioner Deployment has a read-only root
filesystem, UID10001 and no provenance volume. The implemented SQLite backend
is local/disposable only. Accepted ADR-0015 rejects SQLite-on-a-PVC for production;
native journal storage requires the CNPG/rapp-postgres consumer contract or an
explicit governed exception, plus owner-admitted image/storage/caller and writer
isolation. Keep production group operations disabled pending that admission.
This guidance does not apply or authorize a native volume change.