tegwick
994d11c869
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
393 lines
12 KiB
JSON
393 lines
12 KiB
JSON
{
|
|
"schema": "netkingdom.identity-capture-plan.v1",
|
|
"status": "requires_owner_execution_admission",
|
|
"created_at": "2026-10-15T23:33:14.370426+00:00",
|
|
"run_id": "35ffd825063d",
|
|
"binding": {
|
|
"schema": "netkingdom.identity-backup-preparation.v1",
|
|
"status": "prepared_not_admitted",
|
|
"observed_at": "2026-10-15T23:33:13.858371+00:00",
|
|
"cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
|
|
"profile_sha256": "dff567f594826628544bb2252c77ccb8daf8a34fd2095026663cc948ffeff63a",
|
|
"source_sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1",
|
|
"bindings": [
|
|
{
|
|
"namespace": "sso",
|
|
"deployment": "lldap",
|
|
"uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
|
|
"generation": 7,
|
|
"pvc_bindings": [
|
|
{
|
|
"name": "lldap-data",
|
|
"uid": "0a06b65a-e7b3-42d3-916e-e74dbe5fc7da"
|
|
}
|
|
],
|
|
"secret_names_only": [
|
|
"lldap-secrets"
|
|
],
|
|
"configmap_names_only": []
|
|
},
|
|
{
|
|
"namespace": "sso",
|
|
"deployment": "authelia",
|
|
"uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
|
|
"generation": 28,
|
|
"pvc_bindings": [
|
|
{
|
|
"name": "authelia-data",
|
|
"uid": "86826554-b014-4df4-8b28-866aa64f6413"
|
|
}
|
|
],
|
|
"secret_names_only": [
|
|
"authelia-secrets",
|
|
"authelia-smtp"
|
|
],
|
|
"configmap_names_only": [
|
|
"authelia-config"
|
|
]
|
|
},
|
|
{
|
|
"namespace": "sso",
|
|
"deployment": "keycape",
|
|
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
|
|
"generation": 65,
|
|
"pvc_bindings": [
|
|
{
|
|
"name": "keycape-authentication-policy",
|
|
"uid": "423f558f-8c11-4edf-956b-243559df4a8e"
|
|
}
|
|
],
|
|
"secret_names_only": [
|
|
"keycape-approval-engine-operator-client",
|
|
"keycape-config",
|
|
"keycape-factor-read",
|
|
"keycape-informed-decision-sitting-requester-client",
|
|
"keycape-rapp-qonto-client",
|
|
"keycape-secrets-engine-approval-client",
|
|
"keycape-secrets-engine-openbao-client",
|
|
"keycape-secrets-engine-requester-client"
|
|
],
|
|
"configmap_names_only": []
|
|
},
|
|
{
|
|
"namespace": "mfa",
|
|
"deployment": "privacyidea",
|
|
"uid": "58c7f96d-61cb-4dd4-bca2-54661c0ac375",
|
|
"generation": 11,
|
|
"pvc_bindings": [
|
|
{
|
|
"name": "privacyidea-data",
|
|
"uid": "65650fc1-02d8-4c0f-84fc-e0015c8f3ed9"
|
|
},
|
|
{
|
|
"name": "privacyidea-logs",
|
|
"uid": "39fa90d9-bc54-4a03-a0d6-ae85165e0cb9"
|
|
}
|
|
],
|
|
"secret_names_only": [
|
|
"privacyidea-config"
|
|
],
|
|
"configmap_names_only": [
|
|
"factor-recovery-01119187d90d7b76",
|
|
"keycape-onboarding-9465e5e0b98f7986",
|
|
"privacyidea-cfg"
|
|
]
|
|
}
|
|
],
|
|
"secret_values_read": false,
|
|
"backup_captured": false,
|
|
"uploaded": false,
|
|
"runtime_changed": false,
|
|
"credential_grant_created": false,
|
|
"owner_admission_required": [
|
|
"Approve exact CCR-2026-0048/0049 grants and node runtime packet; three required owner reviews, confirmed native SA/namespace/audience boundaries before acceptance",
|
|
"Exclude helper capture label from existing broad DNS allow policies; validate read-only helper manifests and cluster/PVC/source bindings before private capture",
|
|
"Preserve every referenced credential encrypted with original keys; fresh native SQLite/PG snapshots and exact manifest, with documented omissions and no global atomicity claim",
|
|
"Create fresh ciphertext and exact Storage Share object, read back ciphertext and receipt by strong ETag/hash, independently retrieve using operator custody",
|
|
"Attended independent age-key proof: wrong-key denial, complete archive hashes, SQLite/RSA checks, disposable native PostgreSQL restore and verified cleanup before timer activation",
|
|
"Full NK49 closure separately requires native directory/issuer/MFA authentication, retained token decryption, audit signature continuity, current callers and legacy credential dispositions; archive acceptance does not close those gates",
|
|
"Host-local health cannot report a dead host; external outage monitoring and second-provider copy remain separate coverage gaps"
|
|
]
|
|
},
|
|
"kubeconfig": "/home/worsch/.kube/config",
|
|
"sources": [
|
|
{
|
|
"path": "capture-identity.py",
|
|
"sha256": "47dca7c4dc96fa7eb9fb02c81fca9ca8dc5281aac918979eb7367148168ba705"
|
|
},
|
|
{
|
|
"path": "identity-files.py",
|
|
"sha256": "d0063a9eedd3610e3d45bd2d834aae83cff74e4b3504d138b3548f427e89331d"
|
|
},
|
|
{
|
|
"path": "identity-bundle.py",
|
|
"sha256": "491f6f9f074dd0f73a26b16f32d81dbf70e049569e65c9dcee1cbcd1305dc8dc"
|
|
},
|
|
{
|
|
"path": "prepare-identity-coverage.py",
|
|
"sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1"
|
|
},
|
|
{
|
|
"path": "identity-backup-profile.json",
|
|
"sha256": "dff567f594826628544bb2252c77ccb8daf8a34fd2095026663cc948ffeff63a"
|
|
}
|
|
],
|
|
"database": {
|
|
"namespace": "databases",
|
|
"cluster": "net-kingdom-pg",
|
|
"cluster_uid": "0cd04a7c-a183-48ac-975a-9f244ea82c73",
|
|
"pod": "net-kingdom-pg-1",
|
|
"pod_uid": "0404c66b-338b-4446-a767-622d248ab0d3",
|
|
"database": "privacyidea_db"
|
|
},
|
|
"create_resources": [
|
|
{
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
"kind": "NetworkPolicy",
|
|
"metadata": {
|
|
"name": "nk49-capture-35ffd825063d",
|
|
"namespace": "sso"
|
|
},
|
|
"spec": {
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"net-kingdom/capture": "35ffd825063d"
|
|
}
|
|
},
|
|
"policyTypes": [
|
|
"Ingress",
|
|
"Egress"
|
|
],
|
|
"ingress": [],
|
|
"egress": []
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "Pod",
|
|
"metadata": {
|
|
"name": "nk49-capture-35ffd825063d",
|
|
"namespace": "sso",
|
|
"labels": {
|
|
"net-kingdom/capture": "35ffd825063d"
|
|
}
|
|
},
|
|
"spec": {
|
|
"restartPolicy": "Never",
|
|
"activeDeadlineSeconds": 900,
|
|
"automountServiceAccountToken": false,
|
|
"securityContext": {
|
|
"runAsUser": 0,
|
|
"runAsGroup": 0
|
|
},
|
|
"containers": [
|
|
{
|
|
"name": "capture",
|
|
"image": "ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473",
|
|
"imagePullPolicy": "IfNotPresent",
|
|
"command": [
|
|
"python3",
|
|
"-c",
|
|
"import time; time.sleep(900)"
|
|
],
|
|
"securityContext": {
|
|
"allowPrivilegeEscalation": false,
|
|
"readOnlyRootFilesystem": true,
|
|
"capabilities": {
|
|
"drop": [
|
|
"ALL"
|
|
],
|
|
"add": [
|
|
"DAC_OVERRIDE"
|
|
]
|
|
}
|
|
},
|
|
"resources": {
|
|
"requests": {
|
|
"cpu": "50m",
|
|
"memory": "128Mi"
|
|
},
|
|
"limits": {
|
|
"cpu": "1",
|
|
"memory": "2Gi"
|
|
}
|
|
},
|
|
"volumeMounts": [
|
|
{
|
|
"name": "lldap",
|
|
"mountPath": "/source/lldap",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"name": "authelia",
|
|
"mountPath": "/source/authelia",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"name": "keycape",
|
|
"mountPath": "/source/keycape",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"name": "scratch",
|
|
"mountPath": "/scratch"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"name": "lldap",
|
|
"persistentVolumeClaim": {
|
|
"claimName": "lldap-data",
|
|
"readOnly": true
|
|
}
|
|
},
|
|
{
|
|
"name": "authelia",
|
|
"persistentVolumeClaim": {
|
|
"claimName": "authelia-data",
|
|
"readOnly": true
|
|
}
|
|
},
|
|
{
|
|
"name": "keycape",
|
|
"persistentVolumeClaim": {
|
|
"claimName": "keycape-authentication-policy",
|
|
"readOnly": true
|
|
}
|
|
},
|
|
{
|
|
"name": "scratch",
|
|
"emptyDir": {
|
|
"medium": "Memory",
|
|
"sizeLimit": "512Mi"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
"kind": "NetworkPolicy",
|
|
"metadata": {
|
|
"name": "nk49-capture-35ffd825063d",
|
|
"namespace": "mfa"
|
|
},
|
|
"spec": {
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"net-kingdom/capture": "35ffd825063d"
|
|
}
|
|
},
|
|
"policyTypes": [
|
|
"Ingress",
|
|
"Egress"
|
|
],
|
|
"ingress": [],
|
|
"egress": []
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "Pod",
|
|
"metadata": {
|
|
"name": "nk49-capture-35ffd825063d",
|
|
"namespace": "mfa",
|
|
"labels": {
|
|
"net-kingdom/capture": "35ffd825063d"
|
|
}
|
|
},
|
|
"spec": {
|
|
"restartPolicy": "Never",
|
|
"activeDeadlineSeconds": 900,
|
|
"automountServiceAccountToken": false,
|
|
"securityContext": {
|
|
"runAsUser": 0,
|
|
"runAsGroup": 0
|
|
},
|
|
"containers": [
|
|
{
|
|
"name": "capture",
|
|
"image": "ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473",
|
|
"imagePullPolicy": "IfNotPresent",
|
|
"command": [
|
|
"python3",
|
|
"-c",
|
|
"import time; time.sleep(900)"
|
|
],
|
|
"securityContext": {
|
|
"allowPrivilegeEscalation": false,
|
|
"readOnlyRootFilesystem": true,
|
|
"capabilities": {
|
|
"drop": [
|
|
"ALL"
|
|
],
|
|
"add": [
|
|
"DAC_OVERRIDE"
|
|
]
|
|
}
|
|
},
|
|
"resources": {
|
|
"requests": {
|
|
"cpu": "50m",
|
|
"memory": "128Mi"
|
|
},
|
|
"limits": {
|
|
"cpu": "1",
|
|
"memory": "2Gi"
|
|
}
|
|
},
|
|
"volumeMounts": [
|
|
{
|
|
"name": "privacyidea",
|
|
"mountPath": "/source/privacyidea",
|
|
"readOnly": true
|
|
},
|
|
{
|
|
"name": "scratch",
|
|
"mountPath": "/scratch"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"name": "privacyidea",
|
|
"persistentVolumeClaim": {
|
|
"claimName": "privacyidea-data",
|
|
"readOnly": true
|
|
}
|
|
},
|
|
{
|
|
"name": "scratch",
|
|
"emptyDir": {
|
|
"medium": "Memory",
|
|
"sizeLimit": "512Mi"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"service_changes": false,
|
|
"credential_grants": false,
|
|
"matching_network_allow_policies": [
|
|
{
|
|
"namespace": "sso",
|
|
"name": "allow-egress-dns",
|
|
"uid": "d2a1bd49-7035-437b-9b8e-e9e66b203365",
|
|
"spec_sha256": "c22e3a30891f0fa3cdcde97d26c91a09d11a8e94f7dfc66641d8be1cbd976f15"
|
|
},
|
|
{
|
|
"namespace": "mfa",
|
|
"name": "allow-egress-dns",
|
|
"uid": "1d23ed08-bb6f-4959-b72e-3f03af40f136",
|
|
"spec_sha256": "c22e3a30891f0fa3cdcde97d26c91a09d11a8e94f7dfc66641d8be1cbd976f15"
|
|
}
|
|
],
|
|
"network_policy_enforcement_requires_owner_confirmation": true,
|
|
"offsite_delivery_included": false,
|
|
"global_atomic_snapshot_claimed": false,
|
|
"finished_at": "2026-10-15T23:33:14.927800+00:00"
|
|
}
|