tegwick
cdf0d9bf25
Window-scoped write role (CCR-2026-0058 approved as amended), bind self-rotation (pilot step is OPERATE on the one bind; svc-executor-pw dropped), pilot without the PDP gate (not-evaluated), started event plus one receipt per run, rapp Job in sso, owner workplans approved. New tasks: T11 core runner, T12 pilot operations and packaging; T06 depends on T12. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
147 lines
4.5 KiB
YAML
147 lines
4.5 KiB
YAML
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
|
|
kind: BoundedExecutionAdmission
|
|
spec:
|
|
id: BEA-2026-0099
|
|
title: Switch LLDAP's configured super-admin to ld-admin (bind-split step 9, root-class)
|
|
purpose: Change LLDAP_LDAP_USER_DN from admin to ld-admin and restart LLDAP; admin keeps its rights through lldap_admin
|
|
membership. Changes who administers the directory, so the founder admits the run.
|
|
work_ref: NK-WP-0056-T01 example
|
|
risk_class: high
|
|
window:
|
|
not_before: '2026-11-03T09:00:00Z'
|
|
not_after: '2026-11-03T11:00:00Z'
|
|
approval:
|
|
approvers:
|
|
- admin
|
|
principal_type: HUMAN
|
|
assurance: aal2
|
|
carriers:
|
|
- approval-engine
|
|
- founder-ssh-signature
|
|
executor:
|
|
identity: service:nk-bind-executor
|
|
principal_type: WORKLOAD
|
|
runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
|
|
scope_ceiling:
|
|
- mode: ADMINISTER
|
|
scope: lldap
|
|
environments:
|
|
- PRODUCTION
|
|
- mode: OPERATE
|
|
scope: k8s/sso/deployment/lldap
|
|
environments:
|
|
- PRODUCTION
|
|
blast_radius:
|
|
unit: consumer
|
|
consumers:
|
|
- lldap
|
|
max_concurrent: 1
|
|
trust_requires:
|
|
- runtime_secret_trust
|
|
- runtime_identity_trust
|
|
plan:
|
|
source:
|
|
repo: net-kingdom
|
|
commit: c9ab01e23e92
|
|
files:
|
|
- path: sso-mfa/k8s/lldap/bind-split.py
|
|
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
|
- path: sso-mfa/k8s/synthetic-journey/journey.py
|
|
sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
|
|
steps:
|
|
- id: switch-user-dn
|
|
operation: lldap.config.set-ldap-user-dn
|
|
target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
|
|
consumer: lldap
|
|
class: root-class
|
|
mutates: true
|
|
requires:
|
|
mode: ADMINISTER
|
|
scope: lldap
|
|
checks_after:
|
|
- ld-admin-administers
|
|
revert: switch-back
|
|
- id: restart-lldap
|
|
operation: k8s.rollout-restart
|
|
target: k8s:sso/deployment/lldap
|
|
consumer: lldap
|
|
class: root-class
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: k8s/sso/deployment/lldap
|
|
checks_after:
|
|
- synthetic-journey
|
|
revert: restart-lldap-again
|
|
- id: change-admin-password
|
|
operation: lldap.user.set-password
|
|
target: lldap:admin
|
|
consumer: lldap
|
|
class: human-intrinsic
|
|
mutates: true
|
|
requires:
|
|
mode: ADMINISTER
|
|
scope: lldap
|
|
checks_after:
|
|
- ld-admin-administers
|
|
revert: switch-back
|
|
revert_steps:
|
|
- id: switch-back
|
|
operation: lldap.config.set-ldap-user-dn
|
|
target: k8s:sso/secret/lldap-secrets#LLDAP_LDAP_USER_DN
|
|
consumer: lldap
|
|
class: root-class
|
|
mutates: true
|
|
requires:
|
|
mode: ADMINISTER
|
|
scope: lldap
|
|
- id: restart-lldap-again
|
|
operation: k8s.rollout-restart
|
|
target: k8s:sso/deployment/lldap
|
|
consumer: lldap
|
|
class: root-class
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: k8s/sso/deployment/lldap
|
|
plan_digest: sha256:139f0ca7564184290c7cb1f6b20bdb9807db98e5609a79083ac6f7aea13bb50c
|
|
checks:
|
|
- id: ld-admin-administers
|
|
description: ld-admin signs in and administers; admin keeps lldap_admin membership
|
|
ref: sso-mfa/k8s/lldap/bind-split.py
|
|
sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
|
|
timeout_seconds: 60
|
|
expect: pass
|
|
- id: synthetic-journey
|
|
description: 'all three binds still serve sign-in: syn-journey reaches aal2'
|
|
ref: sso-mfa/k8s/synthetic-journey/journey.py
|
|
sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
|
|
timeout_seconds: 90
|
|
expect: pass
|
|
settle_seconds: 125
|
|
stop_and_revert:
|
|
on_check_failure: revert
|
|
on_budget_exhausted: revert
|
|
on_unknown: stop
|
|
on_revert_failure: stop-and-alert
|
|
alert: founder via State Hub message; crisis list item for ld-admin
|
|
budget:
|
|
wall_time_seconds: 900
|
|
attempts: 1
|
|
cost:
|
|
compute_cpu_seconds: 60
|
|
egress_bytes: 1000000
|
|
currency: EUR
|
|
amount: 0.02
|
|
consumption:
|
|
single_use: true
|
|
consume_before_first_step: true
|
|
receipt:
|
|
schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
|
|
emit_to: audit-core
|
|
retain: by-hash-no-secret-values
|
|
independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
|
|
not_authorized:
|
|
- changing admin's own password
|
|
- sealing ld-admin's password (human-intrinsic, step 10)
|
|
- any service bind change
|