tegwick
e830238746
All checks were successful
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
207 lines
6.7 KiB
YAML
207 lines
6.7 KiB
YAML
# NK-WP-0056-T01 example: the bind split (NK-WP-0054) as admissions. Illustrative: the executor
|
|
# (T03) and its operations do not exist yet; files are pinned at the commit named in plan.source.
|
|
apiVersion: netkingdom.io/bounded-execution-admission/v0.1
|
|
kind: BoundedExecutionAdmission
|
|
spec:
|
|
id: BEA-2026-0001
|
|
title: Rotate the svc-authelia directory bind (bind-split steps 5-8, one consumer)
|
|
purpose: 'Pilot shape for NK-WP-0056-T06: generate a new bind password into OpenBao, set it in LLDAP, let ESO deliver it,
|
|
restart Authelia, prove sign-in with the synthetic journey; revert on any failed check.'
|
|
work_ref: NK-WP-0056-T01 example
|
|
risk_class: medium
|
|
window:
|
|
not_before: '2026-11-03T09:00:00Z'
|
|
not_after: '2026-11-03T11:00:00Z'
|
|
approval:
|
|
approvers:
|
|
- admin
|
|
principal_type: HUMAN
|
|
assurance: aal2
|
|
carriers:
|
|
- approval-engine
|
|
- founder-ssh-signature
|
|
executor:
|
|
identity: service:nk-bind-executor
|
|
principal_type: WORKLOAD
|
|
runtime: k8s sso/serviceaccount nk-bind-executor (planned, NK-WP-0056-T03)
|
|
scope_ceiling:
|
|
- mode: OPERATE
|
|
scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
|
|
environments: &id001
|
|
- PRODUCTION
|
|
- mode: OPERATE
|
|
scope: lldap/people/svc-authelia
|
|
environments: *id001
|
|
- mode: OPERATE
|
|
scope: k8s/sso/externalsecret/authelia-secrets
|
|
environments: *id001
|
|
- mode: OPERATE
|
|
scope: k8s/sso/deployment/authelia
|
|
environments: *id001
|
|
blast_radius:
|
|
unit: consumer
|
|
consumers:
|
|
- authelia
|
|
max_concurrent: 1
|
|
trust_requires:
|
|
- runtime_secret_trust
|
|
- runtime_identity_trust
|
|
plan:
|
|
source:
|
|
repo: net-kingdom
|
|
commit: 15c9cdbef881
|
|
files:
|
|
- path: bounded-executor/executor.py
|
|
sha256: d724f4f831640c92b8b542dd2adab2e77f40d87d88f46d9482bff9fdcc4f6c70
|
|
- path: bounded-executor/operations.py
|
|
sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
|
|
- path: sso-mfa/k8s/synthetic-journey/journey.py
|
|
sha256: c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c
|
|
steps:
|
|
- id: generate
|
|
operation: openbao.kv.write-next-version
|
|
target: openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
|
|
checks_after:
|
|
- kv-advanced
|
|
revert: restore-kv
|
|
- id: set-directory
|
|
operation: lldap.user.change-own-password-from-kv
|
|
target: lldap:svc-authelia
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: lldap/people/svc-authelia
|
|
checks_after:
|
|
- bind-signs-in
|
|
revert: restore-directory
|
|
- id: deliver
|
|
operation: eso.force-sync
|
|
target: k8s:sso/externalsecret/authelia-secrets
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: k8s/sso/externalsecret/authelia-secrets
|
|
checks_after:
|
|
- eso-synced
|
|
revert: redeliver
|
|
- id: restart
|
|
operation: k8s.rollout-restart
|
|
target: k8s:sso/deployment/authelia
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: k8s/sso/deployment/authelia
|
|
checks_after:
|
|
- synthetic-journey
|
|
revert: restart-again
|
|
revert_steps:
|
|
- id: restore-kv
|
|
operation: openbao.kv.write-previous-value-as-next-version
|
|
target: openbao:platform/workloads/net-kingdom/directory-binds/svc-authelia
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: openbao/platform/workloads/net-kingdom/directory-binds/svc-authelia
|
|
checks_after:
|
|
- kv-advanced
|
|
- id: restore-directory
|
|
operation: lldap.user.change-own-password-from-kv
|
|
target: lldap:svc-authelia
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: lldap/people/svc-authelia
|
|
checks_after:
|
|
- bind-signs-in
|
|
- id: redeliver
|
|
operation: eso.force-sync
|
|
target: k8s:sso/externalsecret/authelia-secrets
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: k8s/sso/externalsecret/authelia-secrets
|
|
checks_after:
|
|
- eso-synced
|
|
- id: restart-again
|
|
operation: k8s.rollout-restart
|
|
target: k8s:sso/deployment/authelia
|
|
consumer: authelia
|
|
class: delegable
|
|
mutates: true
|
|
requires:
|
|
mode: OPERATE
|
|
scope: k8s/sso/deployment/authelia
|
|
checks_after:
|
|
- synthetic-journey
|
|
plan_digest: sha256:df214e02c24e70c6ac799bee873862f0d24d9bd537bf77cfb845a7b880c7565b
|
|
checks:
|
|
- id: kv-advanced
|
|
description: KV svc-authelia has exactly one new version, CAS on the previous one
|
|
ref: bounded-executor/operations.py
|
|
sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
|
|
timeout_seconds: 30
|
|
expect: pass
|
|
- id: bind-signs-in
|
|
description: the new KV value signs in to LLDAP as svc-authelia
|
|
ref: bounded-executor/operations.py
|
|
sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
|
|
timeout_seconds: 30
|
|
expect: pass
|
|
- id: eso-synced
|
|
description: the ExternalSecret is Ready with a refresh after the step started; the executor never reads the Secret
|
|
ref: bounded-executor/operations.py
|
|
sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
|
|
timeout_seconds: 120
|
|
expect: pass
|
|
- id: synthetic-journey
|
|
description: syn-journey signs in through KeyCape, Authelia and privacyIDEA at aal2
|
|
ref: bounded-executor/operations.py
|
|
sha256: 10d0ba1a2a45edf6d5b137b0702468fb570703347eff81b7f52073dc44b92041
|
|
timeout_seconds: 90
|
|
expect: pass
|
|
stop_and_revert:
|
|
on_check_failure: revert
|
|
on_budget_exhausted: revert
|
|
on_unknown: stop
|
|
on_revert_failure: stop-and-alert
|
|
alert: founder via State Hub message and audit-core
|
|
budget:
|
|
wall_time_seconds: 1200
|
|
attempts: 2
|
|
cost:
|
|
compute_cpu_seconds: 120
|
|
egress_bytes: 5000000
|
|
currency: EUR
|
|
amount: 0.05
|
|
consumption:
|
|
single_use: true
|
|
consume_before_first_step: true
|
|
receipt:
|
|
schema: netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt
|
|
emit_to: audit-core
|
|
retain: by-hash-no-secret-values
|
|
independent_verifier: tools/bounded-execution-admission/validate.py check-approval + receipt source hashes
|
|
not_authorized:
|
|
- any bind other than svc-authelia
|
|
- any LLDAP group change
|
|
- changing LLDAP's configured super-admin
|
|
- reading or changing any human account
|
|
- any change outside the sso namespace
|