tegwick
6c7c37aa70
KeyCape takes KEYCAPE_LLDAP_BIND_PW (key-cape KEY-WP-0046). ESO creates the dedicated Secret keycape-lldap-bind. bind-lane setup reads the current bindPW from keycape-config and requires the svc-keycape bindDN; verify compares the delivered Secret, and the config value while it is present. directory-bind-rollout gains clear-password, which runs only with the service bind and the delivered env (switch restores). deployment.yaml pins image main-e2b5fa1 and adds the env. Nothing is applied. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
# NK-WP-0056-T04, railiance-platform CCR-2026-0054.
|
|
# Creates the dedicated Secret sso/keycape-lldap-bind (key password) from platform custody.
|
|
# KeyCape (image with key-cape KEY-WP-0046) reads it as KEYCAPE_LLDAP_BIND_PW; until
|
|
# bindPW is cleared from keycape-config both carry the same value, and KeyCape refuses
|
|
# to start if they differ. ESO is the only writer of this Secret (creationPolicy Owner);
|
|
# Retain leaves it in place if this ExternalSecret is removed.
|
|
# Apply only after `tools/service-binds/bind-lane.py setup svc-keycape` reports equal custody.
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: net-kingdom-svc-keycape-bind-eso
|
|
namespace: sso
|
|
automountServiceAccountToken: false
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: SecretStore
|
|
metadata:
|
|
name: net-kingdom-svc-keycape-bind
|
|
namespace: sso
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: http://openbao.openbao.svc:8200
|
|
path: platform
|
|
version: v2
|
|
auth:
|
|
kubernetes:
|
|
mountPath: kubernetes
|
|
role: net-kingdom-svc-keycape-bind-eso
|
|
serviceAccountRef:
|
|
name: net-kingdom-svc-keycape-bind-eso
|
|
audiences: [openbao]
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: keycape-lldap-bind
|
|
namespace: sso
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: SecretStore
|
|
name: net-kingdom-svc-keycape-bind
|
|
target:
|
|
# Explicit target metadata stops ESO copying this object's kubectl
|
|
# last-applied annotation onto the Secret (refused by reject-secret-last-applied).
|
|
template:
|
|
metadata: {}
|
|
name: keycape-lldap-bind
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
data:
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: workloads/net-kingdom/directory-binds/svc-keycape
|
|
property: LDAP_BIND_PASSWORD
|