From bae2df0d318bd60fab1d4f4c444aa8c94fc101a0 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 31 Oct 2026 09:19:09 +0100 Subject: [PATCH] CCR-2026-0053 (proposed): NetKingdom svc-authelia directory bind custody and ESO delivery Second NK-WP-0056-T04 lane after the svc-provisioner pilot (CCR-2026-0052): read-only reader for platform/workloads/net-kingdom/directory-binds/svc-authelia, ESO Merge of ldap_password only into sso/authelia-secrets. Binding unconfirmed; apply stays blocked until owner approval and confirm-binding. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2 --- ...R-2026-0053-net-kingdom-authelia-bind.yaml | 116 ++++++++++++++++++ .../net-kingdom-svc-authelia-bind-eso.hcl | 3 + 2 files changed, 119 insertions(+) create mode 100644 credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml create mode 100644 openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl diff --git a/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml b/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml new file mode 100644 index 0000000..477d551 --- /dev/null +++ b/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml @@ -0,0 +1,116 @@ +id: CCR-2026-0053 +kind: credential-change-request +schema_version: 1 +request_type: workload-kv-read +title: NetKingdom Authelia directory bind (svc-authelia) delivery +status: proposed +created: '2026-10-31' +updated: '2026-10-31' +requester: + agent: claude-code + reason: 'NK-WP-0056-T04, second lane after the svc-provisioner pilot (CCR-2026-0052): + move the svc-authelia LLDAP bind out of the founder''s personal SOPS custody into + platform custody, so its rotation needs neither a decrypted custody copy nor a person + handling the value.' +review: + required: true + required_approvers: + - platform-owner + - net-kingdom-owner + comments: [] +target: + domain: infotech + tenant: platform + workload: net-kingdom-authelia + environment: production + purpose: Hold the svc-authelia LLDAP bind password in platform custody and project + only that value into the key ldap_password of the existing Secret sso/authelia-secrets; + no session, storage or OIDC key, no ld-admin, admin or other service bind +openbao: + mount: platform + kv_path: platform/workloads/net-kingdom/directory-binds/svc-authelia + fields: + - LDAP_BIND_PASSWORD + policy_name: net-kingdom-svc-authelia-bind-eso + policy_file: openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl + metadata_read: false + token_self_lifecycle: true + auth: + method: kubernetes + mount: kubernetes + role: net-kingdom-svc-authelia-bind-eso + audience: openbao + ttl: 15m + token_max_ttl: 15m + token_explicit_max_ttl: 15m + token_no_default_policy: true + policies: + - net-kingdom-svc-authelia-bind-eso + bound_claims: + service_account_names: + - net-kingdom-svc-authelia-bind-eso + service_account_namespaces: + - sso + bound_claims_confirmed: false +access_frontdoor: + type: platform-owner + catalog_id: net-kingdom-svc-authelia-bind + readiness: pending-review + resolvable: false +lifecycle: + deactivate: Delete the ExternalSecret (deletionPolicy Retain keeps the working Secret), + then withdraw the role and policy; the KV entry stays as custody until the founder's + copy is confirmed current. + rotate: Change the svc-authelia password in LLDAP and write the new value as the next + KV version with CAS on the current version; ESO projects it and Authelia is restarted, + because it reads ldap_password only at start-up. Until NK-WP-0056 executors exist + this is founder-run. + compromised: Reset svc-authelia in LLDAP first (read-only bind, lldap_strict_readonly), + then rotate as above; fence the reader role if its boundary is in doubt. +delivery: + surface: ESO-managed Secret key (Merge into existing Secret) + namespace: sso + secret: authelia-secrets + key: ldap_password + service_account: net-kingdom-svc-authelia-bind-eso + reader: Authelia Deployment in sso (existing secret volume, file /run/secrets/authelia/ldap_password, + unchanged); no agent credential delivery + manifest: 'net-kingdom: sso-mfa/k8s/authelia/bind-eso.yaml' + cluster_uid: a553c742-0115-43d4-99a4-a5ca56fe0786 +risk: + classification: medium + notes: + - svc-authelia is a read-only directory bind (lldap_strict_readonly); a leak exposes + directory attributes (users, groups, emails), not write access. Authelia's users + filter excludes svc-* accounts from login. + - authelia-secrets also holds the session, storage-encryption and OIDC keys. ESO + Merge projects only ldap_password; the reader policy cannot reach any other path. + - Initial KV write is CAS=0 with the value already live in the Secret and the founder's + custody; no rotation happens in this request. An existing different KV value refuses. + - Setup also refuses unless the live authelia-config binds uid=svc-authelia, so the + projected value cannot belong to another account. + - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary + before the first write. + - Node root, ESO administration and platform-admin remain inside this credential + boundary. +verification: + positive: + - Exact policy, role and bound claims read back; native reader login as the ESO + ServiceAccount gets only this policy with a lease of at most 15m + - KV value equals the live Secret ldap_password before ESO is applied (setup) and + after ESO sync (verify), compared in memory only + - ExternalSecret Ready/SecretSynced; Authelia stays Ready and a first-factor login + works after a restart + negative: + - Reader cannot read metadata, a sibling path, the other directory-bind paths or + create tokens + - Wrong ServiceAccount, wrong audience and wrong namespace logins are denied + - Coding-agent boundary denies data and metadata of the path + activation_conditions: + - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound + by the setup tool). + - Attended platform-admin (aal2) session for setup; the founder runs it, value read + from the decrypted custody copy without display. + - Policy, role and KV in place and equal to live before the ExternalSecret is applied. + - Positive and negative results recorded in value-free receipts. + evidence: [] diff --git a/openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl b/openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl new file mode 100644 index 0000000..538a860 --- /dev/null +++ b/openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl @@ -0,0 +1,3 @@ +path "platform/data/workloads/net-kingdom/directory-binds/svc-authelia" { capabilities = ["read"] } +path "auth/token/lookup-self" { capabilities = ["read"] } +path "auth/token/revoke-self" { capabilities = ["update"] }