CCR-2026-0053 (proposed): NetKingdom svc-authelia directory bind custody and ESO delivery

Second NK-WP-0056-T04 lane after the svc-provisioner pilot (CCR-2026-0052): read-only
reader for platform/workloads/net-kingdom/directory-binds/svc-authelia, ESO Merge of
ldap_password only into sso/authelia-secrets. Binding unconfirmed; apply stays blocked
until owner approval and confirm-binding.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2

credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml

@@ -0,0 +1,116 @@
+id: CCR-2026-0053
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: NetKingdom Authelia directory bind (svc-authelia) delivery
+status: proposed
+created: '2026-10-31'
+updated: '2026-10-31'
+requester:
+  agent: claude-code
+  reason: 'NK-WP-0056-T04, second lane after the svc-provisioner pilot (CCR-2026-0052):
+    move the svc-authelia LLDAP bind out of the founder''s personal SOPS custody into
+    platform custody, so its rotation needs neither a decrypted custody copy nor a person
+    handling the value.'
+review:
+  required: true
+  required_approvers:
+  - platform-owner
+  - net-kingdom-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: platform
+  workload: net-kingdom-authelia
+  environment: production
+  purpose: Hold the svc-authelia LLDAP bind password in platform custody and project
+    only that value into the key ldap_password of the existing Secret sso/authelia-secrets;
+    no session, storage or OIDC key, no ld-admin, admin or other service bind
+openbao:
+  mount: platform
+  kv_path: platform/workloads/net-kingdom/directory-binds/svc-authelia
+  fields:
+  - LDAP_BIND_PASSWORD
+  policy_name: net-kingdom-svc-authelia-bind-eso
+  policy_file: openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl
+  metadata_read: false
+  token_self_lifecycle: true
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: net-kingdom-svc-authelia-bind-eso
+    audience: openbao
+    ttl: 15m
+    token_max_ttl: 15m
+    token_explicit_max_ttl: 15m
+    token_no_default_policy: true
+    policies:
+    - net-kingdom-svc-authelia-bind-eso
+    bound_claims:
+      service_account_names:
+      - net-kingdom-svc-authelia-bind-eso
+      service_account_namespaces:
+      - sso
+    bound_claims_confirmed: false
+access_frontdoor:
+  type: platform-owner
+  catalog_id: net-kingdom-svc-authelia-bind
+  readiness: pending-review
+  resolvable: false
+lifecycle:
+  deactivate: Delete the ExternalSecret (deletionPolicy Retain keeps the working Secret),
+    then withdraw the role and policy; the KV entry stays as custody until the founder's
+    copy is confirmed current.
+  rotate: Change the svc-authelia password in LLDAP and write the new value as the next
+    KV version with CAS on the current version; ESO projects it and Authelia is restarted,
+    because it reads ldap_password only at start-up. Until NK-WP-0056 executors exist
+    this is founder-run.
+  compromised: Reset svc-authelia in LLDAP first (read-only bind, lldap_strict_readonly),
+    then rotate as above; fence the reader role if its boundary is in doubt.
+delivery:
+  surface: ESO-managed Secret key (Merge into existing Secret)
+  namespace: sso
+  secret: authelia-secrets
+  key: ldap_password
+  service_account: net-kingdom-svc-authelia-bind-eso
+  reader: Authelia Deployment in sso (existing secret volume, file /run/secrets/authelia/ldap_password,
+    unchanged); no agent credential delivery
+  manifest: 'net-kingdom: sso-mfa/k8s/authelia/bind-eso.yaml'
+  cluster_uid: a553c742-0115-43d4-99a4-a5ca56fe0786
+risk:
+  classification: medium
+  notes:
+  - svc-authelia is a read-only directory bind (lldap_strict_readonly); a leak exposes
+    directory attributes (users, groups, emails), not write access. Authelia's users
+    filter excludes svc-* accounts from login.
+  - authelia-secrets also holds the session, storage-encryption and OIDC keys. ESO
+    Merge projects only ldap_password; the reader policy cannot reach any other path.
+  - Initial KV write is CAS=0 with the value already live in the Secret and the founder's
+    custody; no rotation happens in this request. An existing different KV value refuses.
+  - Setup also refuses unless the live authelia-config binds uid=svc-authelia, so the
+    projected value cannot belong to another account.
+  - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary
+    before the first write.
+  - Node root, ESO administration and platform-admin remain inside this credential
+    boundary.
+verification:
+  positive:
+  - Exact policy, role and bound claims read back; native reader login as the ESO
+    ServiceAccount gets only this policy with a lease of at most 15m
+  - KV value equals the live Secret ldap_password before ESO is applied (setup) and
+    after ESO sync (verify), compared in memory only
+  - ExternalSecret Ready/SecretSynced; Authelia stays Ready and a first-factor login
+    works after a restart
+  negative:
+  - Reader cannot read metadata, a sibling path, the other directory-bind paths or
+    create tokens
+  - Wrong ServiceAccount, wrong audience and wrong namespace logins are denied
+  - Coding-agent boundary denies data and metadata of the path
+  activation_conditions:
+  - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound
+    by the setup tool).
+  - Attended platform-admin (aal2) session for setup; the founder runs it, value read
+    from the decrypted custody copy without display.
+  - Policy, role and KV in place and equal to live before the ExternalSecret is applied.
+  - Positive and negative results recorded in value-free receipts.
+  evidence: []