id: CCR-2026-0053 kind: credential-change-request schema_version: 1 request_type: workload-kv-read title: NetKingdom Authelia directory bind (svc-authelia) delivery status: verified created: '2026-10-31' updated: '2026-10-31' requester: agent: claude-code reason: 'NK-WP-0056-T04, second lane after the svc-provisioner pilot (CCR-2026-0052): move the svc-authelia LLDAP bind out of the founder''s personal SOPS custody into platform custody, so its rotation needs neither a decrypted custody copy nor a person handling the value.' review: required: true required_approvers: - platform-owner - net-kingdom-owner comments: - at: '2026-10-31T09:03:46+00:00' reviewer: platform-owner decision: approved comment: 'Approved as proposed: read-only svc-authelia lane, CAS=0 from live value, ESO Merge of ldap_password only.' - at: '2026-10-31T09:03:53+00:00' reviewer: net-kingdom-owner decision: approved comment: Approved as proposed for NK-WP-0056-T04. - at: '2026-10-31T09:04:03+00:00' reviewer: platform-owner decision: binding_confirmed comment: 'Binding confirmed: ServiceAccount net-kingdom-svc-authelia-bind-eso in namespace sso only, audience openbao, as declared in net-kingdom sso-mfa/k8s/authelia/bind-eso.yaml.' target: domain: infotech tenant: platform workload: net-kingdom-authelia environment: production purpose: Hold the svc-authelia LLDAP bind password in platform custody and project only that value into the key ldap_password of the existing Secret sso/authelia-secrets; no session, storage or OIDC key, no ld-admin, admin or other service bind openbao: mount: platform kv_path: platform/workloads/net-kingdom/directory-binds/svc-authelia fields: - LDAP_BIND_PASSWORD policy_name: net-kingdom-svc-authelia-bind-eso policy_file: openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl metadata_read: false token_self_lifecycle: true auth: method: kubernetes mount: kubernetes role: net-kingdom-svc-authelia-bind-eso audience: openbao ttl: 15m token_max_ttl: 15m token_explicit_max_ttl: 15m token_no_default_policy: true policies: - net-kingdom-svc-authelia-bind-eso bound_claims: service_account_names: - net-kingdom-svc-authelia-bind-eso service_account_namespaces: - sso bound_claims_confirmed: true access_frontdoor: type: platform-owner catalog_id: net-kingdom-svc-authelia-bind readiness: pending-review resolvable: false lifecycle: deactivate: Delete the ExternalSecret (deletionPolicy Retain keeps the working Secret), then withdraw the role and policy; the KV entry stays as custody until the founder's copy is confirmed current. rotate: Change the svc-authelia password in LLDAP and write the new value as the next KV version with CAS on the current version; ESO projects it and Authelia is restarted, because it reads ldap_password only at start-up. Until NK-WP-0056 executors exist this is founder-run. compromised: Reset svc-authelia in LLDAP first (read-only bind, lldap_strict_readonly), then rotate as above; fence the reader role if its boundary is in doubt. delivery: surface: ESO-managed Secret key (Merge into existing Secret) namespace: sso secret: authelia-secrets key: ldap_password service_account: net-kingdom-svc-authelia-bind-eso reader: Authelia Deployment in sso (existing secret volume, file /run/secrets/authelia/ldap_password, unchanged); no agent credential delivery manifest: 'net-kingdom: sso-mfa/k8s/authelia/bind-eso.yaml' cluster_uid: a553c742-0115-43d4-99a4-a5ca56fe0786 risk: classification: medium notes: - svc-authelia is a read-only directory bind (lldap_strict_readonly); a leak exposes directory attributes (users, groups, emails), not write access. Authelia's users filter excludes svc-* accounts from login. - authelia-secrets also holds the session, storage-encryption and OIDC keys. ESO Merge projects only ldap_password; the reader policy cannot reach any other path. - Initial KV write is CAS=0 with the value already live in the Secret and the founder's custody; no rotation happens in this request. An existing different KV value refuses. - Setup also refuses unless the live authelia-config binds uid=svc-authelia, so the projected value cannot belong to another account. - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary before the first write. - Node root, ESO administration and platform-admin remain inside this credential boundary. verification: positive: - Exact policy, role and bound claims read back; native reader login as the ESO ServiceAccount gets only this policy with a lease of at most 15m - KV value equals the live Secret ldap_password before ESO is applied (setup) and after ESO sync (verify), compared in memory only - ExternalSecret Ready/SecretSynced; Authelia stays Ready and a first-factor login works after a restart negative: - Reader cannot read metadata, a sibling path, the other directory-bind paths or create tokens - Wrong ServiceAccount, wrong audience and wrong namespace logins are denied - Coding-agent boundary denies data and metadata of the path activation_conditions: - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound by the setup tool). - Attended platform-admin (aal2) session for setup; the founder runs it, value read from the decrypted custody copy without display. - Policy, role and KV in place and equal to live before the ExternalSecret is applied. - Positive and negative results recorded in value-free receipts. evidence: - at: '2026-10-31T09:11:39+00:00' actor: founder (attended), claude-code guiding kind: verifier_custody_and_rollout result: passed details: - '2026-10-31: bind-lane.py setup (live authelia-config binds svc-authelia, custody equal to live, coding agents fenced, KV v1 CAS=0, policy+role) and verify (exact policy/TTL, wrong SA and audience denied, metadata/sibling/token-create denied, KV equals delivered ldap_password, reader revoked) passed; ExternalSecret Ready on first apply; Authelia restarted and admin signed in with OTP. Evidence: net-kingdom docs/evidence/2026-10-31-nk56-svc-authelia-bind/ (7f37e25).'