railiance-platform/credential-change-requests/CCR-2026-0053-net-kingdom-authelia-bind.yaml

id: CCR-2026-0053
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: NetKingdom Authelia directory bind (svc-authelia) delivery
status: verified
created: '2026-10-31'
updated: '2026-10-31'
requester:
  agent: claude-code
  reason: 'NK-WP-0056-T04, second lane after the svc-provisioner pilot (CCR-2026-0052):
    move the svc-authelia LLDAP bind out of the founder''s personal SOPS custody into
    platform custody, so its rotation needs neither a decrypted custody copy nor a
    person handling the value.'
review:
  required: true
  required_approvers:
  - platform-owner
  - net-kingdom-owner
  comments:
  - at: '2026-10-31T09:03:46+00:00'
    reviewer: platform-owner
    decision: approved
    comment: 'Approved as proposed: read-only svc-authelia lane, CAS=0 from live value,
      ESO Merge of ldap_password only.'
  - at: '2026-10-31T09:03:53+00:00'
    reviewer: net-kingdom-owner
    decision: approved
    comment: Approved as proposed for NK-WP-0056-T04.
  - at: '2026-10-31T09:04:03+00:00'
    reviewer: platform-owner
    decision: binding_confirmed
    comment: 'Binding confirmed: ServiceAccount net-kingdom-svc-authelia-bind-eso
      in namespace sso only, audience openbao, as declared in net-kingdom sso-mfa/k8s/authelia/bind-eso.yaml.'
target:
  domain: infotech
  tenant: platform
  workload: net-kingdom-authelia
  environment: production
  purpose: Hold the svc-authelia LLDAP bind password in platform custody and project
    only that value into the key ldap_password of the existing Secret sso/authelia-secrets;
    no session, storage or OIDC key, no ld-admin, admin or other service bind
openbao:
  mount: platform
  kv_path: platform/workloads/net-kingdom/directory-binds/svc-authelia
  fields:
  - LDAP_BIND_PASSWORD
  policy_name: net-kingdom-svc-authelia-bind-eso
  policy_file: openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl
  metadata_read: false
  token_self_lifecycle: true
  auth:
    method: kubernetes
    mount: kubernetes
    role: net-kingdom-svc-authelia-bind-eso
    audience: openbao
    ttl: 15m
    token_max_ttl: 15m
    token_explicit_max_ttl: 15m
    token_no_default_policy: true
    policies:
    - net-kingdom-svc-authelia-bind-eso
    bound_claims:
      service_account_names:
      - net-kingdom-svc-authelia-bind-eso
      service_account_namespaces:
      - sso
    bound_claims_confirmed: true
access_frontdoor:
  type: platform-owner
  catalog_id: net-kingdom-svc-authelia-bind
  readiness: pending-review
  resolvable: false
lifecycle:
  deactivate: Delete the ExternalSecret (deletionPolicy Retain keeps the working Secret),
    then withdraw the role and policy; the KV entry stays as custody until the founder's
    copy is confirmed current.
  rotate: Change the svc-authelia password in LLDAP and write the new value as the
    next KV version with CAS on the current version; ESO projects it and Authelia
    is restarted, because it reads ldap_password only at start-up. Until NK-WP-0056
    executors exist this is founder-run.
  compromised: Reset svc-authelia in LLDAP first (read-only bind, lldap_strict_readonly),
    then rotate as above; fence the reader role if its boundary is in doubt.
delivery:
  surface: ESO-managed Secret key (Merge into existing Secret)
  namespace: sso
  secret: authelia-secrets
  key: ldap_password
  service_account: net-kingdom-svc-authelia-bind-eso
  reader: Authelia Deployment in sso (existing secret volume, file /run/secrets/authelia/ldap_password,
    unchanged); no agent credential delivery
  manifest: 'net-kingdom: sso-mfa/k8s/authelia/bind-eso.yaml'
  cluster_uid: a553c742-0115-43d4-99a4-a5ca56fe0786
risk:
  classification: medium
  notes:
  - svc-authelia is a read-only directory bind (lldap_strict_readonly); a leak exposes
    directory attributes (users, groups, emails), not write access. Authelia's users
    filter excludes svc-* accounts from login.
  - authelia-secrets also holds the session, storage-encryption and OIDC keys. ESO
    Merge projects only ldap_password; the reader policy cannot reach any other path.
  - Initial KV write is CAS=0 with the value already live in the Secret and the founder's
    custody; no rotation happens in this request. An existing different KV value refuses.
  - Setup also refuses unless the live authelia-config binds uid=svc-authelia, so
    the projected value cannot belong to another account.
  - Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary
    before the first write.
  - Node root, ESO administration and platform-admin remain inside this credential
    boundary.
verification:
  positive:
  - Exact policy, role and bound claims read back; native reader login as the ESO
    ServiceAccount gets only this policy with a lease of at most 15m
  - KV value equals the live Secret ldap_password before ESO is applied (setup) and
    after ESO sync (verify), compared in memory only
  - ExternalSecret Ready/SecretSynced; Authelia stays Ready and a first-factor login
    works after a restart
  negative:
  - Reader cannot read metadata, a sibling path, the other directory-bind paths or
    create tokens
  - Wrong ServiceAccount, wrong audience and wrong namespace logins are denied
  - Coding-agent boundary denies data and metadata of the path
  activation_conditions:
  - Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound
    by the setup tool).
  - Attended platform-admin (aal2) session for setup; the founder runs it, value read
    from the decrypted custody copy without display.
  - Policy, role and KV in place and equal to live before the ExternalSecret is applied.
  - Positive and negative results recorded in value-free receipts.
  evidence:
  - at: '2026-10-31T09:11:39+00:00'
    actor: founder (attended), claude-code guiding
    kind: verifier_custody_and_rollout
    result: passed
    details:
    - '2026-10-31: bind-lane.py setup (live authelia-config binds svc-authelia, custody
      equal to live, coding agents fenced, KV v1 CAS=0, policy+role) and verify (exact
      policy/TTL, wrong SA and audience denied, metadata/sibling/token-create denied,
      KV equals delivered ldap_password, reader revoked) passed; ExternalSecret Ready
      on first apply; Authelia restarted and admin signed in with OTP. Evidence: net-kingdom
      docs/evidence/2026-10-31-nk56-svc-authelia-bind/ (7f37e25).'