bae2df0d31
Second NK-WP-0056-T04 lane after the svc-provisioner pilot (CCR-2026-0052): read-only reader for platform/workloads/net-kingdom/directory-binds/svc-authelia, ESO Merge of ldap_password only into sso/authelia-secrets. Binding unconfirmed; apply stays blocked until owner approval and confirm-binding. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 896183@bnt-lap001 Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
116 lines
5 KiB
YAML
116 lines
5 KiB
YAML
id: CCR-2026-0053
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: NetKingdom Authelia directory bind (svc-authelia) delivery
|
|
status: proposed
|
|
created: '2026-10-31'
|
|
updated: '2026-10-31'
|
|
requester:
|
|
agent: claude-code
|
|
reason: 'NK-WP-0056-T04, second lane after the svc-provisioner pilot (CCR-2026-0052):
|
|
move the svc-authelia LLDAP bind out of the founder''s personal SOPS custody into
|
|
platform custody, so its rotation needs neither a decrypted custody copy nor a person
|
|
handling the value.'
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-owner
|
|
- net-kingdom-owner
|
|
comments: []
|
|
target:
|
|
domain: infotech
|
|
tenant: platform
|
|
workload: net-kingdom-authelia
|
|
environment: production
|
|
purpose: Hold the svc-authelia LLDAP bind password in platform custody and project
|
|
only that value into the key ldap_password of the existing Secret sso/authelia-secrets;
|
|
no session, storage or OIDC key, no ld-admin, admin or other service bind
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/net-kingdom/directory-binds/svc-authelia
|
|
fields:
|
|
- LDAP_BIND_PASSWORD
|
|
policy_name: net-kingdom-svc-authelia-bind-eso
|
|
policy_file: openbao/policies/net-kingdom-svc-authelia-bind-eso.hcl
|
|
metadata_read: false
|
|
token_self_lifecycle: true
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: net-kingdom-svc-authelia-bind-eso
|
|
audience: openbao
|
|
ttl: 15m
|
|
token_max_ttl: 15m
|
|
token_explicit_max_ttl: 15m
|
|
token_no_default_policy: true
|
|
policies:
|
|
- net-kingdom-svc-authelia-bind-eso
|
|
bound_claims:
|
|
service_account_names:
|
|
- net-kingdom-svc-authelia-bind-eso
|
|
service_account_namespaces:
|
|
- sso
|
|
bound_claims_confirmed: false
|
|
access_frontdoor:
|
|
type: platform-owner
|
|
catalog_id: net-kingdom-svc-authelia-bind
|
|
readiness: pending-review
|
|
resolvable: false
|
|
lifecycle:
|
|
deactivate: Delete the ExternalSecret (deletionPolicy Retain keeps the working Secret),
|
|
then withdraw the role and policy; the KV entry stays as custody until the founder's
|
|
copy is confirmed current.
|
|
rotate: Change the svc-authelia password in LLDAP and write the new value as the next
|
|
KV version with CAS on the current version; ESO projects it and Authelia is restarted,
|
|
because it reads ldap_password only at start-up. Until NK-WP-0056 executors exist
|
|
this is founder-run.
|
|
compromised: Reset svc-authelia in LLDAP first (read-only bind, lldap_strict_readonly),
|
|
then rotate as above; fence the reader role if its boundary is in doubt.
|
|
delivery:
|
|
surface: ESO-managed Secret key (Merge into existing Secret)
|
|
namespace: sso
|
|
secret: authelia-secrets
|
|
key: ldap_password
|
|
service_account: net-kingdom-svc-authelia-bind-eso
|
|
reader: Authelia Deployment in sso (existing secret volume, file /run/secrets/authelia/ldap_password,
|
|
unchanged); no agent credential delivery
|
|
manifest: 'net-kingdom: sso-mfa/k8s/authelia/bind-eso.yaml'
|
|
cluster_uid: a553c742-0115-43d4-99a4-a5ca56fe0786
|
|
risk:
|
|
classification: medium
|
|
notes:
|
|
- svc-authelia is a read-only directory bind (lldap_strict_readonly); a leak exposes
|
|
directory attributes (users, groups, emails), not write access. Authelia's users
|
|
filter excludes svc-* accounts from login.
|
|
- authelia-secrets also holds the session, storage-encryption and OIDC keys. ESO
|
|
Merge projects only ldap_password; the reader policy cannot reach any other path.
|
|
- Initial KV write is CAS=0 with the value already live in the Secret and the founder's
|
|
custody; no rotation happens in this request. An existing different KV value refuses.
|
|
- Setup also refuses unless the live authelia-config binds uid=svc-authelia, so the
|
|
projected value cannot belong to another account.
|
|
- Coding agents are fenced from the data and metadata paths in agent-high-risk-boundary
|
|
before the first write.
|
|
- Node root, ESO administration and platform-admin remain inside this credential
|
|
boundary.
|
|
verification:
|
|
positive:
|
|
- Exact policy, role and bound claims read back; native reader login as the ESO
|
|
ServiceAccount gets only this policy with a lease of at most 15m
|
|
- KV value equals the live Secret ldap_password before ESO is applied (setup) and
|
|
after ESO sync (verify), compared in memory only
|
|
- ExternalSecret Ready/SecretSynced; Authelia stays Ready and a first-factor login
|
|
works after a restart
|
|
negative:
|
|
- Reader cannot read metadata, a sibling path, the other directory-bind paths or
|
|
create tokens
|
|
- Wrong ServiceAccount, wrong audience and wrong namespace logins are denied
|
|
- Coding-agent boundary denies data and metadata of the path
|
|
activation_conditions:
|
|
- Explicit platform-owner and net-kingdom-owner approval of this exact request (sha256-bound
|
|
by the setup tool).
|
|
- Attended platform-admin (aal2) session for setup; the founder runs it, value read
|
|
from the decrypted custody copy without display.
|
|
- Policy, role and KV in place and equal to live before the ExternalSecret is applied.
|
|
- Positive and negative results recorded in value-free receipts.
|
|
evidence: []
|