coulomb/net-kingdom
Archived
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(workplans): revise workplans post NK-WP-0005

Browse Source 
NK-WP-0005: mark all tasks done, status → done
NK-WP-0003: T01 marked done (NK-WP-0004/0005 complete); pre-conditions
  updated; done criteria reflect agent-bootstrap model (no KeePassXC)
NK-WP-0001: status → deferred; T05-T08 (Keycloak) deferred indefinitely;
  superseded_by: NK-WP-0003 added

Active work path is now NK-WP-0003 T02-T09.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-03-21 08:47:44 +00:00
parent 95656f2324
commit 0670e17b42
3 changed files with 54 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
workplans/NK-WP-0001-sso-mfa-platform.md
View File

@@ -3,22 +3,39 @@ id: NK-WP-0001
type: workplan
title: "SSO & MFA Platform — Keycloak + privacyIDEA on Kubernetes"
domain: netkingdom
status: active
status: deferred
owner: worsch
topic_slug: netkingdom
state_hub_workstream_id: 39263c4b-ef70-4053-b782-350834b7e1be
created: "2026-02-28"
updated: "2026-03-05"
updated: "2026-03-21"
superseded_by: NK-WP-0003
---
# SSO & MFA Platform — Keycloak + privacyIDEA on Kubernetes
> **Status: DEFERRED (2026-03-21)**
> The Keycloak path has been superseded by the KeyCape + Authelia + LLDAP
> stack (NK-WP-0003). Keycloak is out of scope for the current deployment.
>
> - T01 (secret bootstrap) → replaced by NK-WP-0004 + NK-WP-0005
> - T02 (K8s foundations) → done, reused by NK-WP-0003
> - T03 (PostgreSQL) → done, reused by NK-WP-0003
> - T04 (privacyIDEA) → superseded by NK-WP-0003-T04
> - T05–T08 (Keycloak) → deferred indefinitely; revisit if/when Keycloak
> is needed for enterprise federation or SAML requirements
>
> **Active work: see NK-WP-0003.**
## Summary
Deploy a hardened SSO and MFA platform on Kubernetes: Keycloak as the
~~Deploy a hardened SSO and MFA platform on Kubernetes: Keycloak as the
OIDC/SAML identity provider, privacyIDEA as the MFA/token engine,
integrated via the privacyIDEA Keycloak Provider. This is the foundational
security layer for the net-kingdom DevSecOps platform.
integrated via the privacyIDEA Keycloak Provider.~~ Deferred — see NK-WP-0003.
This workplan is retained as a reference for the Keycloak-based architecture
decisions (D1–D5) and for the T01–T03 infrastructure that was built and
remains in use.
## Context