generated from coulomb/repo-seed
feat(creds): NK-WP-0005 — agent-driven credential bootstrap
Implements all 7 tasks from NK-WP-0005:
T01: creds-state.yaml → schema_version: 2, agent_mode: true
Replaces keepass_confirmed with emergency_bundle_delivered,
adds phase tracking fields for fully automated flow.
T02: creds-bootstrap-agent.sh — single entrypoint for autonomous
bootstrap. 10 phases, idempotent re-runs via state file.
Only human touchpoint: emergency bundle confirmation gate.
T03: emergency-bundle.sh — assembles and displays emergency bundle
(age key + break-glass passwords + ops bundle location).
Writes temp file, shreds on confirmation, clears screen.
Supports --reprint for re-delivery.
T04: ~/.claude/commands/creds-init.md — /creds-init skill replaces
/creds-bootstrap. Fully autonomous execution via the agent.
T05: Makefile — creds-agent-init, creds-agent-status,
creds-emergency-reprint targets.
T06: creds-rotate.sh — --non-interactive flag for agent-driven
rotation. Auto-confirms all gates; tracks last_rotated_<key>
in creds-state.yaml. LLDAP web UI step prints warning in
non-interactive mode.
T07: canon/standards/credential-management_v0.2.md — updated
standard: KeePassXC removed from operational path, agent
bootstrap as Phase 0, emergency bundle section, prohibited
patterns updated.
Also: creds-status.sh handles both schema v1 (legacy) and v2.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -2,14 +2,19 @@
|
||||
# creds-status.sh — print a human-readable credential state table.
|
||||
#
|
||||
# Usage:
|
||||
# bash sso-mfa/bootstrap/creds-status.sh
|
||||
# bash sso-mfa/bootstrap/creds-status.sh [state-file] [--v2]
|
||||
# make creds-status
|
||||
# make creds-agent-status
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||
STATE_FILE="${1:-$SCRIPT_DIR/creds-state.yaml}"
|
||||
|
||||
# --v2 flag forces v2 display regardless of schema_version field
|
||||
FORCE_V2=false
|
||||
for arg in "$@"; do [[ "$arg" == "--v2" ]] && FORCE_V2=true; done
|
||||
|
||||
if [[ ! -f "$STATE_FILE" ]]; then
|
||||
echo "ERROR: creds-state.yaml not found: $STATE_FILE" >&2
|
||||
echo " This file is created at repo init — check your working directory." >&2
|
||||
@@ -29,37 +34,84 @@ status_icon() {
|
||||
esac
|
||||
}
|
||||
|
||||
echo "=== net-kingdom Credential State ==="
|
||||
echo ""
|
||||
SCHEMA_VER="$(top_val schema_version)"
|
||||
|
||||
generated_at="$(top_val generated_at)"
|
||||
bundle_at="$(top_val bundle_at)"
|
||||
keepass_confirmed="$(top_val keepass_confirmed)"
|
||||
if [[ "$SCHEMA_VER" == "2" || "$FORCE_V2" == "true" ]]; then
|
||||
# ── Schema v2: agent-driven model (NK-WP-0005) ────────────────────────────
|
||||
echo "=== net-kingdom Credential State (v2 — agent mode) ==="
|
||||
echo ""
|
||||
|
||||
printf " %-30s %s\n" "Generated at:" "${generated_at:-—}"
|
||||
printf " %-30s %s\n" "Bundle at:" "${bundle_at:-—}"
|
||||
printf " %-30s %s %s\n" "KeePassXC confirmed:" \
|
||||
"$(status_icon "$keepass_confirmed")" \
|
||||
"$([ "$keepass_confirmed" = "false" ] && echo "(set keepass_confirmed: true manually)" || true)"
|
||||
echo ""
|
||||
age_key="$(top_val age_key_present)"
|
||||
secrets_gen="$(top_val secrets_generated)"
|
||||
ops_bundle="$(top_val ops_bundle_created)"
|
||||
ops_loc="$(top_val ops_bundle_location)"
|
||||
emerg_delivered="$(top_val emergency_bundle_delivered)"
|
||||
emerg_at="$(top_val emergency_bundle_delivered_at)"
|
||||
bootstrap_complete="$(top_val bootstrap_complete)"
|
||||
|
||||
echo " Secrets applied:"
|
||||
for component in postgres lldap authelia privacyidea keycape; do
|
||||
val="$(nested_val "$component")"
|
||||
note=""
|
||||
[[ "$component" == "keycape" && "$val" == "false" ]] && \
|
||||
note=" (requires PI_ADMIN_TOKEN — post-T04)"
|
||||
printf " %-28s %s%s\n" "$component" "$(status_icon "$val")" "$note"
|
||||
done
|
||||
echo ""
|
||||
printf " %-32s %s\n" "age key present:" "$(status_icon "$age_key")"
|
||||
printf " %-32s %s\n" "secrets generated:" "$(status_icon "$secrets_gen")"
|
||||
printf " %-32s %s %s\n" "ops bundle created:" \
|
||||
"$(status_icon "$ops_bundle")" \
|
||||
"$([ "$ops_bundle" = "true" ] && echo "${ops_loc:-}" || true)"
|
||||
printf " %-32s %s %s\n" "emergency bundle delivered:" \
|
||||
"$(status_icon "$emerg_delivered")" \
|
||||
"$([ "$emerg_delivered" = "true" ] && echo "at ${emerg_at:-<unknown>}" || echo "(pending human confirmation)")"
|
||||
echo ""
|
||||
|
||||
enckey="$(top_val enckey_bootstrapped)"
|
||||
pi_admin="$(top_val pi_admin_created)"
|
||||
echo " Secrets applied:"
|
||||
for component in postgres lldap authelia privacyidea keycape; do
|
||||
val="$(nested_val "$component")"
|
||||
printf " %-28s %s\n" "$component" "$(status_icon "$val")"
|
||||
done
|
||||
echo ""
|
||||
|
||||
printf " %-30s %s%s\n" "enckey bootstrapped:" \
|
||||
"$(status_icon "$enckey")" \
|
||||
"$([ "$enckey" = "false" ] && echo " ← TIME-SENSITIVE once pod is live" || true)"
|
||||
printf " %-30s %s\n" "pi-admin created:" "$(status_icon "$pi_admin")"
|
||||
enckey="$(top_val enckey_bootstrapped)"
|
||||
pi_admin="$(top_val pi_admin_created)"
|
||||
|
||||
echo ""
|
||||
echo "Run 'make creds-verify' to refresh state from the live cluster."
|
||||
printf " %-32s %s\n" "enckey bootstrapped:" "$(status_icon "$enckey")"
|
||||
printf " %-32s %s\n" "pi-admin created:" "$(status_icon "$pi_admin")"
|
||||
echo ""
|
||||
|
||||
printf " %-32s %s\n" "bootstrap complete:" "$(status_icon "$bootstrap_complete")"
|
||||
echo ""
|
||||
echo "Run 'make creds-verify' to refresh secrets_applied state from the live cluster."
|
||||
echo "Run 'make creds-agent-init' to resume bootstrap if not complete."
|
||||
|
||||
else
|
||||
# ── Schema v1: human-as-operator model (NK-WP-0004, legacy) ──────────────
|
||||
echo "=== net-kingdom Credential State (v1 — human mode) ==="
|
||||
echo ""
|
||||
|
||||
generated_at="$(top_val generated_at)"
|
||||
bundle_at="$(top_val bundle_at)"
|
||||
keepass_confirmed="$(top_val keepass_confirmed)"
|
||||
|
||||
printf " %-30s %s\n" "Generated at:" "${generated_at:-—}"
|
||||
printf " %-30s %s\n" "Bundle at:" "${bundle_at:-—}"
|
||||
printf " %-30s %s %s\n" "KeePassXC confirmed:" \
|
||||
"$(status_icon "$keepass_confirmed")" \
|
||||
"$([ "$keepass_confirmed" = "false" ] && echo "(set keepass_confirmed: true manually)" || true)"
|
||||
echo ""
|
||||
|
||||
echo " Secrets applied:"
|
||||
for component in postgres lldap authelia privacyidea keycape; do
|
||||
val="$(nested_val "$component")"
|
||||
note=""
|
||||
[[ "$component" == "keycape" && "$val" == "false" ]] && \
|
||||
note=" (requires PI_ADMIN_TOKEN — post-T04)"
|
||||
printf " %-28s %s%s\n" "$component" "$(status_icon "$val")" "$note"
|
||||
done
|
||||
echo ""
|
||||
|
||||
enckey="$(top_val enckey_bootstrapped)"
|
||||
pi_admin="$(top_val pi_admin_created)"
|
||||
|
||||
printf " %-30s %s%s\n" "enckey bootstrapped:" \
|
||||
"$(status_icon "$enckey")" \
|
||||
"$([ "$enckey" = "false" ] && echo " ← TIME-SENSITIVE once pod is live" || true)"
|
||||
printf " %-30s %s\n" "pi-admin created:" "$(status_icon "$pi_admin")"
|
||||
|
||||
echo ""
|
||||
echo "Run 'make creds-verify' to refresh state from the live cluster."
|
||||
fi
|
||||
|
||||
Reference in New Issue
Block a user