Bernd Worsch c054241a5c feat(t09): backup, break-glass, DR drill — NK-WP-0003-T09 done ...

- Apply SQLite backup CronJobs (LLDAP, Authelia, privacyIDEA) — all verified running
- Fix authelia-backup: remove scale-down/up dance; concurrent local-path PVC mount
  works on single-node k3s, sqlite3 .backup is safe for concurrent access
- Fix privacyidea-backup: add supplementalGroups: [999] so uid=1000 can read enckey
- Add allow-backup-to-kube-api NetworkPolicy (backup pod → 10.43.0.1:443)
- Create break-glass LLDAP account (net-kingdom-admins); fix ((PASS++)) set-e trap
- SQLite restore drill: LLDAP backup valid (2 users, all tables)
- verify-t08.sh: PASS=15, FAIL=0; fix counter bug + enckey PVC path (/etc/privacyidea)
- Update DR-RUNBOOK.md Authelia restore procedure
- T09 deferred: CNPG backup (needs MinIO/S3), Prometheus (needs kube-prometheus-stack)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-25 23:56:40 +00:00

..

bootstrap

fix(creds-bootstrap): harden agent bootstrap for non-interactive execution

2026-03-21 12:11:13 +00:00

k8s

feat(t09): backup, break-glass, DR drill — NK-WP-0003-T09 done

2026-03-25 23:56:40 +00:00

WORKPLAN.md

docs(sso-mfa): record T04 blocker — wrong image reference (ImagePullBackOff)

2026-03-20 17:16:35 +00:00