Runbooks
Audience: contributor · Profile:
both· Read this when: you need to prove a piece of work actually functions against a real instance, not just in tests.
A runbook is a procedure you execute, in order, against a live instance and real cloud accounts — the step, the command, and what a pass looks like. They exist because the things they cover cannot be unit-tested: they need a real Entitle tenant, a real cloud account, or a real appliance.
Most are numbered against the phases of a design note, so the number is the order the work landed rather than a difficulty rating. They are kept after the phase ships: the procedure is also how you diagnose that phase later.
Like design/, these are off the /docs index in the app and
reachable by path.
One-time operator setup
| Page | Read this when |
|---|---|
| Cloud-DB Password Safe plugin setup | you are standing up database credential rotation and need the one-time manual setup. |
| SPIRE lab standup + the attribute probe | you are standing up the SPIFFE SVID plugin's lab on a cloud VM, and need to settle whether BeyondInsight populates plugin attributes. |
| SPIFFE federation: proving it against real clouds | you are setting up the dashboard to hold no stored cloud secret, and need to prove AWS, Azure and GCP accept its SPIFFE identity, with and without Workload Credentials. |
Cloud-identity JIT
Phases of design/cloud-identity-jit.md.
| Page | Read this when |
|---|---|
| Phase 0 — smoke test | you are verifying the cloud-identity-JIT scaffolding before wiring anything real. |
| Phase 1 — Entitle submit + poll | you are verifying that a real elevation request reaches Entitle. |
| Phase 2 — AWS EC2 deploy + terminate | you are verifying the first cloud SDK writes wrapped in an elevation. |
| Phase 4a — AWS sweeper | you are verifying the AWS reconciliation sweeper. |
| Phase 4b — Azure sweeper | you are verifying the Azure reconciliation sweeper. |
| Phase 4c — GCP sweeper | you are verifying the GCP reconciliation sweeper. |
Entitle user JIT
Phases of design/entitle-user-jit.md, the legacy Entra-group path.
| Page | Read this when |
|---|---|
| Phase 0 — resolver verification | you are verifying how the legacy Entra-group resolver behaves. |
| Phase 1 — bootstrap Entra groups | you are creating the Entra groups the legacy user-JIT path needs. |
| Phase 2 — bootstrap Entitle applications | you are provisioning the Entitle virtual applications that back those groups. |
Other end-to-end checks
| Page | Read this when |
|---|---|
| First Cloud Functions deploy | you are bringing Cloud Functions up end to end for the first time. |
| Entitle resource registration (E2E) | you want to confirm built resources really do register as Entitle integrations. |