HOWTO: Configure IPAM Authority for an Operation¶

Purpose: Declare and validate the authority required by an IPAM-dependent operation.

Difficulty: Intermediate

Overview¶

An IPAM-dependent step declares the logical inventory_ipam capability. The blueprint binds that requirement to the authority selected for the target environment. Preflight resolves and evaluates the binding before the step can run, then carries a non-secret receipt into the operation record.

1. Declare the logical authority¶

Define authorities.primary_ipam at blueprint level.
Declare the inventory_ipam capability.
Keep the authority name independent of the selected binding.

2. Require authority at the operation boundary¶

Set addressing_mode: ipam on the dependent step.
Require primary_ipam with capability inventory_ipam.
Validate the blueprint before a runtime is selected.

3. Configure the binding¶

Select one of the shipped authority bindings.
Supply credentials through the runtime environment or vault path accepted by that binding.
Set live-check and freshness policy where supported.

4. Test admission and failure¶

Confirm a healthy binding admits the step.
Confirm missing configuration, capability mismatch, stale state, and unreachable authority block the step.
Inspect the authority receipt without exposing credentials.

5. Apply environment policy¶

Bind the logical authority for the intended operating lane.
Use explicit freshness and live-readiness requirements for higher-risk lanes.
Retain the resulting preflight and step records.

References¶

License: MIT-0 for code, CC-BY-4.0 for documentation unless otherwise stated.