# Security Runbook (v0.12)

## Master Key Seal/Unseal

- `orca cluster seal`: encrypts master key with OIDC-derived key;
  prints 5 Shamir shards for offline recovery.
- `orca cluster unseal`: operator authenticates via OIDC; master key
  unwrapped into memory; zeroed on shutdown.
- `orca cluster unseal --recovery`: if IdP lost, present 3 of 5 shards.

## Master Key Rotation

`orca secrets rotate-master [--dry-run]`: generates new master key,
re-encrypts all namespace secrets, re-seals. Atomic + automatic rollback.

## Incident Response

1. Revoke the compromised identity (OIDC user/group or SPIFFE SVID).
2. Rotate the master key (`orca secrets rotate-master`).
3. Review the audit log (`orca doctor audit` verifies the hash chain).
4. If the master key is compromised, all historical secrets are
   compromised (no forward secrecy).

## Sudoers Audit

`orca doctor proxmox` audits the `/etc/sudoers.d/orca` file against the
expected allowlist (pct + qm with NOEXEC; apt-get/dpkg excluded).

## nft Audit

`orca doctor nft` audits the live nftables ruleset against the emitted one.