Complete procedures with a way back.

Enroll a production Linux host into FreeIPA 4.12.4 through verified DNS, time, and TLS trust; replace permissive access with tested HBAC and exact sudo rules; bound SSSD offline credentials; and operate break-glass, deprovisioning, failover, LDAP exceptions, and rollback safely.

Compare protected refresh-only and normal plans, classify authority and impact, contain incidents, accept reality in HCL or restore intent through a saved plan, and verify full convergence without automatic apply.

Derive exact Kubernetes API permissions from observed calls, create a dedicated ServiceAccount with no ambient token, bind a narrow namespaced Role, mount a short-lived audience-bound token only where needed, and prove both allowed and denied behavior.