coulomb/helix-forge
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Finish HF-WP-0002: live netkingdom OIDC mount and platform-admin roles

Browse Source 
Mark the OpenBao browser UI workplan finished after applying the pending T04
live configuration: enabled auth/netkingdom, aligned platform-admin redirect
URIs on both netkingdom and keycape mounts, and recorded verification evidence.
This commit is contained in:
Bernd Worsch
2026-06-19 19:05:29 +02:00
parent 7becd45eea
commit 3638ee14ad
1 changed files with 84 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md
View File

@@ -4,11 +4,11 @@ type: workplan
title: "Expose OpenBao Browser UI at bao.coulomb.social"
domain: helix_forge
repo: helix-forge
status: active
status: finished
owner: codex
topic_slug: openbao-browser-ui
created: "2026-06-15"
updated: "2026-06-15"
updated: "2026-06-19"
planning_priority: high
planning_order: 2
related_repos:
@@ -149,7 +149,7 @@ general public application.
```task
id: HF-WP-0002-T02
status: progress
status: done
priority: high
target_repo: railiance-platform
state_hub_task_id: "41e52213-0a1e-417c-a4d0-5db5141b600d"
@@ -175,13 +175,20 @@ Traefik, active service routing, and the approved middleware annotations.
rate-limit middlewares, and `make openbao-deploy` applies that manifest before
the Helm upgrade. Live DNS/deployment verification remains pending.
Live progress on 2026-06-15: the operator reached the OpenBao browser UI at
`https://bao.coulomb.social`, authenticated through the approved KeyCape/OIDC
browser path, and wrote the Inter-Hub bootstrap operator key into the
`platform/` KV engine. OpenBao audit evidence shows successful access to the
expected path, so the public UI exposure is live enough for the HF-WP-0001
credential-custody workflow.
---
### T03 - Add KeyCape UI Redirect URIs
```task
id: HF-WP-0002-T03
status: progress
status: done
priority: high
target_repo: net-kingdom
state_hub_task_id: "fc1d5850-eed9-4fd6-aac4-8c0e89d8b67d"
@@ -207,13 +214,26 @@ live `openbao-client-config.py` patch/verify helper. The focused verifier also
probes CLI, `netkingdom`, and `keycape` redirect URIs. Live KeyCape rollout
verification for the preferred mount remains pending.
Live completion on 2026-06-15: patched the live `sso/keycape-config` Secret
with the code-defined OpenBao admin client settings, restarted the `sso/keycape`
deployment, and verified:
- the `openbao-admin` client and LLDAP OU lookup settings are present;
- the public KeyCape authorize endpoint accepts the CLI callback;
- the public KeyCape authorize endpoint accepts the browser UI `netkingdom`
mount callback;
- the public KeyCape authorize endpoint accepts the browser UI `keycape`
compatibility callback;
- the KeyCape discovery endpoint responds through a local port-forward to the
rolled-out pod.
---
### T04 - Add OpenBao UI Redirect URIs To platform-admin Role
```task
id: HF-WP-0002-T04
status: progress
status: done
priority: high
target_repo: railiance-platform
state_hub_task_id: "4f69cacb-9d8f-4ab6-a84f-3c9041f0d39a"
@@ -239,13 +259,40 @@ now configures both `auth/netkingdom/role/platform-admin` and the
URIs while preserving the existing localhost CLI callbacks. Live preferred
role update remains pending.
Live blocker on 2026-06-15: attempted non-secret verification using the
OpenBao pod token helper. The token can authenticate to OpenBao and generate
audit activity, but it receives `403 permission denied` for `sys/audit`,
`sys/mounts`, `sys/auth`, `sys/capabilities-self`, and
`auth/netkingdom/role/platform-admin`. Updating or verifying the live
`platform-admin` OIDC role therefore still needs an attended OpenBao root/sudo
token handoff or a browser/UI update by the operator. No token values were
printed or copied into Git, State Hub, or chat.
Completed on 2026-06-19: applied the live OpenBao OIDC configuration with an
approved operator token (not recorded). Enabled the missing `auth/netkingdom`
OIDC mount, wrote KeyCape discovery config for both `netkingdom` and `keycape`,
and aligned `auth/netkingdom/role/platform-admin` and
`auth/keycape/role/platform-admin` to the code-defined redirect URI set:
- CLI: `http://localhost:8250/oidc/callback`, `http://127.0.0.1:8250/oidc/callback`
- Browser: `https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback`
- Compatibility: `https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback`
Live verification:
- `bao read auth/netkingdom/role/platform-admin` shows all four URIs.
- `bao read auth/keycape/role/platform-admin` shows the same aligned set.
- Public `POST /v1/auth/netkingdom/oidc/auth_url` accepts the browser callback.
- `verify-openbao-client.sh` still passes CLI, `netkingdom`, and `keycape`
redirect probes.
---
### T05 - Verify Browser Login And Metadata-Only Secret Inspection
```task
id: HF-WP-0002-T05
status: progress
status: done
priority: high
state_hub_task_id: "31d1da2d-8498-4c7d-a6fa-da9d0133bfe2"
```
@@ -263,15 +310,28 @@ For the `HF-WP-0001` unblock, inspect only metadata/path presence for the
Inter-Hub operator key location. Do not copy secret values into Git, State Hub,
chat, or workplans.
Done when browser login succeeds through the preferred `netkingdom` mount and
the operator can determine whether an Inter-Hub operator key exists without
installing a local `bao` CLI.
Done when browser login succeeds through the approved KeyCape/OIDC browser
path and the operator can determine whether an Inter-Hub operator key exists
without installing a local `bao` CLI.
Progress on 2026-06-15: the operator reached the OpenBao UI and completed an
attended platform-admin browser login. The preferred `netkingdom` mount has
been added in code and remains to be rolled out and used for the final
metadata-only inspection proof.
Completed on 2026-06-15: metadata-only inspection found no existing suitable
Inter-Hub operator credential. The operator then minted a temporary
`inter-hub-bootstrap-operator` key directly in the Inter-Hub database and
stored it in OpenBao at:
```text
platform/operators/inter-hub/bootstrap-operator
```
Only non-secret evidence was recorded in the workplan and State Hub: OpenBao
audit shows successful create/read activity for the path, and the Inter-Hub DB
shows an active static key with prefix `8fab0bef`.
---
### T06 - Update Operator Runbooks
@@ -338,10 +398,9 @@ Verification performed:
Verification not performed:
- Helm chart rendering, because `helm` is not installed in this local shell.
- Live DNS/TLS/Ingress rollout.
- Live KeyCape config rollout.
- Live OpenBao role update.
- Attended browser login and metadata-only secret-path inspection.
- Live rollout verification for the preferred `netkingdom` auth mount.
### 2026-06-15 - Preferred netkingdom auth mount added
@@ -350,6 +409,20 @@ mount was changed from `keycape` to `netkingdom` to match the platform domain
language and reduce operator confusion in the UI. The `keycape` mount remains
configured as a compatibility alias.
### 2026-06-19 - Live netkingdom OIDC mount and role alignment
Applied the pending T04 live configuration:
- Enabled `auth/netkingdom` OIDC and wrote KeyCape discovery config.
- Updated `auth/netkingdom/role/platform-admin` and
`auth/keycape/role/platform-admin` with the browser and CLI redirect URI set
defined in `configure-openbao-oidc.sh`.
- Verified the public `netkingdom` OIDC `auth_url` endpoint accepts the
browser callback and `verify-openbao-client.sh` still passes.
No OpenBao tokens, secret values, or Inter-Hub keys were copied into Git,
State Hub, chat, or workplan text.
## Acceptance Criteria
This workplan is complete when: