Patch KeyCape OpenBao client without bootstrap secrets

sso-mfa/k8s/keycape/verify-openbao-client.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Verify the live KeyCape config carries the OpenBao CLI client and KeyCape is
+# serving OIDC discovery after rollout.
+
+set -euo pipefail
+
+NAMESPACE="${KEYCAPE_NAMESPACE:-sso}"
+SECRET="${KEYCAPE_CONFIG_SECRET:-keycape-config}"
+KUBECTL="${KUBECTL:-kubectl}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+"$KUBECTL" get secret "$SECRET" -n "$NAMESPACE" -o json \
+  | python3 "$SCRIPT_DIR/openbao-client-config.py" verify
+
+KC_POD=$("$KUBECTL" get pod -n "$NAMESPACE" \
+  -l app.kubernetes.io/name=keycape \
+  --field-selector=status.phase=Running \
+  -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+
+if [[ -z "$KC_POD" ]]; then
+  echo "[FAIL] no running KeyCape pod found in namespace $NAMESPACE" >&2
+  exit 1
+fi
+
+"$KUBECTL" exec -n "$NAMESPACE" "$KC_POD" -- \
+  wget -qO- "http://localhost:8080/.well-known/openid-configuration" >/dev/null
+
+echo "[PASS] KeyCape discovery endpoint responds from pod $KC_POD"