coulomb/net-kingdom
Archived
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split OpenBao admin identity tasks

Browse Source
This commit is contained in:
Bernd Worsch
2026-05-26 02:13:55 +02:00
parent 9dc7e140b8
commit f3c8d70270
5 changed files with 292 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
sso-mfa/k8s/keycape/README.md
View File

@@ -101,13 +101,27 @@ kubectl rollout restart deployment/keycape -n sso
## OIDC client registration
Downstream applications are registered in the `clients:` block in
`keycape/create-secrets.sh`. After editing:
`keycape/create-secrets.sh`. The NetKingdom bootstrap console and Railiance
OpenBao admin CLI clients are code-defined there; operators should not create
those clients manually in a separate UI. After changing the block:
```bash
./create-secrets.sh # regenerates keycape-config Secret
kubectl rollout restart deployment/keycape -n sso
```
The `openbao-admin` client is intentionally a public PKCE client for the
current local operator CLI flow. It registers the OpenBao CLI callback URIs:
```text
http://localhost:8250/oidc/callback
http://127.0.0.1:8250/oidc/callback
```
OpenBao browser UI callbacks are not registered yet because Railiance OpenBao
currently has public ingress disabled. Add exact UI callback URIs only after
the OpenBao UI exposure model is explicitly designed.
Example entry (public client, PKCE, for a SPA):
```yaml
clients: