27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
|
# Non-secret static registration fragments for KeyCape's bounded OpenBao JWT
|
||
|
|
# consumers. Merge these entries into the deployment-owned KeyCape config.
|
||
|
|
# The named environment variables must be materialized by an approved
|
||
|
|
# out-of-repository custody path; this file never contains their values.
|
||
|
|
clients:
|
||
|
|
- clientId: "codex-railiance-platform"
|
||
|
|
displayName: "Railiance platform coding agent"
|
||
|
|
allowedScopes: ["openbao:login"]
|
||
|
|
grantTypes: ["client_credentials"]
|
||
|
|
clientType: "confidential"
|
||
|
|
secretRef: "env:KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
|
||
|
|
serviceSubject: "service:codex:railiance-platform"
|
||
|
|
tenant: "tenant:coulomb"
|
||
|
|
roles: ["coding-agent"]
|
||
|
|
tokenLifetime: "15m"
|
||
|
|
|
||
|
|
- clientId: "secrets-engine-openbao"
|
||
|
|
displayName: "secrets-engine OpenBao login"
|
||
|
|
allowedScopes: ["openbao:login"]
|
||
|
|
grantTypes: ["client_credentials"]
|
||
|
|
clientType: "confidential"
|
||
|
|
secretRef: "env:KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET"
|
||
|
|
serviceSubject: "service:secrets-engine"
|
||
|
|
tenant: "tenant:coulomb"
|
||
|
|
roles: ["secrets-engine"]
|
||
|
|
tokenLifetime: "15m"
|