coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T04: founder-run helper to disable the OpenBao auth/keycape alias
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 1m17s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Silent, attended (openbao-attended-exec), read-only unless --apply; refuses
a session not from auth/netkingdom, writes a 0600 non-secret receipt.
Bootstrap console now points at -path=netkingdom. 5 helper tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 149903@bnt-lap001
Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6
This commit is contained in:
tegwick 2026-11-07 14:50:59 +01:00
parent 4a684baabf
commit 186a92c676
5 changed files with 235 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tools/security-bootstrap-console/security_bootstrap_console.py
View file

@ -2411,7 +2411,7 @@ def admin_identity_payloads(data: dict[str, Any]) -> list[dict[str, str]]:
"subsystem": "Railiance OpenBao",
"responsibility": "openbao-ceremony-operator",
"email": role_email(data, "role_openbao_operator_email"),
"location": "auth/keycape or equivalent OpenBao OIDC/JWT mount",
"location": "auth/netkingdom (railiance-platform openbao/auth/netkingdom-*); the auth/keycape alias is retired (NK-WP-0054-T04)",
"state": state_value(yes(data, "openbao_oidc_auth_configured"), yes(data, "openbao_oidc_client_registered")),
},
downstream_taint,
@ -2423,7 +2423,7 @@ def admin_identity_payloads(data: dict[str, Any]) -> list[dict[str, str]]:
"subsystem": "KeyCape -> OpenBao",
"responsibility": "platform-root-custodian",
"email": role_email(data, "role_platform_custodian_email"),
"location": "bao login -method=oidc -path=keycape role=platform-admin",
"location": "bao login -method=oidc -path=netkingdom role=platform-admin",
"state": state_value(yes(data, "openbao_oidc_admin_login_verified"), yes(data, "openbao_oidc_auth_configured")),
},
downstream_taint,
@ -2527,7 +2527,7 @@ def admin_identity_command_payloads(data: dict[str, Any]) -> list[dict[str, str]
"# Terminal 1: start the pod-bundled bao CLI and wait until it prints the login URL.\n"
f"{kubectl_bin} exec -it -n openbao openbao-0 -- sh -lc '\n"
" export BAO_ADDR=http://127.0.0.1:8200\n"
" bao login -method=oidc -path=keycape role=platform-admin \\\n"
" bao login -method=oidc -path=netkingdom role=platform-admin \\\n"
" skip_browser=true listenaddress=0.0.0.0 callbackhost=127.0.0.1 port=8250\n"
" bao token lookup\n"
"'\n\n"
@ -2549,7 +2549,7 @@ def admin_identity_command_payloads(data: dict[str, Any]) -> list[dict[str, str]
),
action(
"Configure OpenBao OIDC auth",
"Create or update the auth/keycape mount and platform-admin role so KeyCape group claims map to OpenBao platform-admin policy. The helper uses a non-secret compatibility client-secret value because OpenBao requires the field while the current KeyCape client is public PKCE.",
"The auth/netkingdom mount and its platform-admin role (net-kingdom-admins, aal2) are railiance-platform-owned; prepare the change there and run it as a governed admin operation. The legacy helper is retired, and the auth/keycape alias mount is retired (NK-WP-0054-T04) because it granted platform-admin without aal2.",
auth_state,
auth_reason,
configure_command,
@ -4165,7 +4165,7 @@ def ui_html() -> str:
<ul class="spec-list" style="margin-top: 14px;">
<li>Development/config: <code>openbao-admin</code> is defined in <code>sso-mfa/k8s/keycape/create-secrets.sh</code>; no manual KeyCape registration is expected.</li>
<li>Operator deployment: apply the updated KeyCape config to live <code>keycape-config</code> and restart KeyCape if the live client is missing.</li>
<li>Protected OpenBao step: configure <code>auth/keycape</code> with a hidden root/sudo token prompt, then verify <code>platform-root</code> can complete MFA-backed login.</li>
<li>Protected OpenBao step: railiance-platform configures <code>auth/netkingdom</code> (aal2-bound <code>platform-admin</code> role), then verify <code>platform-root</code> can complete MFA-backed login.</li>
</ul>
<div id="admin-identity-command-list" class="command-list"></div>
<div class="choice-list">