coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire bao.coulomb.social callbacks from the KeyCape openbao-admin client
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details

Browse source 
The name was retired on 2026-09-15. Remove both public UI callbacks from
the code-defined client (openbao-client-config.py, create-secrets.sh), stop
probing them in verify-openbao-client.sh, and fail verification in
openbao-client-config.py and verify-t07.sh if either is registered again.
The CLI and operator-tunneled 127.0.0.1:18200 callbacks remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
tegwick 2026-09-23 19:41:35 +02:00
parent a356f640ac
commit 3b14469afb
6 changed files with 51 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

17
sso-mfa/k8s/keycape/README.md
View file

@ -128,22 +128,21 @@ kubectl rollout restart deployment/keycape -n sso
```
The `openbao-admin` client is intentionally a public PKCE client for the
current operator flow. It registers both the OpenBao CLI callback URIs and the
browser UI callbacks for `bao.coulomb.social`:
current operator flow. It registers the OpenBao CLI callback URIs and the
operator-tunneled browser UI callback:
```text
http://localhost:8250/oidc/callback
http://127.0.0.1:8250/oidc/callback
http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback
```
The preferred browser UI callback is paired with the named Railiance Platform
operator tunnel at `http://127.0.0.1:18200`. The public callback remains during
the bounded listener rollback window. The preferred browser auth mount is
`netkingdom`; `keycape` remains a compatibility alias. Keep the CLI callbacks
unless there is a separate decision to retire CLI login.
The browser UI callback is paired with the named Railiance Platform operator
tunnel at `http://127.0.0.1:18200`. The public `bao.coulomb.social` callbacks
were retired with that name on 2026-09-15; `openbao-client-config.py` and
`verify-t07.sh` fail if either is registered again. The preferred browser auth
mount is `netkingdom`; `keycape` remains a compatibility alias. Keep the CLI
callbacks unless there is a separate decision to retire CLI login.
To add or refresh only the OpenBao client in a live cluster, do not decrypt the
bootstrap secret bundle and do not re-run the full secret generator. Patch the