feat(NK-WP-0032): admit OpenBao operator loopback callback

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

sso-mfa/k8s/keycape/README.md

@@ -132,14 +132,16 @@ browser UI callbacks for `bao.coulomb.social`:
 ```text
 http://localhost:8250/oidc/callback
 http://127.0.0.1:8250/oidc/callback
+http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
 https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback
 https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback
 ```
 
-The browser UI callback is paired with the Railiance Platform OpenBao ingress
-at `https://bao.coulomb.social`. The preferred browser auth mount is
-`netkingdom`; `keycape` remains a compatibility alias. Keep the localhost
-callbacks unless there is a separate decision to retire CLI login.
+The preferred browser UI callback is paired with the named Railiance Platform
+operator tunnel at `http://127.0.0.1:18200`. The public callback remains during
+the bounded listener rollback window. The preferred browser auth mount is
+`netkingdom`; `keycape` remains a compatibility alias. Keep the CLI callbacks
+unless there is a separate decision to retire CLI login.
 
 To add or refresh only the OpenBao client in a live cluster, do not decrypt the
 bootstrap secret bundle and do not re-run the full secret generator. Patch the
@@ -168,9 +170,10 @@ bash ./configure-openbao-oidc.sh
 That script registers the browser UI callbacks on the OpenBao
 `auth/netkingdom/role/platform-admin` role and the compatibility
 `auth/keycape/role/platform-admin` role. Browser operators should use the
-OpenBao UI at `https://bao.coulomb.social`, leave namespace blank, choose
-OIDC, set mount path `netkingdom`, and use role `platform-admin`; root-token
-browser use is outside the approved operator path.
+OpenBao UI at `http://127.0.0.1:18200` through the named
+`openbao-ui-railiance01` tunnel, leave namespace blank, choose OIDC, set mount
+path `netkingdom`, and use role `platform-admin`; root-token browser use is
+outside the approved operator path.
 
 The script prompts for a root/sudo-capable OpenBao token inside the pod TTY.
 OpenBao currently requires `oidc_client_secret` for OIDC auth config, while

sso-mfa/k8s/keycape/configure-openbao-oidc.sh

@@ -41,6 +41,7 @@ OPENBAO_POD="${OPENBAO_POD:-openbao-0}"
   "allowed_redirect_uris": [
     "http://localhost:8250/oidc/callback",
     "http://127.0.0.1:8250/oidc/callback",
+    "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
     "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
     "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
   ],

sso-mfa/k8s/keycape/create-secrets.sh

@@ -126,6 +126,7 @@ clients:
     redirectUris:
       - "http://localhost:8250/oidc/callback"
       - "http://127.0.0.1:8250/oidc/callback"
+      - "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
       - "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback"
       - "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
     allowedScopes: ["openid", "profile", "email", "groups"]

sso-mfa/k8s/keycape/openbao-client-config.py

@@ -26,6 +26,7 @@ OPENBAO_CLIENT = {
     "redirectUris": [
         "http://localhost:8250/oidc/callback",
         "http://127.0.0.1:8250/oidc/callback",
+        "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
         "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
         "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
     ],

sso-mfa/k8s/keycape/test_openbao_client_config.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""Focused regression tests for the code-defined OpenBao KeyCape client."""
+
+from __future__ import annotations
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+MODULE_PATH = Path(__file__).with_name("openbao-client-config.py")
+SPEC = importlib.util.spec_from_file_location("openbao_client_config", MODULE_PATH)
+assert SPEC and SPEC.loader
+MODULE = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(MODULE)
+
+LOOPBACK_CALLBACK = "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
+
+
+class OpenBaoClientConfigTest(unittest.TestCase):
+    def test_operator_tunnel_callback_is_required(self) -> None:
+        self.assertIn(LOOPBACK_CALLBACK, MODULE.OPENBAO_CLIENT["redirectUris"])
+
+    def test_missing_operator_tunnel_callback_fails_verification(self) -> None:
+        client = dict(MODULE.OPENBAO_CLIENT)
+        client["redirectUris"] = [
+            uri for uri in MODULE.OPENBAO_CLIENT["redirectUris"] if uri != LOOPBACK_CALLBACK
+        ]
+        errors = MODULE.client_errors({"clients": [client]}, MODULE.OPENBAO_CLIENT)
+        self.assertEqual(
+            errors,
+            [f"openbao-admin.redirectUris missing: {LOOPBACK_CALLBACK}"],
+        )
+
+    def test_upsert_preserves_unrelated_clients(self) -> None:
+        config = {"clients": [{"clientId": "unrelated", "clientType": "public"}]}
+        updated = MODULE.upsert_client(config, MODULE.OPENBAO_CLIENT)
+        self.assertEqual(updated["clients"][0]["clientId"], "unrelated")
+        self.assertIn(LOOPBACK_CALLBACK, updated["clients"][1]["redirectUris"])
+
+
+if __name__ == "__main__":
+    unittest.main()

sso-mfa/k8s/keycape/verify-openbao-client.sh

@@ -48,6 +48,7 @@ probe_redirect() {
 }
 
 probe_redirect "CLI" "http://localhost:8250/oidc/callback"
+probe_redirect "operator-tunneled browser UI netkingdom mount" "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback"
 probe_redirect "browser UI netkingdom mount" "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback"
 probe_redirect "browser UI keycape compatibility mount" "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback"
 

sso-mfa/k8s/verify-t07.sh

@@ -187,6 +187,7 @@ if not target:
 required_redirects = {
     "http://localhost:8250/oidc/callback",
     "http://127.0.0.1:8250/oidc/callback",
+    "http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
     "https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
     "https://bao.coulomb.social/ui/vault/auth/keycape/oidc/callback",
 }