coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stop configure-openbao-oidc.sh from writing the platform-admin role
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
The role's policies, callbacks and bound claims are declared centrally by
railiance-platform (openbao/auth/netkingdom-platform-admin-role.json).
Rerunning the script would have dropped the live operator-custody policy
and re-added the retired bao.coulomb.social callbacks. The script now only
configures the OIDC mounts and fails if the declared role is missing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
This commit is contained in:
tegwick 2026-09-23 19:39:53 +02:00
parent 116643fafe
commit a356f640ac
2 changed files with 17 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

9
sso-mfa/k8s/keycape/README.md
View file

@ -169,9 +169,12 @@ KeyCape:
bash ./configure-openbao-oidc.sh
```
That script registers the browser UI callbacks on the OpenBao
`auth/netkingdom/role/platform-admin` role and the compatibility
`auth/keycape/role/platform-admin` role. Browser operators should use the
That script enables and configures the OpenBao `netkingdom` and compatibility
`keycape` OIDC mounts. It never writes the `platform-admin` role: the role's
policies, callbacks and bound claims are declared centrally by
railiance-platform at `openbao/auth/netkingdom-platform-admin-role.json`, and
the script fails if the declared role is missing. Any additional allowance
belongs in that declaration, not here. Browser operators should use the
OpenBao UI at `http://127.0.0.1:18200` through the named
`openbao-ui-railiance01` tunnel, leave namespace blank, choose OIDC, set mount
path `netkingdom`, and use role `platform-admin`; root-token browser use is