net-kingdom/workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related	state_hub_workstream_id
NK-WP-0046	workplan	Deployment-owned registration of the secrets-engine-openbao KeyCape client	infotech	net-kingdom	active	implementation	claude-code	netkingdom	2026-10-06	2026-10-06	KEY-WP-0037 RPF-WP-0035	1de95344-8a72-5797-93e5-6c1038c03b01

KeyCape KEY-WP-0037-T03 needs NetKingdom, which owns sso/keycape and its config, to register the confidential service client secrets-engine-openbao (subject service:secrets-engine, tenant tenant:platform, role secrets-engine, scope openbao:login, client_credentials, 15m, secretRef env:KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET, no resource-audience override). Custody boundary 632a8893 is approved; this plan prepares source only. No live change is authorized until decision caafe4be-4f68-47b4-9567-316d47b94992 is resolved.

Prepare the owner-specific merge, env binding and tests

id: NK-WP-0046-T01
status: done
priority: high
state_hub_task_id: "b7314f5e-ad9d-5d6a-8051-10090b2bc748"

sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py (exact-match add/noop/refuse, byte-preserving; --operation remove rollback; default inspect, apply gated on the live-go decision id and the env binding), secrets-engine-openbao-client.proposed.patch.yaml (one env secretKeyRef from keycape-secrets-engine-openbao-client/client-secret) and test_secrets_engine_openbao_client_rollout.py (synthetic fixtures). The registration is asserted equal to KeyCape config/service-clients.example.yaml at e22029e. No cluster, OpenBao or ESO was read or written.

Choose the reviewed image revision and digest

id: NK-WP-0046-T02
status: done
priority: high
state_hub_task_id: "6062d492-dd6b-5ae6-bd86-d9aef5012cac"

Deployed pin in Git (deployment.yaml, since 019e8f2, 2026-09-28): forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8, built from KeyCape source 1164f65 per history/2026-09-28-telemetry-admin-role.md. KeyCape main HEAD is e22029e. Decide whether the registration rides the deployed image (the client needs no new issuer code) or a newer reviewed digest; record the exact source revision and digest before the go. A newer binary must be checked for startup refusals against the live config.

Decided 2026-10-06 by the founder: the registration rides the deployed image sha256:6f79a2af…c496b8 (KeyCape source 1164f65). No image change.

Live registration rollout under the founder's go

id: NK-WP-0046-T03
status: done
priority: high
needs_human: true
decision_id: caafe4be-4f68-47b4-9567-316d47b94992
depends_on:
  - NK-WP-0046-T02
blocking_reason: "Requires the founder's separate live go (caafe4be), the platform-materialised Secret keycape-secrets-engine-openbao-client and the chosen image pin."
state_hub_task_id: "94cff4cd-a39d-51d9-b4a3-cd5d100bfea7"

Attended operator only: server dry-run and diff of the env patch and the config merge, check headroom, apply the env patch, apply the merge with the observed uid/resourceVersion, restart, then hand to KEY-WP-0037-T04 for native issuance, wrong-secret/excess-scope denial and existing human-login checks. Rollback: --operation remove, restart, remove the env binding. Fold the binding into deployment.yaml in the same change that records the go.

Done 2026-10-07 under live go caafe4be. The env binding was patched first (9 to 10 env names, server dry run first), then the exact-match apply ran. sso/keycape-config went from resourceVersion 71471711 to 71655453 (uid 2e94519d…), changed: true, unrelated_config_bytes_preserved: true, values_emitted: false. KeyCape restarted and rolled out on image sha256:6f79a2af…. The binding is folded into deployment.yaml. Live issuance checks are KEY-WP-0037-T04.