tegwick
1fbb8dbdf6
Founder live go caafe4be. Config resourceVersion 71471711 -> 71655453 with only this client added; KeyCape restarted on the kept image 6f79a2af. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
90 lines
3.8 KiB
Markdown
90 lines
3.8 KiB
Markdown
---
|
|
id: NK-WP-0046
|
|
type: workplan
|
|
title: "Deployment-owned registration of the secrets-engine-openbao KeyCape client"
|
|
domain: infotech
|
|
repo: net-kingdom
|
|
status: active
|
|
flavor: implementation
|
|
owner: claude-code
|
|
topic_slug: netkingdom
|
|
created: "2026-10-06"
|
|
updated: "2026-10-06"
|
|
related: [KEY-WP-0037, RPF-WP-0035]
|
|
state_hub_workstream_id: "1de95344-8a72-5797-93e5-6c1038c03b01"
|
|
---
|
|
|
|
KeyCape KEY-WP-0037-T03 needs NetKingdom, which owns `sso/keycape` and its
|
|
config, to register the confidential service client `secrets-engine-openbao`
|
|
(subject service:secrets-engine, tenant tenant:platform, role secrets-engine,
|
|
scope openbao:login, client_credentials, 15m, secretRef
|
|
env:KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET, no resource-audience
|
|
override). Custody boundary 632a8893 is approved; this plan prepares source
|
|
only. No live change is authorized until decision
|
|
caafe4be-4f68-47b4-9567-316d47b94992 is resolved.
|
|
|
|
## Prepare the owner-specific merge, env binding and tests
|
|
|
|
```task
|
|
id: NK-WP-0046-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "b7314f5e-ad9d-5d6a-8051-10090b2bc748"
|
|
```
|
|
|
|
`sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py` (exact-match
|
|
add/noop/refuse, byte-preserving; `--operation remove` rollback; default
|
|
`inspect`, `apply` gated on the live-go decision id and the env binding),
|
|
`secrets-engine-openbao-client.proposed.patch.yaml` (one env secretKeyRef from
|
|
`keycape-secrets-engine-openbao-client`/`client-secret`) and
|
|
`test_secrets_engine_openbao_client_rollout.py` (synthetic fixtures). The
|
|
registration is asserted equal to KeyCape `config/service-clients.example.yaml`
|
|
at e22029e. No cluster, OpenBao or ESO was read or written.
|
|
|
|
## Choose the reviewed image revision and digest
|
|
|
|
```task
|
|
id: NK-WP-0046-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6062d492-dd6b-5ae6-bd86-d9aef5012cac"
|
|
```
|
|
|
|
Deployed pin in Git (`deployment.yaml`, since 019e8f2, 2026-09-28):
|
|
`forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8`,
|
|
built from KeyCape source 1164f65 per `history/2026-09-28-telemetry-admin-role.md`.
|
|
KeyCape main HEAD is e22029e. Decide whether the registration rides the
|
|
deployed image (the client needs no new issuer code) or a newer reviewed
|
|
digest; record the exact source revision and digest before the go. A newer
|
|
binary must be checked for startup refusals against the live config.
|
|
|
|
**Decided 2026-10-06 by the founder:** the registration rides the deployed
|
|
image `sha256:6f79a2af…c496b8` (KeyCape source 1164f65). No image change.
|
|
|
|
## Live registration rollout under the founder's go
|
|
|
|
```task
|
|
id: NK-WP-0046-T03
|
|
status: done
|
|
priority: high
|
|
needs_human: true
|
|
decision_id: caafe4be-4f68-47b4-9567-316d47b94992
|
|
depends_on:
|
|
- NK-WP-0046-T02
|
|
blocking_reason: "Requires the founder's separate live go (caafe4be), the platform-materialised Secret keycape-secrets-engine-openbao-client and the chosen image pin."
|
|
state_hub_task_id: "94cff4cd-a39d-51d9-b4a3-cd5d100bfea7"
|
|
```
|
|
|
|
Attended operator only: server dry-run and diff of the env patch and the
|
|
config merge, check headroom, apply the env patch, `apply` the merge with the
|
|
observed uid/resourceVersion, restart, then hand to KEY-WP-0037-T04 for native
|
|
issuance, wrong-secret/excess-scope denial and existing human-login checks.
|
|
Rollback: `--operation remove`, restart, remove the env binding. Fold the
|
|
binding into `deployment.yaml` in the same change that records the go.
|
|
|
|
**Done 2026-10-07 under live go `caafe4be`.** The env binding was patched first
|
|
(9 to 10 env names, server dry run first), then the exact-match apply ran.
|
|
`sso/keycape-config` went from resourceVersion 71471711 to 71655453 (uid 2e94519d…),
|
|
`changed: true`, `unrelated_config_bytes_preserved: true`, `values_emitted: false`.
|
|
KeyCape restarted and rolled out on image `sha256:6f79a2af…`. The binding is folded
|
|
into `deployment.yaml`. Live issuance checks are KEY-WP-0037-T04.
|