tegwick
a356f640ac
The role's policies, callbacks and bound claims are declared centrally by railiance-platform (openbao/auth/netkingdom-platform-admin-role.json). Rerunning the script would have dropped the live operator-custody policy and re-added the retired bao.coulomb.social callbacks. The script now only configures the OIDC mounts and fails if the declared role is missing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
63 lines
2.5 KiB
Bash
63 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
|
# Configure Railiance OpenBao to trust KeyCape for platform-admin OIDC login.
|
|
# The OpenBao token is prompted inside the pod TTY and is never placed on the
|
|
# local command line or stored by this script.
|
|
|
|
set -euo pipefail
|
|
|
|
KUBECTL="${KUBECTL:-kubectl}"
|
|
OPENBAO_NAMESPACE="${OPENBAO_NAMESPACE:-openbao}"
|
|
OPENBAO_POD="${OPENBAO_POD:-openbao-0}"
|
|
|
|
"$KUBECTL" exec -it -n "$OPENBAO_NAMESPACE" "$OPENBAO_POD" -- sh -lc '
|
|
set -eu
|
|
|
|
restore_tty() { stty echo 2>/dev/null || true; }
|
|
trap restore_tty EXIT INT TERM
|
|
|
|
printf "OpenBao root/sudo token: " >&2
|
|
stty -echo
|
|
read -r BAO_TOKEN
|
|
stty echo
|
|
printf "\n" >&2
|
|
export BAO_TOKEN
|
|
|
|
# OpenBao requires oidc_client_secret for OIDC auth config. The current
|
|
# KeyCape openbao-admin profile is public PKCE and does not validate this
|
|
# downstream client-secret field, so this compatibility value is not a
|
|
# protected secret. Replace this with a real managed client secret when
|
|
# KeyCape supports confidential downstream clients.
|
|
OPENBAO_OIDC_MOUNTS="netkingdom keycape"
|
|
|
|
# The platform-admin role (policies, callbacks, bound claims) is owned and
|
|
# declared by railiance-platform at
|
|
# openbao/auth/netkingdom-platform-admin-role.json. This script never writes
|
|
# the role: it configures the OIDC mount and requires the declared role to
|
|
# exist. Additional allowances belong in that central declaration.
|
|
for mount in $OPENBAO_OIDC_MOUNTS; do
|
|
bao auth enable -path="$mount" oidc >/tmp/openbao-${mount}-auth-enable.out 2>/tmp/openbao-${mount}-auth-enable.err || {
|
|
if grep -q "path is already in use" /tmp/openbao-${mount}-auth-enable.err; then
|
|
printf "auth/%s already exists\n" "$mount" >&2
|
|
else
|
|
cat /tmp/openbao-${mount}-auth-enable.err >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
bao write "auth/${mount}/config" \
|
|
oidc_discovery_url="https://kc.coulomb.social" \
|
|
oidc_client_id="openbao-admin" \
|
|
oidc_client_secret="keycape-public-pkce-compatibility-value" \
|
|
default_role="platform-admin"
|
|
|
|
if ! bao read "auth/${mount}/role/platform-admin" >/dev/null 2>&1; then
|
|
printf "auth/%s/role/platform-admin is missing; apply the railiance-platform declaration (openbao/auth/netkingdom-platform-admin-role.json)\n" "$mount" >&2
|
|
exit 1
|
|
fi
|
|
bao write "sys/auth/${mount}/tune" listing_visibility=unauth
|
|
printf "configured auth/%s (role preserved) and listing_visibility=unauth\n" "$mount" >&2
|
|
done
|
|
|
|
rm -f /tmp/openbao-*-auth-enable.out /tmp/openbao-*-auth-enable.err
|
|
unset BAO_TOKEN
|
|
'
|