coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix: contain attended OpenBao login output

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
This commit is contained in:
tegwick 2026-08-23 01:31:05 +02:00
parent 461f580813
commit 0fae0904ce
9 changed files with 497 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

30
wiki/playbooks/openbao-platform-admin-login.md
View file

@ -18,27 +18,35 @@ workload KV-read lane and it does not provision a secret value.
`openbao-api-key`, a workload role, paste-once provisioning, or root, stop and
report a routing defect.
2. The operator performs the one identity act through KeyCape OIDC/MFA:
2. The operator performs the identity act and the separately reviewed owner
command through one contained envelope:
```bash
bao login -no-print -method=oidc -path=netkingdom role=platform-admin
warden access openbao-platform-admin-login --exec -- <reviewed-owner-command>
```
`-no-print` is mandatory. Do not paste a token into chat, State Hub, a shell
argument, or a temporary handoff file. Root is offline break-glass authority,
not a fallback for an OIDC or callback failure.
Warden refuses a login-only `--fetch`. Before OIDC it proves the caller's
default home is usable, creates a caller-owned `0700` isolated home and a
`0600` token helper, and then runs `bao login -no-print` with both stdout and
stderr captured. The reviewed command runs in the same contained home with
both streams captured; it must persist any permitted metadata evidence itself
and remain silent. Warden self-revokes the session and removes the helper on
every success or failure path.
Safety does not rely on `-no-print`. Any client or child output, helper
persistence defect, non-zero exit, or revocation/cleanup defect fails closed.
Captured bytes are never returned, logged, excerpted, hashed, or fingerprinted.
Do not paste a token into chat, State Hub, a shell argument, or a handoff file.
Root is offline break-glass authority, not a fallback for failure.
3. Verify authority using metadata or capabilities only, never by reading a
secret value. Then run only the separately reviewed owner procedure. For the
database engine this procedure lives in `rapp-postgres`; the login does not
itself approve configuration changes.
4. Revoke the attended token when the reviewed operation and its non-secret
verification are complete:
```bash
bao token revoke -self
```
4. Confirm the contained command exits successfully. Warden performs and checks
`bao token revoke -self` inside the contained environment before cleanup; do
not retain or reuse the helper.
If browser login fails before authentication, confirm the `netkingdom` auth
mount, `platform-admin` role, and allowed callback with `railiance-platform` and