ops-warden/wiki/playbooks/openbao-platform-admin-login.md

OpenBao platform-admin login

Worker checklist

Use this lane only for an attended OpenBao control-plane operation whose reviewed procedure requires platform-admin, such as configuring a database secrets-engine connection, policies, auth roles, or token roles. It is not a workload KV-read lane and it does not provision a secret value.

1. Plan the exact administration need before drafting any operator step:

   warden plan "attended OpenBao platform administration for <reviewed operation>" --json
   

   The result must select openbao-platform-admin-login, return founder_required, and name one oidc_login act. If it selects openbao-api-key, a workload role, paste-once provisioning, or root, stop and report a routing defect.

2. The operator performs the identity act and the separately reviewed owner command through one contained envelope:

   warden access openbao-platform-admin-login --exec -- <reviewed-owner-command>
   

   Warden refuses a login-only --fetch. Before OIDC it proves the caller's default home is usable, creates a caller-owned 0700 isolated home and a 0600 token helper, and then runs bao login -no-print with both stdout and stderr captured. The reviewed command runs in the same contained home with both streams captured; it must persist any permitted metadata evidence itself and remain silent. Warden self-revokes the session and removes the helper on every success or failure path.

   Safety does not rely on -no-print. Login output stays contained and is accepted only after successful helper persistence. Any child output (including whitespace), persistence defect, non-zero exit, or revocation/cleanup defect fails closed. Captured bytes are never returned, logged, excerpted, hashed, or fingerprinted. Do not paste a token into chat, State Hub, a shell argument, or a handoff file. Root is offline break-glass authority, not a fallback for failure.

3. Verify authority using metadata or capabilities only, never by reading a secret value. Then run only the separately reviewed owner procedure. For the database engine this procedure lives in rapp-postgres; the login does not itself approve configuration changes.

4. Confirm the contained command exits successfully. Warden performs and checks bao token revoke -self inside the contained environment before cleanup; do not retain or reuse the helper.

If browser login fails before authentication, confirm the netkingdom auth mount, platform-admin role, and allowed callback with railiance-platform and key-cape. Do not retry with a workload-specific OIDC role: it is intentionally incapable of OpenBao control-plane administration.

Exit status and audit

After argument/configuration validation, the contained envelope returns:

Exit	Audit outcome	Meaning
0	ok	Login, silent child, self-revocation and cleanup succeeded.
10	login_failed	Login or private-home preflight failed; child did not run.
11	child_failed	Child could not start or exited non-zero.
12	child_output	Child emitted stdout/stderr, even whitespace; takes precedence over child exit failure.
13	revoke_unconfirmed	Child succeeded silently, but self-revocation was not confirmed.
14	cleanup_failed	Private storage cleanup failed; overrides the prior phase.

Both access-audit.log and audit.jsonl record the Warden exit code and phase outcome, never captured bytes. Revocation warnings accompany child failures too. Codes 11–14 do not establish that the child made no changes: check its permitted metadata receipt before retrying. A zero exit from bao token revoke -self is Warden's revocation confirmation; no post-revoke lookup is used. An arbitrary lookup failure would not prove revocation.

On the WSL workstation, use the ops-bridge openbao-ui-railiance01 tunnel at http://127.0.0.1:18200 for BAO_ADDR and VAULT_ADDR, with the founder's TTY and a working browser opener (xdg-open, or the configured OpenBao browser). bao.coulomb.social serves a public notice, not OpenBao. The captured OIDC output is not a browser fallback. Check the opener before starting an attended login. The reviewed child must redirect both streams if its tools normally print success messages; it should write only approved, value-free evidence to its own receipt.

Authority

• OpenBao policy and role owner: railiance-platform/docs/openbao.md
• Human identity and MFA provider: key-cape / Keycloak
• Database-engine procedure owner: rapp-postgres
• Routing decision and founder-act surface: WARDEN-WP-0029