coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/helm/openbao-ui-overlay
History
Exact
codex 0f0282a436
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06) 
credential-change.py generates sys/capabilities-self (update) when
openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it
for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops
calling sys/capabilities with a root token. The OpenBao login page keeps
its platform-admin button and adds an allow-listed workload role choice.
Repo only; nothing applied to OpenBao or the cluster.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
2026-10-14 23:45:00 +02:00
..
patches/2.5.4 feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access 2026-08-23 12:50:23 +02:00
callback.html fix(openbao-ui): handle OIDC callback without Ember popup flow 2026-06-19 21:18:34 +02:00
callback.js fix(openbao-ui): handle OIDC callback without Ember popup flow 2026-06-19 21:18:34 +02:00
login.css RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06) 2026-10-14 23:45:00 +02:00
login.html RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06) 2026-10-14 23:45:00 +02:00
login.js RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06) 2026-10-14 23:45:00 +02:00
nginx.conf fix(openbao-ui): handle OIDC callback without Ember popup flow 2026-06-19 21:18:34 +02:00
overlay.css Fix OpenBao login falling back to token auth 2026-06-19 21:04:31 +02:00
overlay.js fix(openbao-ui): handle OIDC callback without Ember popup flow 2026-06-19 21:18:34 +02:00
presets.json RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06) 2026-10-14 23:45:00 +02:00
README.md RPF-WP-0057: capabilities-self grant for the hub-writer caller and UI workload role choice (NK-WP-0051-T06) 2026-10-14 23:45:00 +02:00
VERSION Add KeyCape login overlay gateway for OpenBao browser UI 2026-06-19 20:28:16 +02:00

README.md

OpenBao KeyCape login overlay

Streamlines the browser login mask reached through the named openbao-ui-railiance01 operator tunnel at http://127.0.0.1:18200 to a single Sign in with KeyCape action. Namespace, auth method, mount path, and role are preset in presets.json and hidden by overlay.css / overlay.js.

The main button always uses role platform-admin. Below it, "Sign in with a workload role" offers only the roles listed in presets.json workloadRoles (no free-text role), for example reuse-surface-hub-writer-workload-kv-read (NK-WP-0051-T06). Each listed role must allow the loopback UI callback. Use a private window for a workload role so the platform-admin KeyCape session is not reused.

Mechanism (T01 decision)

OpenBao ships UI assets inside the container image. There is no supported API to customize the login form (/sys/config/ui only configures response headers).

We use an nginx UI gateway (openbao-ui-gateway) that:

  1. Proxies all traffic to openbao.openbao.svc.cluster.local:8200.
  2. Serves overlay assets from a ConfigMap at /ui/platform-overlay/.
  3. Injects overlay.css and overlay.js into HTML responses via sub_filter.

Overlay assets live entirely in this directory. Upgrading OpenBao does not require hand-editing files inside the OpenBao pod.

Track upstream openbao/openbao#2936 for native custom CSS. When available, keep presets.json and branding assets and retire nginx sub_filter injection if the upstream API covers the same behaviour.

Layout

File Purpose
VERSION OpenBao image tag this overlay targets (openbao-values.yaml)
presets.json Hidden login defaults (netkingdom, platform-admin, …) and the workloadRoles allow-list
overlay.css Hide raw OpenBao login fields
overlay.js Apply presets, branding on post-login Ember pages
login.html / login.js / login.css Standalone KeyCape login at /ui/vault/auth
callback.html / callback.js OIDC code exchange at /ui/vault/auth/*/oidc/callback
nginx.conf Gateway proxy + standalone auth page + HTML injection
patches/<version>/manifest.sha256 Upstream UI fingerprints for drift detection

Deploy

From railiance-platform:

make openbao-overlay-apply   # overlay only
make openbao-deploy          # middleware + overlay + Helm upgrade
make openbao-verify-login-overlay

Reapply after an OpenBao upgrade

  1. Bump server.image.tag in helm/openbao-values.yaml.

  2. Deploy: make openbao-deploy.

  3. Fetch live UI assets and compare hashes:

    curl -sS http://127.0.0.1:18200/ui/ -o /tmp/index.html
# locate vault-*.js path in /tmp/index.html, then:
curl -sS "http://127.0.0.1:18200/ui/assets/vault-....js" -o /tmp/vault.js
sha256sum /tmp/index.html /tmp/vault.js

  4. If hashes differ from patches/<old-version>/manifest.sha256, update overlay.css / overlay.js selectors against the new Ember templates.

  5. Write patches/<new-version>/manifest.sha256, update VERSION.

  6. Run make openbao-verify-login-overlay CHECK_UPSTREAM_DRIFT=1.

  7. Attended browser login through KeyCape MFA. The OpenBao role and KeyCape client must both allow the exact loopback callback http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback before the former public listener is retracted.

Workplan: helix-forge/workplans/HF-WP-0003-openbao-keycape-login-overlay.md