0f0282a436
credential-change.py generates sys/capabilities-self (update) when openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops calling sys/capabilities with a root token. The OpenBao login page keeps its platform-admin button and adds an allow-listed workload role choice. Repo only; nothing applied to OpenBao or the cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
80 lines
3.5 KiB
Markdown
80 lines
3.5 KiB
Markdown
# OpenBao KeyCape login overlay
|
|
|
|
Streamlines the browser login mask reached through the named
|
|
`openbao-ui-railiance01` operator tunnel at `http://127.0.0.1:18200` to a
|
|
single **Sign in with KeyCape** action. Namespace, auth method, mount path, and
|
|
role are preset in `presets.json` and hidden by `overlay.css` / `overlay.js`.
|
|
|
|
The main button always uses role `platform-admin`. Below it, "Sign in with a
|
|
workload role" offers only the roles listed in `presets.json` `workloadRoles`
|
|
(no free-text role), for example `reuse-surface-hub-writer-workload-kv-read`
|
|
(NK-WP-0051-T06). Each listed role must allow the loopback UI callback. Use a
|
|
private window for a workload role so the platform-admin KeyCape session is
|
|
not reused.
|
|
|
|
## Mechanism (T01 decision)
|
|
|
|
OpenBao ships UI assets inside the container image. There is no supported API
|
|
to customize the login form ([`/sys/config/ui`](https://openbao.org/api-docs/system/config-ui/)
|
|
only configures response headers).
|
|
|
|
We use an **nginx UI gateway** (`openbao-ui-gateway`) that:
|
|
|
|
1. Proxies all traffic to `openbao.openbao.svc.cluster.local:8200`.
|
|
2. Serves overlay assets from a ConfigMap at `/ui/platform-overlay/`.
|
|
3. Injects `overlay.css` and `overlay.js` into HTML responses via `sub_filter`.
|
|
|
|
Overlay assets live entirely in this directory. Upgrading OpenBao does not
|
|
require hand-editing files inside the OpenBao pod.
|
|
|
|
Track upstream [openbao/openbao#2936](https://github.com/openbao/openbao/issues/2936)
|
|
for native custom CSS. When available, keep `presets.json` and branding assets
|
|
and retire nginx `sub_filter` injection if the upstream API covers the same
|
|
behaviour.
|
|
|
|
## Layout
|
|
|
|
| File | Purpose |
|
|
| --- | --- |
|
|
| `VERSION` | OpenBao image tag this overlay targets (`openbao-values.yaml`) |
|
|
| `presets.json` | Hidden login defaults (`netkingdom`, `platform-admin`, …) and the `workloadRoles` allow-list |
|
|
| `overlay.css` | Hide raw OpenBao login fields |
|
|
| `overlay.js` | Apply presets, branding on post-login Ember pages |
|
|
| `login.html` / `login.js` / `login.css` | Standalone KeyCape login at `/ui/vault/auth` |
|
|
| `callback.html` / `callback.js` | OIDC code exchange at `/ui/vault/auth/*/oidc/callback` |
|
|
| `nginx.conf` | Gateway proxy + standalone auth page + HTML injection |
|
|
| `patches/<version>/manifest.sha256` | Upstream UI fingerprints for drift detection |
|
|
|
|
## Deploy
|
|
|
|
From `railiance-platform`:
|
|
|
|
```bash
|
|
make openbao-overlay-apply # overlay only
|
|
make openbao-deploy # middleware + overlay + Helm upgrade
|
|
make openbao-verify-login-overlay
|
|
```
|
|
|
|
## Reapply after an OpenBao upgrade
|
|
|
|
1. Bump `server.image.tag` in `helm/openbao-values.yaml`.
|
|
2. Deploy: `make openbao-deploy`.
|
|
3. Fetch live UI assets and compare hashes:
|
|
|
|
```bash
|
|
curl -sS http://127.0.0.1:18200/ui/ -o /tmp/index.html
|
|
# locate vault-*.js path in /tmp/index.html, then:
|
|
curl -sS "http://127.0.0.1:18200/ui/assets/vault-....js" -o /tmp/vault.js
|
|
sha256sum /tmp/index.html /tmp/vault.js
|
|
```
|
|
|
|
4. If hashes differ from `patches/<old-version>/manifest.sha256`, update
|
|
`overlay.css` / `overlay.js` selectors against the new Ember templates.
|
|
5. Write `patches/<new-version>/manifest.sha256`, update `VERSION`.
|
|
6. Run `make openbao-verify-login-overlay CHECK_UPSTREAM_DRIFT=1`.
|
|
7. Attended browser login through KeyCape MFA. The OpenBao role and KeyCape
|
|
client must both allow the exact loopback callback
|
|
`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` before the
|
|
former public listener is retracted.
|
|
|
|
Workplan: `helix-forge/workplans/HF-WP-0003-openbao-keycape-login-overlay.md`
|