0f0282a436
credential-change.py generates sys/capabilities-self (update) when openbao.token_capabilities_self is true. Proposed CCR-2026-0045 sets it for workload-kv-read-reuse-surface-runtime so the ops-mason proof stops calling sys/capabilities with a root token. The OpenBao login page keeps its platform-admin button and adds an allow-listed workload role choice. Repo only; nothing applied to OpenBao or the cluster. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
17 lines
632 B
JSON
17 lines
632 B
JSON
{
|
|
"namespace": "",
|
|
"method": "oidc",
|
|
"mount": "netkingdom",
|
|
"role": "platform-admin",
|
|
"title": "Sign in with KeyCape",
|
|
"signInLabel": "Sign in with KeyCape",
|
|
"banner": "Platform operators authenticate through KeyCape at kc.coulomb.social.",
|
|
"workloadRoles": [
|
|
{
|
|
"role": "reuse-surface-hub-writer-workload-kv-read",
|
|
"label": "reuse-surface hub writer (workload read)"
|
|
}
|
|
],
|
|
"workloadLabel": "Sign in with a workload role",
|
|
"workloadHint": "A workload role needs its own person. Open this page in a private window, or sign out of KeyCape first, so the platform-admin session is not reused."
|
|
}
|