From 204ccbf27af1ae831ad8cb80680f3e34b39252a2 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 7 Oct 2026 09:17:30 +0200 Subject: [PATCH] Point the KeyCape OpenBao consumer command at the operator tunnel bao.coulomb.social was retired on 2026-09-15. The in-memory source accepts a loopback address. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b --- docs/keycape-openbao-consumer-custody.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/keycape-openbao-consumer-custody.md b/docs/keycape-openbao-consumer-custody.md index 5affaad..70ebc05 100644 --- a/docs/keycape-openbao-consumer-custody.md +++ b/docs/keycape-openbao-consumer-custody.md @@ -24,7 +24,7 @@ and is being revised by railiance-platform. | Issuer copy | `sso` Secret `keycape-secrets-engine-openbao-client` key `client-secret`, via ESO on Kubernetes auth (platform/KeyCape; unchanged) | | Consumer copy | **none** — the value exists only in process memory for one command | | Consumer read lane | OIDC mount `auth/netkingdom`, role `keycape-secrets-engine-openbao-operator-workload-kv-read`, policy `workload-kv-read-keycape-secrets-engine-openbao-operator` (read on the data path, `update` on `auth/token/revoke-self`, nothing else), 5m TTL, 4 uses, bound `groups=net-kingdom-admins` | -| Companion config | `BAO_ADDR=https://bao.coulomb.social`, `SECRETS_ENGINE_KEYCAPE_TOKEN_URL=https://kc.coulomb.social/token`, `SECRETS_ENGINE_KEYCAPE_ISSUER=https://kc.coulomb.social`, `SECRETS_ENGINE_OPENBAO_JWT_LOGIN=` | +| Companion config | `BAO_ADDR=http://127.0.0.1:18200` (operator tunnel; bao.coulomb.social retired 2026-09-15), `SECRETS_ENGINE_KEYCAPE_TOKEN_URL=https://kc.coulomb.social/token`, `SECRETS_ENGINE_KEYCAPE_ISSUER=https://kc.coulomb.social`, `SECRETS_ENGINE_OPENBAO_JWT_LOGIN=` | The mount, path, field and role are pinned in `service_auth.OpenBaoOidcClientSecretSource`; any other value is refused. @@ -74,7 +74,7 @@ verification item 6. ```bash cd /home/worsch/secrets-engine && \ env -u BAO_TOKEN -u VAULT_TOKEN -u SECRETS_ENGINE_KEYCAPE_CLIENT_SECRET_FILE \ - BAO_ADDR=https://bao.coulomb.social \ + BAO_ADDR=http://127.0.0.1:18200 \ SECRETS_ENGINE_KEYCAPE_TOKEN_URL=https://kc.coulomb.social/token \ SECRETS_ENGINE_KEYCAPE_ISSUER=https://kc.coulomb.social \ SECRETS_ENGINE_OPENBAO_JWT_LOGIN=/home/worsch/.secrets-engine/keycape/openbao-jwt-login.yaml \