coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/openbao-jwt-login.md
tegwick 4378ec1fc2 Prepare reviewed service JWT boundary verification and retain execution adoption gates 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
2026-10-11 14:11:59 +02:00

1.4 KiB
Raw Blame History

OpenBao JWT login contract (engine consumer)

Steady-state engine authentication is the reviewed KeyCape secrets-engine-openbao identity plus a platform-owned OpenBao JWT auth mount and exact-bound role. This repository does not invent that mount.

Point SECRETS_ENGINE_OPENBAO_JWT_LOGIN at a mode-normal YAML file outside the need to hold a standing OpenBao token:

mount: jwt
role: secrets-engine
bound_issuer: https://<keycape-issuer>

bound_issuer must equal SECRETS_ENGINE_KEYCAPE_ISSUER. The JWT is sent through a temporary JSON file, never argv. The resulting OpenBao token is revoked at the end of the command (token revoke -self). Evidence records the provider name and an accessor fingerprint only.

railiance-platform published the exact consumer file on 2026-10-10 at docs/contracts/secrets-engine-openbao-jwt-login.yaml (mount keycape-services, role secrets-engine-openbao, issuer https://kc.coulomb.social). When configured, --auth auto selects service-jwt; without a contract it keeps named bootstrap/env providers. Explicit service-jwt fails closed when configuration is missing. The current service token is login-self-only and cannot perform protected lane operations. T06 also requires a reviewed task-scoped execution entitlement and functional steady-state adoption; see final acceptance. A service-jwt selection never reads --bootstrap-token-file or BAO_TOKEN.