OpenBao: identity agent-rex #6

New issue

Closed

opened 2026-10-31 13:09:04 +00:00 by mikluko · 2 comments

mikluko commented

2026-10-31 13:09:04 +00:00

Owner

Map: #1

Question

Set up OpenBao for agent-rex: entity, Kubernetes auth role bound to the pod's ServiceAccount, the shared agent policies, agents/anthropic/agent-rex with CLAUDE_CODE_OAUTH_TOKEN, and the entity's sub in the Forgejo "agent" integration rule. Writes to agents and policies are the human's; the agent writes the commands. Resolved when baox inside a pod with that ServiceAccount logs in.

Map: #1 ## Question Set up OpenBao for `agent-rex`: entity, Kubernetes auth role bound to the pod's ServiceAccount, the shared agent policies, `agents/anthropic/agent-rex` with `CLAUDE_CODE_OAUTH_TOKEN`, and the entity's `sub` in the Forgejo "agent" integration rule. Writes to `agents` and policies are the human's; the agent writes the commands. Resolved when `baox` inside a pod with that ServiceAccount logs in.

mikluko added the

wayfinder:task

label

2026-10-31 13:09:16 +00:00

mikluko added a new dependency

2026-10-31 13:09:17 +00:00

#4 Pod shape: namespace, pool, sandbox, egress

mikluko added a new dependency

2026-10-31 13:09:18 +00:00

#8 Deploy kuberex on saraksh via Flux HelmRelease

mikluko self-assigned this

2026-10-31 16:21:32 +00:00

mikluko commented

2026-10-31 16:30:59 +00:00

Author

Owner

Progress:

Done (by me, admin login): entity agent-rex (agents-read, agents-oidc, agents-k8s-saraksh, agents-github), alias agents/rex on kubernetes/saraksh, role rex for SA agents/rex, alias_name_source=serviceaccount_name, 1h/4h.
Done (agent token): kv/k8s/saraksh/agents/rex-apt, key auth.conf. ESO paths are kv/k8s/saraksh/<namespace>/<name>, so the Tailscale key goes to kv/k8s/saraksh/agents/rex-tailscale.
Dropped: agents/anthropic/agent-rex. Claude Code is logged in interactively in a Rex terminal; credentials stay in the home on /srv/rex.
Open: agent-rex in the sub rule of the Forgejo integration "agent".

Progress: - Done (by me, admin login): entity `agent-rex` (`agents-read`, `agents-oidc`, `agents-k8s-saraksh`, `agents-github`), alias `agents/rex` on `kubernetes/saraksh`, role `rex` for SA `agents/rex`, `alias_name_source=serviceaccount_name`, 1h/4h. - Done (agent token): `kv/k8s/saraksh/agents/rex-apt`, key `auth.conf`. ESO paths are `kv/k8s/saraksh/<namespace>/<name>`, so the Tailscale key goes to `kv/k8s/saraksh/agents/rex-tailscale`. - Dropped: `agents/anthropic/agent-rex`. Claude Code is logged in interactively in a Rex terminal; credentials stay in the home on `/srv/rex`. - Open: `agent-rex` in the `sub` rule of the Forgejo integration "agent".

mikluko referenced this issue

2026-10-31 16:33:17 +00:00

Map: Rex server on saraksh #1

mikluko commented

2026-10-31 16:33:17 +00:00

Author

Owner

Out of scope: agent identity and secrets inside the pod are a separate effort. Left in place: entity agent-rex, alias agents/rex, role rex on kubernetes/saraksh. Not done: agents/anthropic/agent-rex (dropped), the Forgejo sub rule. kv/k8s/saraksh/agents/rex-apt stays; it serves the startup install.

Out of scope: agent identity and secrets inside the pod are a separate effort. Left in place: entity `agent-rex`, alias `agents/rex`, role `rex` on `kubernetes/saraksh`. Not done: `agents/anthropic/agent-rex` (dropped), the Forgejo `sub` rule. `kv/k8s/saraksh/agents/rex-apt` stays; it serves the startup install.

mikluko closed this issue

2026-10-31 16:33:17 +00:00