Repository navigation
tribelt and estate-dashboard sign in through their declared Client #450
Description
Parent
What to build
tribelt and the estate dashboard sign in through their declared Client: both declare client and read ${client:secret}. Their copies in secret/auth-api and cluster.sh's client stages are removed.
Acceptance criteria
- Both sign people in through their Client.
-
secret/auth-apiholds no copy of either secret, andcluster.shhas no client stage.
Blocked by
- The render emits chapter 17's Clients #449
- Phase 1 cutover: identity goes live identity#25 (identity goes live; it serves every declared Client, Clients come from Kubernetes Client objects identity#13). auth-api serves every declared Client auth-api#104 was closed as superseded on 2026-10-26.
Activity
ExtraToast commentedon Oct 29, 2026
Picked up from the ready-for-agent backlog and skipped, because it needs a live step first.
JorisJonkers-dev/identity#25 is still open and
status: ready-for-human. Until identity serves the Issuer host, nothing watches theClientobjects, so nothing writessecret/data/<namespace>/<application>/client. If JorisJonkers-dev/tribelt and JorisJonkers-dev/estate-dashboard switched toclientand${client:secret}before then, their next release would reference a Vault path nobody creates and sign-in would break. Today both still read their own copy: tribelt fromsecret/data/platform/tribelt#oidc.client_secret, the dashboard fromsecret/data/estate-dashboard-system/sign-in#oidc-client-secret.The
cluster.shhalf of the second criterion already holds: JorisJonkers-dev/estatemainhas no client stage left. Emptying the copies insecret/auth-apiis a production Vault write, so a person has to do it after the cutover.Question for the maintainer: should this go back to
status: blockeduntil identity#25 closes? Once it closes, the two project-file PRs are small: add theclientblock, pointOIDC_CLIENT_SECRETat${client:secret}, and drop the old grant key.ExtraToast commentedon Oct 29, 2026
Decision (maintainer, 2026-10-29): not now. Identity's production cutover (JorisJonkers-dev/identity#25) is flipped later, and this waits for it. No worker takes it until then.