feat: dockerised toolbox with the platform CLIs preauthenticated

[venkatamutyala]

Developers can't use the platform CLIs today. Everything on a GlueOps cluster sits behind oauth2-proxy, which expects a browser session cookie; a CLI has none, so every request is answered with a login redirect — and they have no kubectl to work around it.

argocd login … --sso   ->  rpc error: unexpected EOF        (got the 302 HTML, not gRPC)
bao login -method=oidc ->  invalid character 'R'            (parsing "Redirecting…")

This ships the CLIs in a container that deals with the edge, so they behave normally:

docker run -it --rm \
  -e TOOLBOX_CAPTAIN_DOMAIN=<captain-domain> \
  -v glueops-toolbox:/home/toolbox/.config/glueops \
  ghcr.io/glueops/toolbox:latest

argocd app list
bao kv get secret/my-app

One browser approval. No argocd login, no bao login, no flags, no kubectl.

How

Device flow, not loopback. toolbox-login uses the OIDC device flow against Dex — no loopback listener and no redirect URI, so the browser can live on the host. A localhost:8085 callback could not work from a container. Dex returns a refresh token too, so the browser step happens once, not daily.

One token, three verifiers. The Dex id_token is checked independently by oauth2-proxy (oidc_extra_audiences), ArgoCD (allowedAudiences) and OpenBao (jwt roles' bound_audiences). None of them coordinate — they each verify the same signature against Dex's JWKS.

Each side wants it in a different header, which is most of what made this fiddly:

	header	read by
ARGOCD_AUTH_TOKEN	Token:	ArgoCD
-H "Authorization: …"	Authorization: Bearer	oauth2-proxy
bao	X-Vault-Token	OpenBao

The argocd wrapper sends the first two. For bao there is no workable wrapper — -header must sit after the subcommand and before any positional, and bao kv list secret is indistinguishable from a subcommand plus a path:

bao kv get -header="…" secret/foo     ✓
bao kv get secret/foo -header="…"     ✗  flags must precede positional arguments
bao -header="…" kv get secret/foo     ✗  no global flag position

So a loopback proxy adds the header and forwards upstream, with BAO_ADDR pointed at it. bao needs no flags and scripts work unmodified. It binds 127.0.0.1 only — it attaches the caller's credential to whatever it forwards.

toolbox-login also exchanges the Dex token for an OpenBao token (posting to the login endpoint directly, since the OpenBao CLI registers no jwt method), so both CLIs are usable after one login.

Restricting access

TOOLBOX_BAO_ROLES=reader pins the session to read-only. Verified: bao kv put → 403 permission denied, nothing written.

Platforms

linux/amd64 and linux/arm64, so Apple Silicon is native. TARGETARCH has no default on purpose — a default would silently produce an arm64 image full of amd64 binaries when built natively on a Mac. CI builds both and smoke-tests the native one.

Releases

release-please, matching the other GlueOps repos. The manifest starts at 0.0.0 with bump-patch-for-minor-pre-major, so the first release is v0.0.1 rather than v0.1.0, without depending on how this PR is merged.

Testing

Run end to end against a live cluster, twice, as a developer would — fresh image, fresh container, empty volume, real browser approval:

toolbox-login        Authenticated.  OpenBao: logged in as editor.
argocd app list      30 applications
argocd cluster list  in-cluster, 1.34, Successful
bao status           Sealed false, HA Mode active
bao token lookup     jwt-<user>  policies ['default','editor']
bao kv list secret/  3 secrets

TOOLBOX_BAO_ROLES=reader   ->  Already authenticated (no second prompt)
                               policies ['default','reader']
bao kv put                 ->  403 permission denied

Four bugs were found by actually running it, not by review:

• ARGOCD_AUTH_TOKEN alone never reaches the edge — ArgoCD sends it in Token:, which oauth2-proxy doesn't read.
• -H alone gets past the edge but leaves Token: empty, so ArgoCD answers "no session information". Both headers are needed.
• A VOLUME directive made the token cache root-owned and gave a fresh anonymous volume per docker run, so the cache could never persist.
• docker exec bypasses the ENTRYPOINT, leaving BAO_ADDR unset — bao then fell back to its own default, which is the same port on https, failing confusingly.

Cluster prerequisites

A public toolbox Dex client, that audience in oauth2-proxy's oidc_extra_audiences and ArgoCD's allowedAudiences, and jwt-type OpenBao roles bound to it — GlueOps/platform-helm-chart-platform#1485 and GlueOps/terraform-module-kubernetes-hashicorp-vault-configuration#68.

ghcr.io/glueops/toolbox does not exist until this merges; PR builds don't push.