Service Directory
One page for every front door in the lab: where it is, how you log in, and — when a credential exists — a link that opens that exact secret in the Vault UI.
This page links to credentials, never shows values. No password, token, or key appears here or anywhere else in this book — every “Open in Vault ↗” link opens the exact secret in the Vault UI, and only works after you have logged in to Vault itself. If a link ever lands on a “not found” in the UI, the secret moved — update this page in the same change that moves it.
Front doors
| Service | URL | Login | Credential |
|---|---|---|---|
| Vault | vault.rhels.com | Token login — this is the credential store itself | Root token and unseal key are not in Vault: they live in the mini’s macOS Keychain (vault-crc-lab items), and the unseal key also as the file ~/.vault-unseal-key on the mini |
| Argo CD | argo.rhels.com | “Log in via OpenLDAP” (Dex) with your directory account | Break-glass local admin: Open in Vault ↗ (also held in the argocd-initial-admin-secret Secret, argocd namespace) |
| Harbor | harbor.rhels.com | LDAP — your directory account | Local admin (break-glass): Open in Vault ↗ · Kyverno verifier robot: Open in Vault ↗ · CRC pull robot: Open in Vault ↗ · Docs CI robot: Open in Vault ↗ |
| Grafana | grafana.rhels.com | Local admin (anonymous viewer is on) | Open in Vault ↗ |
| StackRox Central (ACS) | acs.rhels.com | LDAP SSO via Dex; your directory account (admins group for Admin) | Local admin (break-glass): Open in Vault ↗ |
| Prometheus | prom.rhels.com | No login — tailnet only | — |
| AlertManager | alerts.rhels.com | No login — tailnet only | — |
| Dex (OIDC issuer) | id.rhels.com | This is the login service — Argo and ACS redirect here; you sign in with your directory account | No credential of its own in Vault: Dex’s LDAP bind password lives only in the argocd-secret Secret (argocd namespace, on the mini) |
| MCP server | mcp.rhels.com/mcp | LDAP bind login, then an opaque session token | Your own directory account — the owner’s is recorded at Open in Vault ↗ |
| Alert bridge | bridge.rhels.com | No human login — webhook receiver that turns CRC alerts into GitHub issues | Its GitHub token: Open in Vault ↗ |
| Docs (this site) | docs.rhels.com | No login — tailnet only | — |
| OpenLDAP | ldaps://ldap.rhels.com:636 (plain LDAP on port 389, same name) | Bind with your directory account | Directory admin: Open in Vault ↗ · Service binds: Open in Vault ↗, Open in Vault ↗ |
| OpenShift console (CRC) | console.crc.rhels.com | OpenShift OAuth → the agentops-ldap provider, your directory account; htpasswd developer is break-glass | CRC pull secret: Open in Vault ↗ · htpasswd record: Open in Vault ↗ |
Credentials with no front door of their own
| What | Where it is used | Credential |
|---|---|---|
| ARC GitHub App | The CI runners’ GitHub identity (pro scale sets) | Open in Vault ↗ |
| ServiceNow PDI | dev377665.service-now.com — admin login; the namespace platform’s real ServiceNow backend | Open in Vault ↗ — the platform’s working copies are the pdi-creds Secrets in the clusters and the PDI_PASSWORD GitHub secret |
| Fixture & smoke-test LDAP accounts | dev1, dev2, ops1 (test users) and svc-smoketest (health suite) | Open in Vault ↗ and Open in Vault ↗; the health suite’s working copies live in the file ~/workspace/lab-health/.env on the Spark VM |
| Tailscale operator OAuth | Lets the mini’s Tailscale operator own the front-door device | Open in Vault ↗ |
| Cloudflare DNS-01 token | cert-manager’s Let’s Encrypt challenges for rhels.com | Open in Vault ↗ |
| Argo CD → pro cluster token | How the mini’s Argo CD drives the pro cluster | Open in Vault ↗ |
Related pages
- Vault — how the store itself is set up and unsealed.
- Identity & Access — the directory behind every “your directory account” login above.
- The cover of this site has the same front doors as a public-safe directory (names and login mechanisms only, no credential paths).