Endpoints and credentials

The user-facing endpoints of the Fedshi reference instance, the credentials that come seeded out of the box, and where those secrets actually live in the cluster.

note

DevsPortal is built on the Control Plane Operator engine. Identifiers like openchoreo-auth, the thunder namespace, and the OpenBao secret keys are upstream names kept unchanged.

warning

Every credential on this page is a demo default seeded by the bootstrap — they are the upstream demo values, documented so onboarding works, not for production. Change the platform login and the ThunderID admin password before any real use.

Endpoints

Endpoint	URL	What it is for	How to reach it
Console	https://console.idp.fedshi.com	The branded Backstage developer portal — discover, create, deploy, and observe applications	Open in a browser; sign in via Control Plane Operator auth (OIDC)
API	https://api.idp.fedshi.com	The Control Plane Operator API server (REST + CRDs)	curl, the occ CLI, or the portal; bearer token from auth
Auth	https://auth.idp.fedshi.com	ThunderID OAuth2 / OIDC issuer	Used by the console/CLI for sign-in; admin console at {fedshi.auth}/console
Registry	https://registry.idp.fedshi.com	Harbor container registry (built images)	docker/crane pull (the idp project is public for pulls); Harbor UI in a browser
Observer	https://observer.idp.fedshi.com	Observer API for logs, metrics, and traces	Consumed by the console's observability views; bearer token from auth
Apps	{fedshi.apps}	Deployed workload endpoints (wildcard)	Each component gets a <env>-<namespace>.apps.idp.{fedshi.dnsZone} URL

note

The occ CLI is the upstream Control Plane Operator command-line tool. Point it at the API base {fedshi.api} to operate this instance.

Default credentials

Platform login (console)

The seeded platform administrator signs in to the console with:

Field	Value
Username	{defaultCredentials.username}
Password	(see defaultCredentials.password in _constants.mdx)

The bootstrap also seeds developer@openchoreo.dev, platform-engineer@openchoreo.dev, and sre@openchoreo.dev users, plus matching admins / developers / platform-engineers / sres groups in ThunderID.

danger

{defaultCredentials.username} ships with a well-known demo password. Change it (and the other seeded users) immediately — these are public defaults, not production credentials.

ThunderID admin console

The identity provider has its own admin console:

Field	Value
URL	{fedshi.auth}/console
Username	{defaultCredentials.thunderAdminUser}
Password	(see defaultCredentials.thunderAdminPassword in _constants.mdx)

The ThunderID admin defaults are {defaultCredentials.thunderAdminUser} / {defaultCredentials.thunderAdminUser}-tier demo values — rotate them as part of production hardening.

Where secrets actually live

Platform secrets are not baked into manifests. They live in OpenBao (the secret backend, in the openbao namespace) and are synced into Kubernetes Secrets by the External Secrets Operator through the cluster-scoped default ClusterSecretStore, which points ESO at OpenBao (http://openbao.openbao.svc:8200, KV v2, path secret).

note

OpenBao and ClusterSecretStore/ExternalSecret are upstream component and CRD names (from OpenBao and the External Secrets Operator), kept unchanged.

ExternalSecret	Namespace	OpenBao key(s)	Consumed by
backstage-secrets	openchoreo-control-plane	backstage-backend-secret, backstage-client-secret, backstage-jenkins-api-key	The portal (backend signing + OAuth client secret)
opensearch-admin-credentials	openchoreo-observability-plane	opensearch-username, opensearch-password	OpenSearch setup job + log/trace adapters
observer-secret	openchoreo-observability-plane	observer-oauth-client-secret	Observer (UID-resolver OAuth client secret)
registry-push-secret (OpenBao key)	n/a (read by build workflows)	registry-push-secret (dockerconfigjson)	Build publish-image step pushing to Harbor idp

Notes:

• The Harbor admin password is injected at install time with --set and persisted in the cluster in the harbor-core secret (not in OpenBao).
• Build pushes authenticate to Harbor with a dockerconfigjson stored in OpenBao under registry-push-secret; the idp project is public for pulls, so the data plane pulls anonymously and there is no pull secret to manage.
• In this reference instance OpenBao runs in dev mode (in-memory, root token, single replica) and seeds the platform secrets via a postStart hook. For production, run OpenBao with real storage and proper unseal — the default ClusterSecretStore stays the same. See Secrets management.

Related pages

• Environment map — hostnames, planes, namespaces, TLS secrets.
• Identity and SSO — configuring ThunderID.
• Container registry — Harbor wiring.