Operate Hikyo from the browser
Take a fresh organisation to Kubernetes-ready delivery from the embedded web UI, without the CLI.
The embedded web UI covers the core administration and delivery lifecycle. This page follows the browser path end to end, from a fresh organisation on an installation whose only human is the bootstrap administrator to a workload receiving secrets in Kubernetes, and then lists exactly what stays outside the browser and why.
The same journey is executable: the Playwright flow browser-only lifecycle
in web/e2e/flows/machine-access.spec.ts runs it against a real instance on
every change, on a desktop and a phone viewport, from a fresh organisation on
the suite’s shared instance.
Before you start
Two acts are host-local by contract and happen on the server host, not in a browser: creating the first administrator (Getting started) and running migrations or a restore. After that, sign in at the instance origin. Organisation creation and instance administration need a second factor, so enrol one under Account & security first (Account security). A human who has lost that factor recovers from the sign-in page: Lost your second factor? Recover with a code spends one recovery code for a new password.
The lifecycle
- Organisation. Instance administration → Create organisation. Creation grants you organisation admin and ends the session; sign in again.
- Project. Projects → New project. The active organisation is the one selected in the rail, or the one a deep link named.
- Environments. Project settings → New environment. Protection, retention and the Git-governed definitions mode live on the same page.
- Keys and values. Environment matrix → New key declares a config or secret key with an optional first value per environment. Cells stage drafts; Publish drafts publishes the selected environments atomically. A protected environment asks for its confirmation and a purpose-bound ceremony.
- Human access. Members → Invite issues a display-once setup authority with a role template; New grant adds capability lines to any principal.
- Workload access. Machine access → Create service account, Mint
credential (shown exactly once), Add environment grant for
read. - Secret delivery. Machine access → Enable the opt-in for machine secret
delivery, then Members → New grant of
revealto the service account’s principal on the environment. Until both are done, a workload receives configuration values and secret presence only. - Kubernetes. Store the minted credential in the designated bootstrap
Secret and create the
HikyoSecret(Kubernetes operator). Reconciliation is the controller’s work; every Hikyo-side prerequisite above is browser-operable. - CI delivery. Deployment adapters → Add adapter with a write-only provider credential and a first target. The target’s health, last attempt, failed names and conflict artifacts are read in place; Plan previews the name changes without reading a value and Test connection probes the provider without writing.
- Inspect. Audit (organisation sidebar) queries and exports the trail. Deployment adapters shows per-target health. Overview shows the pruner and storage high-water state.
- Recover. Revoke a leaked machine credential from the account row and mint a new one; the old value is refused at the next fetch. Roll a bad publish back from the history drawer (Restore), which stages ordinary drafts you publish like any other.
Low-frequency administration
Frequency orders delivery; it never excuses a missing surface. These surfaces exist in the browser even though most installations touch them rarely:
| Surface | Where | What it administers |
|---|---|---|
| Identity providers | Instance administration | OIDC providers, SAML providers and SP keys, federation issuers |
| Provisioning | Organisation → SCIM | Bindings, mappings, provisioning credentials, directory views |
| Remotes | Organisation → Remotes | Directory-tier remotes, connection credentials, workspace sessions |
| Dynamic secrets | Machine access → Providers and Leases | Providers, write-only credentials, mint/renew/revoke/settle leases |
| Certificates | Instance administration, Machine access → SSH and Certificates | SSH CAs/profiles, private-PKI issuers/profiles, issuance and revocation |
| Adapters | Project → Deployment adapters | Create, targets, pause/resume/resync, plan, test, credential custody, origin moves, deletion |
| Audit | Organisation → Audit, Project → Project audit | Query, inspect and export the organisation trail, or a project’s trail narrowed to one environment |
| Remote crypto | Instance administration, Project settings | DEK/master/root/token/scanning-key rotation and resumable re-encryption |
What stays outside the browser
The exemption list is closed and machine-checked: api/parity.yaml in the
repository maps every public operation to a browser surface, one of the
classes below, or an open issue, and CI fails when an operation is added
without a disposition or an issue is closed without its surface. Transit key
management and cryptographic operations are currently CLI/API-only
(#820). These are implementation
gaps, not host-local or protocol exemptions.
| Class | Examples | Why |
|---|---|---|
| Host-local authority | hikyo admin create, migrate, sudo hikyo upgrade, escrow verify, restore reconcile, config-rollout, break-glass | No HTTP endpoint exists; the act needs the host and the root key |
| Client-local delivery | hikyo run, render, the Compose and Kubernetes delivery fetch | Acts on the box the credential lives on and admits no human session |
| Kubernetes reconciliation | HikyoSecret converge | The operator speaks only the delivery wire |
| Identity-protocol endpoints | OIDC callback, SAML ACS, the SCIM wire, the CLI’s own reauthentication legs | Protocol-shaped and client-specific by nature |
Parity is by outcome, not by form
Browser, CLI and API parity is judged by the user outcome. A browser form
does not mirror every CLI flag: the matrix edits cells one by one where the
CLI applies a batch; the adapter list embeds each adapter’s targets where the
CLI has adapter show. What must hold is that the same person can reach the
same end state from either surface, under the same authorization, refusal,
redaction and audit rules.
Managed Hikyo configuration
Owner runtime settings and per-node settings are edited in the protected project like any other values, published as an exact revision, then applied after reauthentication. Manage Hikyo with Hikyo covers adoption, per-node convergence, independent remote projects and rollback; settings that need a restart go through configuration rollouts.
The protected organisation and project refuse machine access, deployment adapters, SCIM provisioning and additional projects by design, so the browser does not offer them there; a deep link to one of those pages says so. Use an organisation of your own for that work.