---
id: w6/m11/t001
title: Stand up the local stack (mock-cluster + Kratos/OpenFGA/OpenBao/CP-Postgres)
worker: worker6
status: todo
estimate: 40m
depends_on: []
---

## Objective

Restore a full live verification environment: the local CAPD cluster plus a bex-api wired to real control-plane Postgres, Kratos (admin API included), OpenFGA, and OpenBao — the stack all three residual verifications need.

## Context

- `bash scripts/mock-cluster.sh` — kind infra cluster + Cluster API + CAPD app cluster; kubeconfig at `infra/local/bex.kubeconfig` (gitignored — never commit or print).
- The prior blocker is fixed: the Calico IPIP overlay outage was resolved by `ipipMode: CrossSubnet` on the IPPool + CNPG DB recreate (see the recorded post-mortem); verify cross-node pod traffic works before blaming this milestone's steps.
- bex-api env: `BEX_CP_DB_URI` (control-plane store — required for workspaces), `BEX_KRATOS_ADMIN_URL` (email enrichment), `BEX_OPENFGA_URL`, `BEX_OPENBAO_URL` (env-vars store / purge target).

## Steps

1. Run `bash scripts/mock-cluster.sh`; confirm nodes Ready and cross-node pod networking works.
2. Deploy/start the auth+authz+secrets stack (Kratos + Hydra, OpenFGA, OpenBao, CP Postgres) and bex-api with the env vars above.
3. Smoke-check: bex-api healthz, a GraphQL `workspaces` query returns the seeded identity's workspace, OpenBao reachable.

## Files

- none (environment only; any fixes discovered belong to their own follow-up notes)

## Acceptance criteria

- [ ] bex-api healthy against real CP Postgres + OpenFGA + Kratos + OpenBao on the local cluster
- [ ] GraphQL `workspaces` query succeeds for a logged-in test identity

## Out of scope

- Any dashboard/backend code changes (t004 owns the stub change)
