coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NET-WP-0020-T02: wire OpenBao init/unseal as Phase 7b in creds-bootstrap-agent (operator-reviewed)

Browse source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-02 13:32:58 +02:00
parent abde6b1fd4
commit 67b4677cea
3 changed files with 59 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
sso-mfa/bootstrap/creds-state.yaml
View file

@ -28,5 +28,12 @@ secrets_applied:
enckey_bootstrapped: true
pi_admin_created: true
# OpenBao init/unseal (NET-WP-0020 T2, sops-held-automation lane only).
# false here because the current cluster's OpenBao was initialized via the
# attended ceremony (NET-WP-0015–0017), not this automation path. These flip
# to true only when Phase 7b runs on a greenfield rebuild.
openbao_initialized: false
openbao_post_unseal_verified: false
# Derived: all true → bootstrap complete
bootstrap_complete: true