coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0055-T13: founder chooses a standing loopback generate-root listener
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 23:39:28 +01:00
parent 6b6ff3d56e
commit fd64fc8478
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
workplans/NK-WP-0055-security-platform-production-readiness.md
View file

@ -316,6 +316,8 @@ root token against an isolated restored OpenBao (never production); use produces
2026-10-27: founder ran `kingpath-offsite.py`: `net-kingdom-kingpath-20261027T223050Z-8c9d48421f1b.tar.age` (items `admin-kubeconfig`, `tunnel-ssh-key`) sealed to `railiance-backup`, uploaded to `Backup/railiance-backups/net-kingdom-kingpath/` and read back (sha256 `8c9d48421f1b…dd4aa`, ETag `"5a14c69d…8252"`). Restoring it from Storage Share is part of the king-path drill.
2026-10-27: railiance-platform wrote "Break-glass: OpenBao with SSO down" in `docs/openbao.md` (`8016f56`, pushed): access via the static-key tunnel and admin kubeconfig, unseal at hidden prompts, value-free held-token check, the `generate-root` ceremony through the API (server OTP, shares at hidden prompts, in-memory decode, nothing in argv/env/history), revoke-and-confirm, and a post-event review record. Drill: RPF-WP-0064-T10 on an isolated restore, including the held root-token check. **Finding:** OpenBao 2.5.4 disables unauthenticated `generate-root` by default and the production listener (`rapp-openbao/helm/openbao-values.yaml`) does not enable it, so the ceremony cannot run on production without an existing token. rapp-openbao must choose (a) an incident-time listener edit plus restart and re-unseal, or (b) a standing loopback-only listener reachable only through `kubectl port-forward`/`exec`.
2026-10-27 founder decision (hub decision `732b5c96`): option (b), a standing loopback-only OpenBao listener with `generate-root` enabled, reachable only through `kubectl port-forward`/`exec` with the admin kubeconfig. Owner rapp-openbao prepares the change for founder review and rollout.
## Policy import pipeline and platform/tenant package split
```task