From fd64fc8478b6d2a6fc041556d314568cdfd0bb02 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 23:39:28 +0100 Subject: [PATCH] NK-WP-0055-T13: founder chooses a standing loopback generate-root listener Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- workplans/NK-WP-0055-security-platform-production-readiness.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md index 93c2426..3fdf9f9 100644 --- a/workplans/NK-WP-0055-security-platform-production-readiness.md +++ b/workplans/NK-WP-0055-security-platform-production-readiness.md @@ -316,6 +316,8 @@ root token against an isolated restored OpenBao (never production); use produces 2026-10-27: founder ran `kingpath-offsite.py`: `net-kingdom-kingpath-20261027T223050Z-8c9d48421f1b.tar.age` (items `admin-kubeconfig`, `tunnel-ssh-key`) sealed to `railiance-backup`, uploaded to `Backup/railiance-backups/net-kingdom-kingpath/` and read back (sha256 `8c9d48421f1b…dd4aa`, ETag `"5a14c69d…8252"`). Restoring it from Storage Share is part of the king-path drill. 2026-10-27: railiance-platform wrote "Break-glass: OpenBao with SSO down" in `docs/openbao.md` (`8016f56`, pushed): access via the static-key tunnel and admin kubeconfig, unseal at hidden prompts, value-free held-token check, the `generate-root` ceremony through the API (server OTP, shares at hidden prompts, in-memory decode, nothing in argv/env/history), revoke-and-confirm, and a post-event review record. Drill: RPF-WP-0064-T10 on an isolated restore, including the held root-token check. **Finding:** OpenBao 2.5.4 disables unauthenticated `generate-root` by default and the production listener (`rapp-openbao/helm/openbao-values.yaml`) does not enable it, so the ceremony cannot run on production without an existing token. rapp-openbao must choose (a) an incident-time listener edit plus restart and re-unseal, or (b) a standing loopback-only listener reachable only through `kubectl port-forward`/`exec`. + +2026-10-27 founder decision (hub decision `732b5c96`): option (b), a standing loopback-only OpenBao listener with `generate-root` enabled, reachable only through `kubectl port-forward`/`exec` with the admin kubeconfig. Owner rapp-openbao prepares the change for founder review and rollout. ## Policy import pipeline and platform/tenant package split ```task