tegwick
1fbebb2d94
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 6969@bnt-lap001 Assistant-Session: e8ae73f2-8385-4c9c-b714-94c3c52cdbc0
79 lines
3 KiB
YAML
79 lines
3 KiB
YAML
spec: runbook-pack/v0.2
|
|
id: nk.openbao-emergency-lockdown
|
|
title: OpenBao emergency lock-down
|
|
owner: net-kingdom
|
|
outcome: OpenBao is sealed, sealed state is confirmed, and the drill or incident outcome is recorded without secrets.
|
|
engine: native
|
|
confirm_phrase: I understand this cannot be undone
|
|
framing:
|
|
- Sealing stops all access to stored assets until a quorum of shares unseals it again.
|
|
- Confirm the quorum is available before sealing outside an incident.
|
|
- Ported from the security bootstrap console runbook "Emergency lock-down".
|
|
actors:
|
|
- id: operator
|
|
role: OpenBao ceremony operator
|
|
description: Holds a root or sudo-capable token and seals the instance.
|
|
privileges: [openbao-root-or-sudo]
|
|
datapoints:
|
|
- id: evidence_path
|
|
label: Emergency drill evidence file
|
|
type: path
|
|
default: /tmp/netkingdom-openbao-emergency-drill/evidence.json
|
|
dimensions: {actor: operator, kind: location, subsystem: openbao}
|
|
ask_in: seal
|
|
stages:
|
|
- id: seal
|
|
title: Seal and confirm
|
|
goal: OpenBao reports Sealed true.
|
|
steps:
|
|
- id: seal-now
|
|
title: Seal OpenBao
|
|
actor: operator
|
|
owner: openbao
|
|
command: |
|
|
printf "OpenBao token: " >&2; read -rs OPENBAO_TOKEN; printf "\n" >&2
|
|
printf "%s\n" "$OPENBAO_TOKEN" | kubectl exec -i -n openbao openbao-0 -- sh -c 'read -r BAO_TOKEN; export BAO_TOKEN; bao operator seal'
|
|
unset OPENBAO_TOKEN
|
|
reversible: false
|
|
idempotent: idempotent
|
|
idempotent_note: Sealing an already sealed instance changes nothing.
|
|
auto_confirm: manual-only
|
|
rollback: Unseal with a quorum of shares (attended ceremony).
|
|
verify:
|
|
done_when: The seal command succeeded
|
|
expect: manual
|
|
- id: confirm-sealed
|
|
title: Confirm sealed status
|
|
actor: operator
|
|
owner: openbao
|
|
requires: [seal-now]
|
|
command: kubectl exec -n openbao openbao-0 -- bao status
|
|
idempotent: idempotent
|
|
verify:
|
|
done_when: Sealed is true
|
|
expect: manual
|
|
gates:
|
|
- id: sealed
|
|
title: OpenBao is sealed
|
|
goal: contained-exposure
|
|
blocking: true
|
|
downstream_risk: Stored assets stay reachable during the incident.
|
|
checks:
|
|
- done_when: Status reports Sealed true
|
|
expect: manual
|
|
- id: record
|
|
title: Record the outcome
|
|
goal: Non-secret drill or incident evidence validates.
|
|
requires: [seal]
|
|
steps:
|
|
- id: validate-evidence
|
|
title: Validate the emergency evidence
|
|
actor: operator
|
|
owner: railiance-platform
|
|
uses: [evidence_path]
|
|
command: make -C ../railiance-platform openbao-validate-emergency-evidence OPENBAO_EMERGENCY_EVIDENCE={{evidence_path}}
|
|
idempotent: idempotent
|
|
verify:
|
|
done_when: The validator accepts the evidence
|
|
command: make -C ../railiance-platform openbao-validate-emergency-evidence OPENBAO_EMERGENCY_EVIDENCE={{evidence_path}}
|
|
expect: exit-0
|