From aad0e7094a69682725d2c280a6e049331e6223d2 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 23 Oct 2026 09:09:53 +0200 Subject: [PATCH] RCLUSTER-WP-0018-T06: staging rehearsal run green; receipt recorded, dry-run step corrected Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4101@bnt-lap001 Assistant-Session: bc7d2ce5-6f32-45f1-83e5-0dcbb8e610a7 --- docs/keycape-tls-le-staging-rehearsal.md | 29 +++++++++++++++++-- ...R-WP-0018-keycape-original-tls-recovery.md | 8 +++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/docs/keycape-tls-le-staging-rehearsal.md b/docs/keycape-tls-le-staging-rehearsal.md index b1ebfcd..893b330 100644 --- a/docs/keycape-tls-le-staging-rehearsal.md +++ b/docs/keycape-tls-le-staging-rehearsal.md @@ -83,7 +83,10 @@ curl -sS -o /dev/null -w '%{http_code}\n' http://kc.coulomb.social/.well-known/a LIVE_BEFORE=$(openssl s_client -connect kc.coulomb.social:443 -servername kc.coulomb.social /dev/null \ | openssl x509 -noout -fingerprint -sha256); echo "$LIVE_BEFORE" kubectl -n sso get secret kc-tls -o jsonpath='{.metadata.resourceVersion}{"\n"}' # metadata only, no data -kubectl apply --dry-run=server -f "$M" # expect exactly 3 objects, all in $NS +# A server dry run does not persist the Namespace, so the namespaced Issuer and +# Certificate would fail with NotFound. Create the empty namespace first. +kubectl create namespace "$NS" +kubectl apply --dry-run=server -f "$M" # expect the namespace configured + 2 created, all in $NS # 1. Apply kubectl apply -f "$M" @@ -123,7 +126,7 @@ Stop and go to step 5 cleanup if any of these is true: - The static guard test fails, or the server dry-run shows an object outside `tls-rehearsal-kc` or a name other than the three expected. -- `tls-rehearsal-kc` already exists before apply. +- `tls-rehearsal-kc` already exists before the preflight creates it. - DNS for `kc.coulomb.social` does not resolve to the railiance01 ingress address, or port 80 does not answer. - The live fingerprint or the `sso/kc-tls` resourceVersion changes at any point. @@ -140,3 +143,25 @@ cleanup done) is the entry condition for the production reissue in NK-WP-0049-T3 That attempt runs through NetKingdom's `sso/keycape` ingress and `ClusterIssuer/letsencrypt-prod` under RCLUSTER-WP-0018-T04's owner-attended gate. It is not part of this runbook. + +## Rehearsal receipt (2026-10-23, attended by the founder) + +Run from railiance-cluster `d905a6f` with the operator `system:admin` +kubeconfig. Certificate Ready and Order `valid` on the first order (no retry). + +| Check | Result | +| --- | --- | +| Issuer | `C = US, O = Let's Encrypt, CN = (STAGING) Ersatz Emmer YR2` | +| Subject / SAN | `CN = kc.coulomb.social` / `DNS:kc.coulomb.social` | +| Validity | 2026-10-23T05:56:44Z to 2026-12-26T05:56:43Z | +| `openssl verify` against staging Root X1 | `OK` | +| `tls_cert_sha256` (chain, public) | `11ad7ad35885d16577f46842d886cf50fa1bd2bd37966612db8b4fa86532d40e` | +| `leaf_public_spki_sha256` | `sha256:f6504168524fdce4b3453449baac330f05739fec740a1f894bfa5bfc8035ff0d` | +| `trust_sha256` (staging root) | `3a5e1171e5f5c2d41522d438f225602e4236a68fb29c32399a95921a4ae80e73` | +| Chain certificates | 3 | +| Live fingerprint before = after | `D5:DB:2B:55:5E:74:F7:FB:CD:56:DD:A3:28:5D:FF:FF:B8:6A:C1:64:BF:6C:28:88:1B:3E:FE:58:0F:C4:CE:5C` | +| `sso/kc-tls` resourceVersion before = after | `66444692` | +| Cleanup | namespace deleted; no ACME solver ingress left | + +No private key or account key was retained. Deviation: the server dry run +needed the namespace created first (runbook corrected above). diff --git a/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md b/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md index eb493ab..a175a36 100644 --- a/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md +++ b/workplans/RCLUSTER-WP-0018-keycape-original-tls-recovery.md @@ -171,6 +171,14 @@ write happened, and no credential was read. Running the rehearsal is an operator-attended step. Its public receipt is the entry condition for the production reissue under T04. +2026-10-23: rehearsal run, attended by the founder, and green. Certificate +Ready and Order valid on the first order. The issuer is `(STAGING) Ersatz Emmer YR2`, +the SAN is exactly kc.coulomb.social, and the chain verifies OK against staging +Root X1. The live fingerprint (D5:DB:2B:55…) and the sso/kc-tls resourceVersion +(66444692) were unchanged, and the namespace was deleted. The receipt is in the runbook. The runbook's +server dry run now creates the namespace first (a server dry run does not persist +it). This satisfies the entry condition for the T04 production reissue. + ## Coordination and completion Beneficiary NK-WP-0049-T35/CUST-WP-0080 remains linked to this obligor record by