coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prove OpenBao isolated restore

Browse source
This commit is contained in:
codex 2026-08-03 20:38:27 +02:00
parent b8fdc4aa45
commit 7fd89ad6b0
4 changed files with 64 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -39,8 +39,8 @@
| task | RAILIANCE-WP-0019-T10 | done | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
| task | RAILIANCE-WP-0020-T01 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T02 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T03 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T04 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T04 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T05 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T06 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T07 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |

41
docs/evidence/openbao-isolated-restore-2026-08-03.json Normal file
View file

@ -0,0 +1,41 @@
{
"audit": {
"declarative_file_device_loaded": true,
"file_nonempty": true,
"path": "/openbao/audit/openbao-audit.log"
},
"authorization_probe": {
"credential": "existing external-secrets-rapp-qonto AppRole passed by stdin/reference",
"exact_path": "tenants/data/binky/qonto-api",
"exact_path_capabilities": ["read"],
"sibling_capabilities": ["deny"],
"sibling_path": "tenants/data/binky/not-qonto-api"
},
"captured_at": "2026-08-03",
"cluster_id": "fd28df5d-98ec-57dd-42ec-9b3e4f4e53bf",
"inventory": {
"approle_count": 7,
"auth_method_count": 5,
"kubernetes_role_count": 3,
"mount_count": 8,
"policy_count": 26,
"ssh_role_count": 3
},
"restart_unseal_cycles": 2,
"restored_active": true,
"seal": {
"shares": 3,
"threshold": 2,
"type": "shamir"
},
"snapshot": {
"bytes": 106836,
"sha256": "8ba31731131539e8070f24de1a8c3677998b417dacd5c5a6bdb94e7b7d20125d"
},
"source_remained_authoritative": true,
"target_version": "2.5.4",
"temporary_credentials_removed": true,
"temporary_plaintext_snapshot_removed": true,
"unseal_ceremony": "attended; rotated source shares entered through hidden prompts",
"secret_values_recorded": false
}

11
docs/openbao-coulombcore-to-railiance01-runbook.md
View file

@ -36,9 +36,14 @@ approved offsite backup lane. Its non-secret fingerprints are:
A second fresh snapshot restored successfully into an isolated OpenBao 2.5.4
pod on railiance01. OpenBao correctly resealed immediately after restore under
the source Shamir barrier. Full semantic and restart validation therefore
requires the source 2-of-3 unseal quorum; the temporary instance was not made
serving. The empty target Helm release has been aligned from 2.5.3 to 2.5.4.
the source Shamir barrier. On 2026-08-03 the operator supplied the rotated
2-of-3 quorum through hidden prompts. Two restart/unseal cycles passed; the
restored cluster became active with the source cluster ID, its inventory
matched, a scoped AppRole proved exact-path read and sibling denial, and the
declarative file audit device wrote successfully. Evidence is in
`docs/evidence/openbao-isolated-restore-2026-08-03.json`. The disposable
instance and plaintext staging were then removed. The empty target Helm release
has been aligned from 2.5.3 to 2.5.4.
## Preconditions and abort points

13
tools/openbao-attended-unseal-drill.sh Executable file
View file

@ -0,0 +1,13 @@
#!/usr/bin/env bash
set -euo pipefail
remote=(ssh -tt railiance01)
unseal='kubectl -n openbao-restore-drill exec -it openbao -- env BAO_ADDR=http://127.0.0.1:8200 bao operator unseal'
status='kubectl -n openbao-restore-drill exec openbao -- env BAO_ADDR=http://127.0.0.1:8200 bao status'
echo "OpenBao isolated restore: enter source share 1 of 2 at the hidden prompt."
"${remote[@]}" "$unseal"
echo "OpenBao isolated restore: enter a different source share at the hidden prompt."
"${remote[@]}" "$unseal"
echo "OpenBao isolated restore status:"
"${remote[@]}" "$status"