coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance OpenBao migration to consumer waves

Browse source
This commit is contained in:
codex 2026-08-03 21:30:17 +02:00
parent 50a0a2ab50
commit cb428442eb
3 changed files with 33 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -40,8 +40,8 @@
| task | RAILIANCE-WP-0020-T01 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T02 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T04 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T05 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T04 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T05 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T06 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T07 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |

13
tools/openbao-attended-unseal-target.sh Executable file
View file

@ -0,0 +1,13 @@
#!/usr/bin/env bash
set -euo pipefail
remote=(ssh -tt railiance01)
unseal='kubectl -n openbao exec -it openbao-0 -- env BAO_ADDR=http://127.0.0.1:8200 bao operator unseal'
status='kubectl -n openbao exec openbao-0 -- env BAO_ADDR=http://127.0.0.1:8200 bao status'
echo "Private railiance01 target: enter rotated source share 1 of 2 at the hidden prompt."
"${remote[@]}" "$unseal"
echo "Private railiance01 target: enter a different rotated source share at the hidden prompt."
"${remote[@]}" "$unseal"
echo "Private railiance01 target status:"
"${remote[@]}" "$status"

20
workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
View file

@ -123,7 +123,7 @@ output was non-empty. Machine-readable evidence is in
```task
id: RAILIANCE-WP-0020-T04
status: wait
status: done
priority: high
state_hub_task_id: "d04d7fdd-bd00-407a-8954-101b680ed327"
```
@ -136,11 +136,22 @@ change public DNS or consumers yet.
Done when target semantic probes match the source and repeated restart/unseal
tests pass through a private endpoint.
Completed 2026-08-03. A final source snapshot was encrypted and uploaded
offsite (plaintext SHA-256
`ac5e27536c01c3a019c3dde1069866569112c76d8ab42ec2bdb45724cc9b13f8`,
encrypted SHA-256
`22003d8fcb12ef17d6edafad9358ed2b0e538b21a8daee86445d9b85482f9161`).
The still-empty railiance01 target was restored privately, temporary init
material and plaintext staging were removed, and two attended target
restart/unseal cycles passed. The target is active on OpenBao 2.5.4 with the
source cluster ID and a non-empty persistent audit file. CoulombCore remains
live and no public DNS changed.
## T05 - Migrate consumers to local workload identity
```task
id: RAILIANCE-WP-0020-T05
status: wait
status: progress
priority: high
state_hub_task_id: "f0a82e4e-8074-4a22-b1e9-f01ec0ff76a1"
```
@ -154,6 +165,11 @@ rollout, and reversal before continuing.
Done when all railiance01 consumers use the local private service and no
runtime dependency requires the CoulombCore API.
2026-08-03: Wave 1 (`reuse`) moved to
`http://openbao.openbao.svc:8200`. The ClusterSecretStore remained Valid, a
forced ExternalSecret refresh completed as SecretSynced/Ready, and the
declarative owner change was committed in `railiance-platform@33b36e8`.
## T06 - Cut over public OpenBao DNS and operator access
```task