coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance OpenBao migration to consumer waves

Browse source
This commit is contained in:
codex 2026-08-03 21:30:17 +02:00
parent 50a0a2ab50
commit cb428442eb
3 changed files with 33 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -40,8 +40,8 @@
| task | RAILIANCE-WP-0020-T01 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T01 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T02 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T02 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T04 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T04 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T05 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T05 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T06 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T06 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T07 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T07 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |

13
tools/openbao-attended-unseal-target.sh Executable file
View file

@ -0,0 +1,13 @@
#!/usr/bin/env bash
set -euo pipefail
remote=(ssh -tt railiance01)
unseal='kubectl -n openbao exec -it openbao-0 -- env BAO_ADDR=http://127.0.0.1:8200 bao operator unseal'
status='kubectl -n openbao exec openbao-0 -- env BAO_ADDR=http://127.0.0.1:8200 bao status'
echo "Private railiance01 target: enter rotated source share 1 of 2 at the hidden prompt."
"${remote[@]}" "$unseal"
echo "Private railiance01 target: enter a different rotated source share at the hidden prompt."
"${remote[@]}" "$unseal"
echo "Private railiance01 target status:"
"${remote[@]}" "$status"

20
workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
View file

@ -123,7 +123,7 @@ output was non-empty. Machine-readable evidence is in
```task ```task
id: RAILIANCE-WP-0020-T04 id: RAILIANCE-WP-0020-T04
status: wait status: done
priority: high priority: high
state_hub_task_id: "d04d7fdd-bd00-407a-8954-101b680ed327" state_hub_task_id: "d04d7fdd-bd00-407a-8954-101b680ed327"
``` ```
@ -136,11 +136,22 @@ change public DNS or consumers yet.
Done when target semantic probes match the source and repeated restart/unseal Done when target semantic probes match the source and repeated restart/unseal
tests pass through a private endpoint. tests pass through a private endpoint.
Completed 2026-08-03. A final source snapshot was encrypted and uploaded
offsite (plaintext SHA-256
`ac5e27536c01c3a019c3dde1069866569112c76d8ab42ec2bdb45724cc9b13f8`,
encrypted SHA-256
`22003d8fcb12ef17d6edafad9358ed2b0e538b21a8daee86445d9b85482f9161`).
The still-empty railiance01 target was restored privately, temporary init
material and plaintext staging were removed, and two attended target
restart/unseal cycles passed. The target is active on OpenBao 2.5.4 with the
source cluster ID and a non-empty persistent audit file. CoulombCore remains
live and no public DNS changed.
## T05 - Migrate consumers to local workload identity ## T05 - Migrate consumers to local workload identity
```task ```task
id: RAILIANCE-WP-0020-T05 id: RAILIANCE-WP-0020-T05
status: wait status: progress
priority: high priority: high
state_hub_task_id: "f0a82e4e-8074-4a22-b1e9-f01ec0ff76a1" state_hub_task_id: "f0a82e4e-8074-4a22-b1e9-f01ec0ff76a1"
``` ```
@ -154,6 +165,11 @@ rollout, and reversal before continuing.
Done when all railiance01 consumers use the local private service and no Done when all railiance01 consumers use the local private service and no
runtime dependency requires the CoulombCore API. runtime dependency requires the CoulombCore API.
2026-08-03: Wave 1 (`reuse`) moved to
`http://openbao.openbao.svc:8200`. The ClusterSecretStore remained Valid, a
forced ExternalSecret refresh completed as SecretSynced/Ready, and the
declarative owner change was committed in `railiance-platform@33b36e8`.
## T06 - Cut over public OpenBao DNS and operator access ## T06 - Cut over public OpenBao DNS and operator access
```task ```task