coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retire CoulombCore OpenBao reversibly

Browse source
This commit is contained in:
codex 2026-08-04 00:19:26 +02:00
parent 99ca9df6c2
commit f1839a9d95
2 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -42,6 +42,6 @@
| task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T04 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T04 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T05 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T05 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T06 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T06 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T07 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T07 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md | | task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |

25
workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
View file

@ -182,7 +182,7 @@ same-cluster Kubernetes identity conversion remains post-cutover hardening.
```task ```task
id: RAILIANCE-WP-0020-T06 id: RAILIANCE-WP-0020-T06
status: progress status: done
priority: high priority: high
state_hub_task_id: "f458d110-5fdd-465a-8a23-4ada1051fb12" state_hub_task_id: "f458d110-5fdd-465a-8a23-4ada1051fb12"
``` ```
@ -201,11 +201,19 @@ to CoulombCore. No automated DNS credential route exists; change the A record
to `92.205.62.239`, then verify certificate, UI/OIDC, API, audit, backup, and to `92.205.62.239`, then verify certificate, UI/OIDC, API, audit, backup, and
negative access before retiring the source. negative access before retiring the source.
Completed 2026-08-03. All authoritative and sampled public resolvers converged
on `92.205.62.239`. The rapp-openbao gateway serves HTTP 200 for UI and health
with a valid cert-manager-owned Let's Encrypt certificate. The target remains
active/unsealed with the preserved cluster ID; its audit file is growing and
all six stores plus nine ExternalSecrets remain Ready. The source OIDC
initiation behavior was compared directly and no target-only regression was
found.
## T07 - Retire CoulombCore OpenBao reversibly ## T07 - Retire CoulombCore OpenBao reversibly
```task ```task
id: RAILIANCE-WP-0020-T07 id: RAILIANCE-WP-0020-T07
status: wait status: done
priority: high priority: high
state_hub_task_id: "db2443e6-bad7-4a71-b45f-d4b81099df15" state_hub_task_id: "db2443e6-bad7-4a71-b45f-d4b81099df15"
``` ```
@ -217,6 +225,14 @@ tunnel, catalog entry, or automation still targets the old runtime.
Done when CoulombCore serves no OpenBao traffic and rollback remains tested. Done when CoulombCore serves no OpenBao traffic and rollback remains tested.
Completed 2026-08-03. After more than one DNS TTL and multi-resolver
convergence, the old gateway showed only its Kubernetes readiness probes and
no external traffic. CoulombCore StatefulSet `openbao` and Deployment
`openbao-ui-gateway` were scaled to zero and their pods terminated. Data and
audit PVCs, Services, Ingress, TLS and Helm Secrets, manifests, rotated unseal
custody, and encrypted final snapshot remain retained for rollback. A
post-retirement public probe returned HTTP 200 from railiance01 with valid TLS.
## T08 - Final cleanup and closure ## T08 - Final cleanup and closure
```task ```task
@ -234,6 +250,11 @@ runbooks, routing catalog, State Hub, and the CoulombCore retirement plan.
Done when reef-railiance is the sole authoritative OpenBao location and all Done when reef-railiance is the sole authoritative OpenBao location and all
source-backed records agree. source-backed records agree.
Retention gate opened 2026-08-03. Do not delete the retained CoulombCore PVCs,
Secrets, Helm records, Ingress, or Services before 2026-09-02. Final deletion
also requires a successful railiance01 disaster-recovery drill and fresh
explicit destructive-cleanup approval.
## Safety constraints ## Safety constraints
- Never initialize or overwrite either OpenBao instance without verified - Never initialize or overwrite either OpenBao instance without verified