railiance-master/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	depends_on	state_hub_workstream_id
RAILIANCE-WP-0020	workplan	Migrate authoritative OpenBao from CoulombCore to reef-railiance	financials	railiance-master	ready	codex	railiance	2026-07-30	2026-07-30	NK-WP-0022	0616a297-18c5-4c4e-a4fc-69135b3f9a15

RAILIANCE-WP-0020 - OpenBao migration to reef-railiance

Move the authoritative OpenBao runtime from CoulombCore to the default rail-kubernetes platform path on reef-railiance, preserving every secret, policy, auth method, identity, lease-relevant contract, audit record, and recovery capability. This is a stateful security control plane and must never run on scale-to-zero Knative.

Current-state review

• bao.coulomb.social resolves to CoulombCore (92.205.130.254).
• CoulombCore runs initialized, unsealed OpenBao 2.5.4 with integrated Raft, 5 GiB data PVC, 2 GiB audit PVC, and the public UI gateway.
• Every railiance01 ClusterSecretStore currently uses https://bao.coulomb.social.
• railiance01 has an OpenBao 2.5.3 StatefulSet with local Raft PVCs, but it is uninitialized, sealed, has no ingress, and serves no consumers.
• Cross-cluster ESO access currently uses transitional AppRoles. Once OpenBao is local, same-cluster Kubernetes authentication is the preferred steady state.
• The reef is a single node. Migration improves topology consolidation but does not create infrastructure high availability; backup and rollback are mandatory.

T01 - Inventory authoritative state and consumer contracts

id: RAILIANCE-WP-0020-T01
status: todo
priority: high
state_hub_task_id: "0d40e879-ae4e-45de-aa31-81bf110924dc"

Capture non-secret inventories of mounts, auth methods, policies, roles, entities, aliases, audit devices, Raft peers, versions, storage, ingress, ClusterSecretStores, ExternalSecrets, direct clients, automation scripts, and backup jobs. Record counts and fingerprints without secret values. Identify all consumers that bypass ESO or depend on the public address.

Done when source, empty target, and every consumer have a machine-readable dependency map plus explicit rollback owners.

T02 - Ratify migration, seal, and custody design

id: RAILIANCE-WP-0020-T02
status: todo
priority: high
state_hub_task_id: "c266dce7-7d89-454a-a299-48fc169efea1"

Choose and document a supported Raft snapshot migration procedure; align target OpenBao version before restore. Define unseal/recovery-key custody, TLS and DNS continuity, audit retention, target PVC handling, service identity, backup encryption, operator access, and emergency rollback. Use ops-mason for any new credential, policy, AppRole, or Kubernetes-auth construction plan and retain its executive approval gate.

Done when the procedure has preconditions, abort points, rollback commands, RTO/RPO, and no secret material in Git or State Hub.

T03 - Prove backup and isolated restore before cutover

id: RAILIANCE-WP-0020-T03
status: todo
priority: high
state_hub_task_id: "88671108-cf8c-4de6-b1ce-06e99b1c3d70"

Take an encrypted authoritative Raft snapshot and matching configuration/audit evidence through approved custody. Restore it into an isolated non-serving instance at the target version. Verify inventory counts, representative exact-path reads, sibling denial, auth-method metadata, audit continuity, and restart/unseal behavior.

Done when restore evidence is machine-readable and rollback does not depend on the live source remaining healthy.

T04 - Restore authoritative state on railiance01

id: RAILIANCE-WP-0020-T04
status: wait
priority: high
state_hub_task_id: "d04d7fdd-bd00-407a-8954-101b680ed327"

Freeze administrative writes for a bounded window, take the final snapshot, replace the empty target state through the ratified procedure, restore configuration and audit continuity, and bring the target up privately. Do not change public DNS or consumers yet.

Done when target semantic probes match the source and repeated restart/unseal tests pass through a private endpoint.

T05 - Migrate consumers to local workload identity

id: RAILIANCE-WP-0020-T05
status: wait
priority: high
state_hub_task_id: "f0a82e4e-8074-4a22-b1e9-f01ec0ff76a1"

Move ClusterSecretStores and other railiance01 clients in bounded waves. Replace transitional cross-cluster AppRoles with namespace-restricted same-cluster Kubernetes-auth roles where supported. For each wave prove ExternalSecret readiness, exact-path access, sibling denial, rotation, workload rollout, and reversal before continuing.

Done when all railiance01 consumers use the local private service and no runtime dependency requires the CoulombCore API.

T06 - Cut over public OpenBao DNS and operator access

id: RAILIANCE-WP-0020-T06
status: wait
priority: high
state_hub_task_id: "f458d110-5fdd-465a-8a23-4ada1051fb12"

After T03-T05, move bao.coulomb.social to railiance01 with TLS continuity. Verify status, UI gateway, OIDC/operator login, scoped automation, audit delivery, backup, revocation, rotation, and negative access through normal DNS. Keep the source sealed or write-frozen and immediately recoverable.

Done when the observation window passes without source traffic or divergence.

T07 - Retire CoulombCore OpenBao reversibly

id: RAILIANCE-WP-0020-T07
status: wait
priority: high
state_hub_task_id: "db2443e6-bad7-4a71-b45f-d4b81099df15"

Scale the CoulombCore OpenBao and UI gateway to zero after successful cutover. Retain manifests, encrypted final snapshot, PVCs, Secrets, TLS material, and documented rollback for at least 30 days. Confirm no DNS, monitor, client, tunnel, catalog entry, or automation still targets the old runtime.

Done when CoulombCore serves no OpenBao traffic and rollback remains tested.

T08 - Final cleanup and closure

id: RAILIANCE-WP-0020-T08
status: wait
priority: medium
state_hub_task_id: "1dc50d98-64e8-4755-a52e-2b94b765019e"

After retention expiry, a successful railiance01 disaster-recovery drill, and new explicit approval for destructive deletion, remove stale CoulombCore OpenBao resources and transitional AppRole/bootstrap material. Update topology, runbooks, routing catalog, State Hub, and the CoulombCore retirement plan.

Done when reef-railiance is the sole authoritative OpenBao location and all source-backed records agree.

Safety constraints

• Never initialize or overwrite either OpenBao instance without verified snapshot and rollback evidence.
• Never print, export, compare, or log secret values; use counts, names, capabilities, and cryptographic fingerprints where appropriate.
• Do not switch DNS before private target restore and consumer waves pass.
• Do not revoke transitional access until the replacement path and reversal are proven.
• Final PVC, Secret, Raft, recovery-key, or audit deletion requires separate explicit approval after the retention window.