209 lines
7.9 KiB
Markdown
209 lines
7.9 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0020
|
|
type: workplan
|
|
title: "Migrate authoritative OpenBao from CoulombCore to reef-railiance"
|
|
domain: financials
|
|
repo: railiance-master
|
|
status: active
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-30"
|
|
updated: "2026-08-03"
|
|
depends_on:
|
|
- NK-WP-0022
|
|
state_hub_workstream_id: "0616a297-18c5-4c4e-a4fc-69135b3f9a15"
|
|
---
|
|
|
|
# RAILIANCE-WP-0020 - OpenBao migration to reef-railiance
|
|
|
|
Move the authoritative OpenBao runtime from CoulombCore to the default
|
|
`rail-kubernetes` platform path on `reef-railiance`, preserving every secret,
|
|
policy, auth method, identity, lease-relevant contract, audit record, and
|
|
recovery capability. This is a stateful security control plane and must never
|
|
run on scale-to-zero Knative.
|
|
|
|
## Current-state review
|
|
|
|
- `bao.coulomb.social` resolves to CoulombCore (`92.205.130.254`).
|
|
- CoulombCore runs initialized, unsealed OpenBao 2.5.4 with integrated Raft,
|
|
5 GiB data PVC, 2 GiB audit PVC, and the public UI gateway.
|
|
- Every railiance01 ClusterSecretStore currently uses
|
|
`https://bao.coulomb.social`.
|
|
- railiance01 has an OpenBao 2.5.3 StatefulSet with local Raft PVCs, but it is
|
|
uninitialized, sealed, has no ingress, and serves no consumers.
|
|
- Cross-cluster ESO access currently uses transitional AppRoles. Once OpenBao
|
|
is local, same-cluster Kubernetes authentication is the preferred steady
|
|
state.
|
|
- The reef is a single node. Migration improves topology consolidation but
|
|
does not create infrastructure high availability; backup and rollback are
|
|
mandatory.
|
|
|
|
## T01 - Inventory authoritative state and consumer contracts
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "0d40e879-ae4e-45de-aa31-81bf110924dc"
|
|
```
|
|
|
|
Capture non-secret inventories of mounts, auth methods, policies, roles,
|
|
entities, aliases, audit devices, Raft peers, versions, storage, ingress,
|
|
ClusterSecretStores, ExternalSecrets, direct clients, automation scripts, and
|
|
backup jobs. Record counts and fingerprints without secret values. Identify
|
|
all consumers that bypass ESO or depend on the public address.
|
|
|
|
Done when source, empty target, and every consumer have a machine-readable
|
|
dependency map plus explicit rollback owners.
|
|
|
|
Completed 2026-08-03. The non-secret source, target, and consumer dependency
|
|
map is recorded in
|
|
`docs/evidence/openbao-migration-inventory-2026-08-03.json`. It includes six
|
|
ClusterSecretStores, nine ExternalSecrets, state/auth counts, storage and
|
|
version topology, and rollback ownership without secret values.
|
|
|
|
## T02 - Ratify migration, seal, and custody design
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "c266dce7-7d89-454a-a299-48fc169efea1"
|
|
```
|
|
|
|
Choose and document a supported Raft snapshot migration procedure; align target
|
|
OpenBao version before restore. Define unseal/recovery-key custody, TLS and DNS
|
|
continuity, audit retention, target PVC handling, service identity, backup
|
|
encryption, operator access, and emergency rollback. Use ops-mason for any new
|
|
credential, policy, AppRole, or Kubernetes-auth construction plan and retain
|
|
its executive approval gate.
|
|
|
|
Done when the procedure has preconditions, abort points, rollback commands,
|
|
RTO/RPO, and no secret material in Git or State Hub.
|
|
|
|
Completed 2026-08-03. The ratified procedure, custody boundary, consumer
|
|
waves, abort points, rollback, retention, RTO, and RPO are documented in
|
|
`docs/openbao-coulombcore-to-railiance01-runbook.md`. The empty target release
|
|
was aligned to OpenBao 2.5.4, matching the source.
|
|
|
|
## T03 - Prove backup and isolated restore before cutover
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "88671108-cf8c-4de6-b1ce-06e99b1c3d70"
|
|
```
|
|
|
|
Take an encrypted authoritative Raft snapshot and matching configuration/audit
|
|
evidence through approved custody. Restore it into an isolated non-serving
|
|
instance at the target version. Verify inventory counts, representative
|
|
exact-path reads, sibling denial, auth-method metadata, audit continuity, and
|
|
restart/unseal behavior.
|
|
|
|
Done when restore evidence is machine-readable and rollback does not depend on
|
|
the live source remaining healthy.
|
|
|
|
2026-08-03: Created a fresh authoritative snapshot, encrypted it before
|
|
offsite upload, removed plaintext staging, and recorded only fingerprints.
|
|
A second fresh snapshot restored successfully into an isolated OpenBao 2.5.4
|
|
pod on railiance01. The restored instance correctly resealed under the source
|
|
Shamir barrier. The remaining semantic and repeated restart/unseal proof needs
|
|
two of the three existing source shares through the attended custody ceremony;
|
|
no supported automated custody route exposes those shares.
|
|
|
|
## T04 - Restore authoritative state on railiance01
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "d04d7fdd-bd00-407a-8954-101b680ed327"
|
|
```
|
|
|
|
Freeze administrative writes for a bounded window, take the final snapshot,
|
|
replace the empty target state through the ratified procedure, restore
|
|
configuration and audit continuity, and bring the target up privately. Do not
|
|
change public DNS or consumers yet.
|
|
|
|
Done when target semantic probes match the source and repeated restart/unseal
|
|
tests pass through a private endpoint.
|
|
|
|
## T05 - Migrate consumers to local workload identity
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T05
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "f0a82e4e-8074-4a22-b1e9-f01ec0ff76a1"
|
|
```
|
|
|
|
Move ClusterSecretStores and other railiance01 clients in bounded waves.
|
|
Replace transitional cross-cluster AppRoles with namespace-restricted
|
|
same-cluster Kubernetes-auth roles where supported. For each wave prove
|
|
ExternalSecret readiness, exact-path access, sibling denial, rotation, workload
|
|
rollout, and reversal before continuing.
|
|
|
|
Done when all railiance01 consumers use the local private service and no
|
|
runtime dependency requires the CoulombCore API.
|
|
|
|
## T06 - Cut over public OpenBao DNS and operator access
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T06
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "f458d110-5fdd-465a-8a23-4ada1051fb12"
|
|
```
|
|
|
|
After T03-T05, move `bao.coulomb.social` to railiance01 with TLS continuity.
|
|
Verify status, UI gateway, OIDC/operator login, scoped automation, audit
|
|
delivery, backup, revocation, rotation, and negative access through normal DNS.
|
|
Keep the source sealed or write-frozen and immediately recoverable.
|
|
|
|
Done when the observation window passes without source traffic or divergence.
|
|
|
|
## T07 - Retire CoulombCore OpenBao reversibly
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T07
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "db2443e6-bad7-4a71-b45f-d4b81099df15"
|
|
```
|
|
|
|
Scale the CoulombCore OpenBao and UI gateway to zero after successful cutover.
|
|
Retain manifests, encrypted final snapshot, PVCs, Secrets, TLS material, and
|
|
documented rollback for at least 30 days. Confirm no DNS, monitor, client,
|
|
tunnel, catalog entry, or automation still targets the old runtime.
|
|
|
|
Done when CoulombCore serves no OpenBao traffic and rollback remains tested.
|
|
|
|
## T08 - Final cleanup and closure
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0020-T08
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "1dc50d98-64e8-4755-a52e-2b94b765019e"
|
|
```
|
|
|
|
After retention expiry, a successful railiance01 disaster-recovery drill, and
|
|
new explicit approval for destructive deletion, remove stale CoulombCore
|
|
OpenBao resources and transitional AppRole/bootstrap material. Update topology,
|
|
runbooks, routing catalog, State Hub, and the CoulombCore retirement plan.
|
|
|
|
Done when reef-railiance is the sole authoritative OpenBao location and all
|
|
source-backed records agree.
|
|
|
|
## Safety constraints
|
|
|
|
- Never initialize or overwrite either OpenBao instance without verified
|
|
snapshot and rollback evidence.
|
|
- Never print, export, compare, or log secret values; use counts, names,
|
|
capabilities, and cryptographic fingerprints where appropriate.
|
|
- Do not switch DNS before private target restore and consumer waves pass.
|
|
- Do not revoke transitional access until the replacement path and reversal
|
|
are proven.
|
|
- Final PVC, Secret, Raft, recovery-key, or audit deletion requires separate
|
|
explicit approval after the retention window.
|