# OpenBao public-listener transition

Status: source implementation complete; live retraction held.

This is the S3-owner procedure for `RMASTER-WP-0020-T09`. It preserves the
OpenBao Deployment, the `openbao-ui-gateway` Deployment, and its ClusterIP
Service while removing the public `bao.coulomb.social` Ingress.

## Target access

- Exposure posture: `operator`
- Named tunnel: `openbao-ui-railiance01`
- Local UI: `http://127.0.0.1:18200`
- Cluster target: `openbao/openbao-ui-gateway:8080`
- Public Ingress: absent after the transition

The tunnel is an ops-bridge local forward to the current ClusterIP and does not
open a node port. If the Service is recreated with a new ClusterIP, update and
revalidate the tunnel before use.

Browser OIDC derives its callback from the local origin. Before retraction,
both the KeyCape `openbao-admin` client and OpenBao
`auth/netkingdom/role/platform-admin` must allow exactly:

```text
http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
```

Record only a value-safe attended-login result. Do not record the authorization
code, token, accessor, callback query, browser storage, or screenshots.

## Guarded sequence

```bash
make openbao-public-listener-dry-run
make openbao-public-listener-status
```

The status command deliberately fails if ops-bridge does not report the named
tunnel as lifecycle-healthy, even when an orphan forward still answers. Repair
that state before proceeding.

After KeyCape/OpenBao callback configuration and one attended MFA login through
the local URL, use the exact hold point:

```bash
OPENBAO_OPERATOR_LOGIN_VERIFIED=true \
OPENBAO_PUBLIC_LISTENER_CONFIRM='RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER' \
make openbao-public-listener-retract
```

The command pins the railiance01 cluster UID, rechecks the ClusterIP gateway and
tunnel, deletes only `openbao/openbao-ui-gateway` Ingress, then proves the
private path remains healthy and the public name no longer returns a successful
HTTP status.

## Rollback

During the bounded observation window:

```bash
OPENBAO_PUBLIC_LISTENER_CONFIRM='ROLLBACK RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER' \
make openbao-public-listener-rollback
```

Rollback reapplies only the retained Traefik middleware and the explicitly
named rollback Ingress. It does not mutate OpenBao policy, Raft, PVCs, Secrets,
or the CoulombCore retention state.
