# OpenBao public-listener transition

Status: source implementation complete; live retraction held.

This is the S3-owner procedure for `RMASTER-WP-0020-T09`. It preserves the
OpenBao Deployment, the `openbao-ui-gateway` Deployment, and its ClusterIP
Service while removing the public `bao.coulomb.social` Ingress.

## Target access

- Exposure posture: `operator`
- Named tunnel: `openbao-ui-railiance01`
- Local UI: `http://127.0.0.1:18200`
- Cluster target: `openbao/openbao-ui-gateway:8080`
- Public Ingress: absent after the transition

The tunnel is an ops-bridge local forward to the current ClusterIP and does not
open a node port. If the Service is recreated with a new ClusterIP, update and
revalidate the tunnel before use.

Browser OIDC derives its callback from the local origin. Before retraction,
both the KeyCape `openbao-admin` client and OpenBao
`auth/netkingdom/role/platform-admin` must allow exactly:

```text
http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback
```

Record only a value-safe attended-login result. Do not record the authorization
code, token, accessor, callback query, browser storage, or screenshots.

KeyCape admission is applied by the Net Kingdom owner procedure. Apply the
OpenBao half through the governed contained login lane; the child command is
silent and Warden self-revokes the attended session:

```bash
warden plan \
  "attended OpenBao platform administration to add the exact operator-tunneled OIDC callback to auth/netkingdom/role/platform-admin" \
  --json
warden access openbao-platform-admin-login --exec -- \
  scripts/openbao-apply-operator-loopback-callback.sh
```

The plan must return `founder_required` and select
`openbao-platform-admin-login`. Do not run the owner command directly with a
persistent token.

## Guarded sequence

```bash
make openbao-public-listener-dry-run
make openbao-public-listener-status
```

The status command deliberately fails if ops-bridge does not report the named
tunnel as lifecycle-healthy, even when an orphan forward still answers. Repair
that state before proceeding.

After KeyCape/OpenBao callback configuration and one attended MFA login through
the local URL, use the exact hold point:

```bash
OPENBAO_OPERATOR_LOGIN_VERIFIED=true \
OPENBAO_PUBLIC_LISTENER_CONFIRM='RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER' \
make openbao-public-listener-retract
```

The command pins the railiance01 cluster UID, rechecks the ClusterIP gateway and
tunnel, deletes only `openbao/openbao-ui-gateway` Ingress, then proves the
private path remains healthy and the public name no longer returns a successful
HTTP status.

## Rollback

During the bounded observation window:

```bash
OPENBAO_PUBLIC_LISTENER_CONFIRM='ROLLBACK RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER' \
make openbao-public-listener-rollback
```

Rollback reapplies only the retained Traefik middleware and the explicitly
named rollback Ingress. It does not mutate OpenBao policy, Raft, PVCs, Secrets,
or the CoulombCore retention state.
