coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064-T10: SSO-down walk checks the live break-glass listener (200 on 8210, 405 on 8200)
All checks were successful
CCR intake gate / gate (push) Successful in 1m10s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
codex 2026-10-28 00:08:52 +01:00
parent a2da4085e0
commit 3727f8bc7a
1 changed files with 9 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/RPF-WP-0064-isolated-original-openbao-restore.md
View file

@ -769,7 +769,8 @@ evidence: paste the same lines. The receipt stays outside Git (mode 0400).
### Founder runbook: production SSO-down walk (read-only)
The walk uses the static-key `k3s-api-railiance01` tunnel and the admin kubeconfig. Local port 18200 is taken by
a tunnel, so the port-forward uses 18210. There is no unseal, no generate-root attempt and no token on
a tunnel, so the port-forward maps the break-glass listener 8210 to 18210 and the main listener 8200 to 18201
(RAPP-OPENBAO-WP-0003, live since 2026-10-28). There is no unseal, no generate-root attempt and no token on
production.
```bash
@ -778,12 +779,14 @@ export KUBECONFIG=~/.kube/config-railiance01
kubectl -n openbao get pod openbao-0 -o wide
kubectl -n openbao exec openbao-0 -- bao status -format=json \
| jq '{initialized, sealed, t, n, version, ha_enabled}' # exit 2 only means sealed
kubectl -n openbao port-forward pod/openbao-0 18210:8200 >/dev/null 2>&1 & PF=$!; sleep 3
curl -sS http://127.0.0.1:18210/v1/sys/seal-status | jq '{initialized, sealed, t, n}'
curl -sS -o /dev/null -w 'generate-root status GET: %{http_code}\n' \
http://127.0.0.1:18210/v1/sys/generate-root/attempt # 405 = unauthenticated generate-root disabled
kubectl -n openbao port-forward pod/openbao-0 18210:8210 18201:8200 >/dev/null 2>&1 & PF=$!; sleep 3
curl -sS http://127.0.0.1:18201/v1/sys/seal-status | jq '{initialized, sealed, t, n}'
curl -sS -o /dev/null -w 'break-glass listener generate-root status GET: %{http_code}\n' \
http://127.0.0.1:18210/v1/sys/generate-root/attempt # expect 200: ceremony available
curl -sS -o /dev/null -w 'main listener generate-root status GET: %{http_code}\n' \
http://127.0.0.1:18201/v1/sys/generate-root/attempt # expect 405: refused without a token
kill "$PF"; unset KUBECONFIG
```
**Paste back** the pod line, the two `jq` outputs and the `generate-root status GET` code. Record them in the
**Paste back** the pod line, the two `jq` outputs and both `generate-root status GET` codes. Record them in the
NK-WP-0055-T13 post-event review record. The GET only reads status and starts nothing.