From 3727f8bc7a7fd8fa7ffd6befd90dacb64e6d4406 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 28 Oct 2026 00:08:52 +0100 Subject: [PATCH] RPF-WP-0064-T10: SSO-down walk checks the live break-glass listener (200 on 8210, 405 on 8200) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- ...F-WP-0064-isolated-original-openbao-restore.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md index d07c189..73b0bf4 100644 --- a/workplans/RPF-WP-0064-isolated-original-openbao-restore.md +++ b/workplans/RPF-WP-0064-isolated-original-openbao-restore.md @@ -769,7 +769,8 @@ evidence: paste the same lines. The receipt stays outside Git (mode 0400). ### Founder runbook: production SSO-down walk (read-only) The walk uses the static-key `k3s-api-railiance01` tunnel and the admin kubeconfig. Local port 18200 is taken by -a tunnel, so the port-forward uses 18210. There is no unseal, no generate-root attempt and no token on +a tunnel, so the port-forward maps the break-glass listener 8210 to 18210 and the main listener 8200 to 18201 +(RAPP-OPENBAO-WP-0003, live since 2026-10-28). There is no unseal, no generate-root attempt and no token on production. ```bash @@ -778,12 +779,14 @@ export KUBECONFIG=~/.kube/config-railiance01 kubectl -n openbao get pod openbao-0 -o wide kubectl -n openbao exec openbao-0 -- bao status -format=json \ | jq '{initialized, sealed, t, n, version, ha_enabled}' # exit 2 only means sealed -kubectl -n openbao port-forward pod/openbao-0 18210:8200 >/dev/null 2>&1 & PF=$!; sleep 3 -curl -sS http://127.0.0.1:18210/v1/sys/seal-status | jq '{initialized, sealed, t, n}' -curl -sS -o /dev/null -w 'generate-root status GET: %{http_code}\n' \ - http://127.0.0.1:18210/v1/sys/generate-root/attempt # 405 = unauthenticated generate-root disabled +kubectl -n openbao port-forward pod/openbao-0 18210:8210 18201:8200 >/dev/null 2>&1 & PF=$!; sleep 3 +curl -sS http://127.0.0.1:18201/v1/sys/seal-status | jq '{initialized, sealed, t, n}' +curl -sS -o /dev/null -w 'break-glass listener generate-root status GET: %{http_code}\n' \ + http://127.0.0.1:18210/v1/sys/generate-root/attempt # expect 200: ceremony available +curl -sS -o /dev/null -w 'main listener generate-root status GET: %{http_code}\n' \ + http://127.0.0.1:18201/v1/sys/generate-root/attempt # expect 405: refused without a token kill "$PF"; unset KUBECONFIG ``` -**Paste back** the pod line, the two `jq` outputs and the `generate-root status GET` code. Record them in the +**Paste back** the pod line, the two `jq` outputs and both `generate-root status GET` codes. Record them in the NK-WP-0055-T13 post-event review record. The GET only reads status and starts nothing.