feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4

helm/openbao-public-ingress.rollback.yaml

@@ -0,0 +1,33 @@
+# Rollback-only public listener for an attended RMASTER-WP-0020-T09 reversal.
+# This file is never applied by the ordinary platform deployment path.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: openbao-ui-gateway
+  namespace: openbao
+  labels:
+    app.kubernetes.io/name: openbao-ui-gateway
+    app.kubernetes.io/part-of: railiance-platform
+    railiance-platform/component: secrets
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: >-
+      openbao-openbao-rate-limit@kubernetescrd,
+      openbao-openbao-hsts@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - secretName: bao-tls
+      hosts:
+        - bao.coulomb.social
+  rules:
+    - host: bao.coulomb.social
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: openbao-ui-gateway
+                port:
+                  number: 8080

helm/openbao-ui-overlay-k8s.yaml

@@ -1,6 +1,6 @@
 # OpenBao browser UI gateway — injects the KeyCape login overlay and proxies
-# to the OpenBao service. Public ingress for bao.coulomb.social targets this
-# gateway instead of the chart-managed OpenBao ingress.
+# to the OpenBao service. The gateway is ClusterIP-only and is reached through
+# the named openbao-ui-railiance01 operator tunnel.
 #
 # ConfigMap data is applied by scripts/openbao-ui-overlay-apply.sh from
 # helm/openbao-ui-overlay/*.
@@ -87,35 +87,3 @@ spec:
       port: 8080
       targetPort: http
       protocol: TCP
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: openbao-ui-gateway
-  namespace: openbao
-  labels:
-    app.kubernetes.io/name: openbao-ui-gateway
-    app.kubernetes.io/part-of: railiance-platform
-    railiance-platform/component: secrets
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    traefik.ingress.kubernetes.io/router.middlewares: >-
-      openbao-openbao-rate-limit@kubernetescrd,
-      openbao-openbao-hsts@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-    - secretName: bao-tls
-      hosts:
-        - bao.coulomb.social
-  rules:
-    - host: bao.coulomb.social
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: openbao-ui-gateway
-                port:
-                  number: 8080

helm/openbao-ui-overlay/README.md

@@ -1,8 +1,9 @@
 # OpenBao KeyCape login overlay
 
-Streamlines the browser login mask at `https://bao.coulomb.social` to a single
-**Sign in with KeyCape** action. Namespace, auth method, mount path, and role
-are preset in `presets.json` and hidden by `overlay.css` / `overlay.js`.
+Streamlines the browser login mask reached through the named
+`openbao-ui-railiance01` operator tunnel at `http://127.0.0.1:18200` to a
+single **Sign in with KeyCape** action. Namespace, auth method, mount path, and
+role are preset in `presets.json` and hidden by `overlay.css` / `overlay.js`.
 
 ## Mechanism (T01 decision)
 
@@ -54,9 +55,9 @@ make openbao-verify-login-overlay
 3. Fetch live UI assets and compare hashes:
 
    ```bash
-   curl -sS https://bao.coulomb.social/ui/ -o /tmp/index.html
+   curl -sS http://127.0.0.1:18200/ui/ -o /tmp/index.html
    # locate vault-*.js path in /tmp/index.html, then:
-   curl -sS "https://bao.coulomb.social/ui/assets/vault-....js" -o /tmp/vault.js
+   curl -sS "http://127.0.0.1:18200/ui/assets/vault-....js" -o /tmp/vault.js
    sha256sum /tmp/index.html /tmp/vault.js
    ```
 
@@ -64,6 +65,9 @@ make openbao-verify-login-overlay
    `overlay.css` / `overlay.js` selectors against the new Ember templates.
 5. Write `patches/<new-version>/manifest.sha256`, update `VERSION`.
 6. Run `make openbao-verify-login-overlay CHECK_UPSTREAM_DRIFT=1`.
-7. Attended browser login through KeyCape MFA.
+7. Attended browser login through KeyCape MFA. The OpenBao role and KeyCape
+   client must both allow the exact loopback callback
+   `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` before the
+   former public listener is retracted.
 
-Workplan: `helix-forge/workplans/HF-WP-0003-openbao-keycape-login-overlay.md`
+Workplan: `helix-forge/workplans/HF-WP-0003-openbao-keycape-login-overlay.md`

helm/openbao-ui-overlay/patches/2.5.4/manifest.sha256

@@ -1,8 +1,8 @@
 # OpenBao UI asset fingerprints for image tag 2.5.4.
 # Regenerate after an OpenBao image bump when login markup drifts.
 # Compare vault.js only — index.html is intentionally modified by the gateway.
-#   curl -sS https://bao.coulomb.social/ui/ -o /tmp/index.html
+#   curl -sS http://127.0.0.1:18200/ui/ -o /tmp/index.html
 #   vault_path=$(rg -o '/ui/assets/vault-[a-f0-9]+\\.js' /tmp/index.html | head -1)
-#   curl -sS "https://bao.coulomb.social${vault_path}" -o /tmp/vault.js
+#   curl -sS "http://127.0.0.1:18200${vault_path}" -o /tmp/vault.js
 #   sha256sum /tmp/vault.js
-f0214b5be89377395f8d6521c34139877529bd95ba703901c78b527ab0f1c231  ui/assets/vault-bae6b876038fbf475728f993b5a62002.js
+f0214b5be89377395f8d6521c34139877529bd95ba703901c78b527ab0f1c231  ui/assets/vault-bae6b876038fbf475728f993b5a62002.js