diff --git a/Makefile b/Makefile index a316076..70f091e 100644 --- a/Makefile +++ b/Makefile @@ -199,24 +199,23 @@ openbao-dry-run: openbao-repo ## Render the OpenBao Helm release without applyin -f $(OPENBAO_VALUES) \ --dry-run -openbao-overlay-apply: ## Apply KeyCape login overlay gateway and assets - OPENBAO_UI_OVERLAY_DIR=$(OPENBAO_UI_OVERLAY_DIR) \ - OPENBAO_UI_OVERLAY_K8S=$(OPENBAO_UI_OVERLAY_K8S) \ - KUBECTL='$(KUBECTL)' OPENBAO_NAMESPACE=$(OPENBAO_NAMESPACE) \ - scripts/openbao-ui-overlay-apply.sh +# The OpenBao package (Helm values, UI overlay, gateway) is owned by +# rapp-openbao. The copies here are retained for reference only; two deployable +# copies drifted apart and one deploy undid the other's changes (RPF-WP-0057). +# These targets refuse. +RAPP_OPENBAO_REFUSAL = echo '$@ is owned by rapp-openbao; the copy in railiance-platform is retained only and must not be applied.' >&2; \ + echo 'Run it from the canonical repo instead: cd ~/rapp-openbao && make $@' >&2; \ + echo 'See docs/rapp-openbao-compatibility-handoff.md.' >&2; exit 2 + +openbao-overlay-apply: ## Refuses: the overlay is applied from rapp-openbao + @$(RAPP_OPENBAO_REFUSAL) openbao-verify-login-overlay: ## Verify public KeyCape login overlay is active OPENBAO_UI_OVERLAY_DIR=$(OPENBAO_UI_OVERLAY_DIR) \ scripts/openbao-verify-login-overlay.sh $(OPENBAO_VERIFY_LOGIN_OVERLAY_ARGS) -openbao-deploy: openbao-repo ## Deploy / upgrade OpenBao to the openbao namespace - $(KUBECTL) create namespace $(OPENBAO_NAMESPACE) --dry-run=client -o yaml | $(KUBECTL) apply -f - - $(HELM) upgrade --install $(OPENBAO_RELEASE) openbao/openbao \ - --version $(OPENBAO_CHART_VERSION) \ - --namespace $(OPENBAO_NAMESPACE) \ - -f $(OPENBAO_VALUES) \ - --wait --timeout 5m - $(MAKE) openbao-overlay-apply +openbao-deploy: ## Refuses: OpenBao is deployed from rapp-openbao + @$(RAPP_OPENBAO_REFUSAL) .PHONY: openbao-public-listener-dry-run openbao-public-listener-status openbao-public-listener-retract openbao-public-listener-rollback diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 2dcbab6..1f20b34 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -179,6 +179,7 @@ | task | RPF-WP-0057-T02 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | task | RPF-WP-0057-T03 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | task | RPF-WP-0057-T04 | progress | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| task | RPF-WP-0057-T05 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | | task | RPF-WP-0058-T01 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | task | RPF-WP-0058-T03 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | diff --git a/assurance/ownership-handoffs.json b/assurance/ownership-handoffs.json index c4f9d77..0319cd8 100644 --- a/assurance/ownership-handoffs.json +++ b/assurance/ownership-handoffs.json @@ -54,11 +54,11 @@ }, { "path": "scripts/openbao-verify-login-overlay.sh", - "sha256": "57438714f1b7aac0c37b8bdf525c5387f812a6d30532bb98b395e5db5208ad6d" + "sha256": "44435af01da60f08228a07d547a5dc8941f848eaf2a1baf9b79a83845b6defdc" }, { "path": "docs/rapp-openbao-compatibility-handoff.md", - "sha256": "65ff0b39ee7312c8a242d24cf3434f9d0636a830e841f1a70de560c96cd8d57f" + "sha256": "415f08f111b98ebb4a0cdd3906acf915a0f1c9854bd364d078aac151dd9d354f" } ], "acceptance": "Owner names canonical replacements; update all callers and prove dry-run/smoke and rollback before source removal. No external acceptance asserted." diff --git a/docs/openbao.md b/docs/openbao.md index 68ad343..f72c0aa 100644 --- a/docs/openbao.md +++ b/docs/openbao.md @@ -55,9 +55,14 @@ Platform operators with approved admin identity The official OpenBao project recommends the Helm chart for Kubernetes deployments and warns to run Helm with `--dry-run` before install or upgrade. -From a host with kubeconfig access: +The OpenBao package is deployed from `rapp-openbao`, its canonical owner. +In this repo `make openbao-deploy` and `make openbao-overlay-apply` refuse, +because the retained copies here have fallen behind (see +`docs/rapp-openbao-compatibility-handoff.md`). From a host with operator +kubeconfig access: ```bash +cd ~/rapp-openbao make openbao-dry-run make openbao-deploy make openbao-status @@ -72,7 +77,7 @@ retraction and rollback are separate guarded commands documented in On Railiance01 directly: ```bash -cd ~/railiance-platform +cd ~/rapp-openbao sudo env KUBECONFIG=/etc/rancher/k3s/k3s.yaml make openbao-dry-run sudo env KUBECONFIG=/etc/rancher/k3s/k3s.yaml make openbao-deploy sudo env KUBECONFIG=/etc/rancher/k3s/k3s.yaml make openbao-status @@ -607,9 +612,11 @@ mount path: netkingdom role: platform-admin ``` -Deploy or refresh the overlay: +Deploy or refresh the overlay from `rapp-openbao`; the copy here is retained +only: ```bash +cd ~/rapp-openbao make openbao-overlay-apply make openbao-verify-login-overlay make openbao-verify-login-overlay OPENBAO_VERIFY_LOGIN_OVERLAY_ARGS=--check-upstream-drift @@ -866,7 +873,7 @@ existing env/file reference contract. 2. Update `OPENBAO_CHART_VERSION` in `Makefile`. 3. Run `make openbao-dry-run`. 4. Confirm current backup and audit log posture. -5. Run `make openbao-deploy`. +5. Run `make openbao-deploy` from `rapp-openbao`. 6. Run `make openbao-status`. For rollback, run `helm rollback openbao -n openbao` on Railiance01 diff --git a/docs/rapp-openbao-compatibility-handoff.md b/docs/rapp-openbao-compatibility-handoff.md index e7a04f8..d6d4e0d 100644 --- a/docs/rapp-openbao-compatibility-handoff.md +++ b/docs/rapp-openbao-compatibility-handoff.md @@ -52,6 +52,16 @@ If package-owned behavior changes: operators or automation still depend on it; and 3. avoid evolving the platform copy independently. +Since 2026-11-03 the write targets `openbao-deploy` and +`openbao-overlay-apply` in `railiance-platform` refuse and point to +`rapp-openbao`. Two changes had landed only in the platform copy: the +RPF-WP-0057 workload-role login choice and the RPF-WP-0063 gateway CPU +request. Meanwhile the package copy gained the RAPP-OPENBAO-WP-0003 +break-glass listener. A package deploy then reverted the live UI, and a +platform deploy would have removed the listener. Both changes are now in +`rapp-openbao` (RAPP-OPENBAO-WP-ADHOC-2026-11-03). Read-only targets, such as +`openbao-verify-login-overlay`, still run here. + ## What Stays In `railiance-platform` The handoff does not expand the package boundary. diff --git a/helm/openbao-ui-overlay/README.md b/helm/openbao-ui-overlay/README.md index a645611..b0584ed 100644 --- a/helm/openbao-ui-overlay/README.md +++ b/helm/openbao-ui-overlay/README.md @@ -1,5 +1,11 @@ # OpenBao KeyCape login overlay +> **Retained copy.** The canonical overlay is in `rapp-openbao` +> (`helm/openbao-ui-overlay/`). Change it there first. This repo's +> `make openbao-overlay-apply` and `make openbao-deploy` refuse. Two +> deployable copies drifted apart, and on 2026-10-27 a deploy of the other +> copy removed this one's workload-role choice from the live UI (RPF-WP-0057). + Streamlines the browser login mask reached through the named `openbao-ui-railiance01` operator tunnel at `http://127.0.0.1:18200` to a single **Sign in with KeyCape** action. Namespace, auth method, mount path, and @@ -47,7 +53,7 @@ behaviour. ## Deploy -From `railiance-platform`: +From `rapp-openbao` (the targets here refuse): ```bash make openbao-overlay-apply # overlay only diff --git a/layer.yaml b/layer.yaml index 4e45f87..37dea71 100644 --- a/layer.yaml +++ b/layer.yaml @@ -111,7 +111,7 @@ tooling_contacts: - id: openbao-service-operation shape: "5.3" - module: Makefile (openbao-deploy, openbao-overlay-apply), helm/openbao-values.yaml + module: rapp-openbao Makefile (openbao-deploy, openbao-overlay-apply), rapp-openbao helm/openbao-values.yaml; the railiance-platform targets refuse tooling: OpenBao operation: "helm upgrade of the OpenBao release; unseal and snapshot procedures" write: true diff --git a/tests/test_openbao_retained_guard.py b/tests/test_openbao_retained_guard.py new file mode 100644 index 0000000..6099a9e --- /dev/null +++ b/tests/test_openbao_retained_guard.py @@ -0,0 +1,34 @@ +"""The retained OpenBao package copy must not be applied from this repo. + +rapp-openbao owns the package. Two deployable copies drifted apart, and a +deploy of one undid the other's changes (RPF-WP-0057). The write targets here +refuse before running kubectl or helm. +""" +import os +import pathlib +import subprocess + +import pytest + +ROOT = pathlib.Path(__file__).resolve().parents[1] + + +@pytest.mark.parametrize("target", ["openbao-overlay-apply", "openbao-deploy"]) +def test_write_target_refuses_without_touching_cluster(target, tmp_path): + marker = tmp_path / "called" + fake = tmp_path / "fake" + fake.write_text(f"#!/bin/sh\ntouch {marker}\n") + fake.chmod(0o755) + env = dict(os.environ, KUBECTL_BIN=str(fake), HELM=str(fake), KUBECONFIG=str(tmp_path / "none")) + result = subprocess.run(["make", "-s", target], cwd=ROOT, env=env, capture_output=True, text=True) + assert result.returncode != 0 + assert "owned by rapp-openbao" in result.stderr + assert f"cd ~/rapp-openbao && make {target}" in result.stderr + assert not marker.exists() + + +def test_dry_run_and_prerequisites_do_not_reach_the_write_path(): + text = (ROOT / "Makefile").read_text() + for target in ("openbao-overlay-apply", "openbao-deploy"): + line = next(l for l in text.splitlines() if l.startswith(target + ":")) + assert line.split(":", 1)[1].split("##")[0].strip() == "", line diff --git a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md index f0ab891..7c91153 100644 --- a/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md +++ b/workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md @@ -123,3 +123,33 @@ the older copy. The change is now ported there (`rapp-openbao` `32d6e92`, RAPP-OPENBAO-WP-ADHOC-2026-11-03). Future overlay changes must land in `rapp-openbao` first. T04 still needs the overlay applied from `rapp-openbao`, a passing verifier, and the attended clickthrough of both role controls. + +2026-11-03: the founder applied the overlay from `rapp-openbao` with the +operator kubeconfig. `make openbao-verify-login-overlay` passes again, and the +live login assets match `rapp-openbao`. The attended clickthrough of both role +controls is still open. + +## Stop the retained OpenBao copy from deploying + +```task +id: RPF-WP-0057-T05 +status: done +priority: high +``` + +`make openbao-deploy` and `make openbao-overlay-apply` in this repo now +refuse with exit 2 and point to `cd ~/rapp-openbao && make `; they +call no kubectl or helm. They have no prerequisites, so `openbao-repo` does +not run either. Test: `tests/test_openbao_retained_guard.py`. Each copy had +changes the other lacked: +- here: the 0057 overlay and the RPF-WP-0063 10m gateway CPU request; +- `rapp-openbao`: the RAPP-OPENBAO-WP-0003 break-glass listener. +A deploy from here would therefore have removed the listener. Both +platform-only changes are now ported (`rapp-openbao` `32d6e92`, `004ca55`). The live +gateway is back at 25m until the founder re-applies from `rapp-openbao` +(RAPP-OPENBAO-WP-ADHOC-2026-11-03-T03). `docs/openbao.md`, the overlay README, +`docs/rapp-openbao-compatibility-handoff.md` and `layer.yaml` now name +`rapp-openbao`, and the `openbao-package` pins in +`assurance/ownership-handoffs.json` are refreshed. Read-only targets still run +here. Retained files are not deleted. Automating the attended apply is +deferred by founder decision; the founder deploys.