Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults
- WP-0025-T03 done: public listener retracted 2026-09-15; bao.coulomb.social is retired, tunnel is the operator path; DNS withdrawal handed to S1. - WP-0043-T01 done: ArgoCD Core reconciles railiance01 at main (evidence). - WP-0043-T05 done: direct-apply gap inventory and founder proposal. - WP-0045-T05 cancelled (no rollback needed); T06 preconditions recorded. - Operator scripts default BAO_ADDR to the openbao-ui-railiance01 tunnel. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
This commit is contained in:
codex
parent
8a7ebce5c6
commit
b666301487
11 changed files with 133 additions and 14 deletions
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Retract public OpenBao listener behind operator-only access"
|
||||
domain: financials
|
||||
repo: railiance-platform
|
||||
status: active
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-08-23"
|
||||
updated: "2026-09-15"
|
||||
updated: "2026-09-22"
|
||||
related:
|
||||
- RMASTER-WP-0020-T09
|
||||
- RAPP-OPENBAO-WP-0002
|
||||
|
|
@ -55,7 +55,7 @@ It deletes only the Ingress and provides an exact rollback path.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0025-T03
|
||||
status: progress
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"
|
||||
```
|
||||
|
|
@ -152,3 +152,21 @@ HTTP 404. Evidence:
|
|||
Remaining T03: public DNS withdrawal with railiance-infra and non-secret
|
||||
acceptance to Railiance Master. Rollback phrase remains available during the
|
||||
observation window.
|
||||
|
||||
## Closure — 2026-09-22
|
||||
|
||||
T03 done. The operator-only cutover is complete on the platform side:
|
||||
loopback MFA login passed, and the public Ingress was retracted on 2026-09-15
|
||||
(`docs/evidence/2026-09-15-openbao-public-listener-retract.json`). **Intended
|
||||
end state: `bao.coulomb.social` is retired.** The named tunnel
|
||||
`openbao-ui-railiance01` (`http://127.0.0.1:18200`) is the only operator path,
|
||||
and workloads use `openbao.openbao.svc:8200`. No certificate or route will be
|
||||
restored for the public name. The dangling DNS record (it still resolves to
|
||||
92.205.62.239, where Traefik serves its default certificate and returns 404)
|
||||
was handed to its S1 publisher, railiance-infra, for withdrawal. Non-secret
|
||||
acceptance went to railiance-master for RMASTER-WP-0020-T09, and the end
|
||||
state was sent to user-engine (hub message `e8ccbc2f`). Operator scripts no
|
||||
longer default `BAO_ADDR` to the public name. The one exception is
|
||||
`scripts/audit-core-database-lease-recovery.py`: the WP-0024 owner-review
|
||||
contract pins its digest, so it keeps the old literal until the next owner
|
||||
review.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: planning
|
|||
owner: railiance-platform
|
||||
topic_slug: railiance
|
||||
created: "2026-09-21"
|
||||
updated: "2026-09-21"
|
||||
updated: "2026-09-22"
|
||||
due: "2026-12-21"
|
||||
related: [RPF-WP-0022]
|
||||
state_hub_workstream_id: "ec41a4bd-df18-5b07-9b63-ccb80d9f001c"
|
||||
|
|
@ -43,7 +43,7 @@ stays untouched and unwrapped while this lane moves.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0043-T01
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "d6a7a480-6251-504a-aa5f-ab9c04fe1e79"
|
||||
```
|
||||
|
|
@ -205,7 +205,7 @@ Rollback:
|
|||
|
||||
```task
|
||||
id: RPF-WP-0043-T05
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "91431560-79d4-5352-a6b5-f12850315dd2"
|
||||
```
|
||||
|
|
@ -218,3 +218,16 @@ evidence only. Inventory those targets, declare the gap as not conforming,
|
|||
and propose to the founder which ones move to a reconciled lane and which
|
||||
stay direct under `APPROVED`. Do not change a target's behaviour as part of
|
||||
the inventory.
|
||||
|
||||
## Execution record — 2026-09-22
|
||||
|
||||
- **T01 done.** Read-only check over `ssh railiance01`. Node 92.205.62.239 is
|
||||
Ready. Argo CD Core runs 1/1 in `argocd`. `railiance-apps-root` is
|
||||
Synced/Healthy at `8a7ebce`, which equals Forgejo `main`. `openbao-secretstore`
|
||||
and `target-revenue` are Synced/Healthy. Evidence:
|
||||
`docs/evidence/2026-09-22-argocd-railiance01-status.json`. This supersedes
|
||||
the custodian's 2026-09-21 "not installed" reading, which predates the phase A
|
||||
install and the kubeconfig fix. The plan continues.
|
||||
- **T05 done.** Gap declared and inventoried in
|
||||
`docs/direct-apply-gap-inventory.md`, with a per-group proposal for the
|
||||
founder. No target changed.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: implementation
|
|||
owner: railiance-platform
|
||||
topic_slug: railiance
|
||||
created: "2026-09-21"
|
||||
updated: "2026-09-21"
|
||||
updated: "2026-09-22"
|
||||
related: [RPF-WP-0037]
|
||||
state_hub_workstream_id: "0edc6426-9cc8-5bbe-88ea-c27d9862d96e"
|
||||
---
|
||||
|
|
@ -200,7 +200,7 @@ other than the header. The earlier 37-count had 5 failing; expect 0.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0045-T05
|
||||
status: wait
|
||||
status: cancel
|
||||
priority: medium
|
||||
state_hub_task_id: "6bccc229-3428-588a-9488-3fd5d5a07e92"
|
||||
```
|
||||
|
|
@ -277,3 +277,21 @@ and `email-connect/deploy/k8s/railiance/openbao-eso-token-apply.sh`, and update
|
|||
- **T03 done.** SAs created; both stores switched to Kubernetes auth.
|
||||
- **T04 done.** Both stores `Ready=True` ("store validated"); forced refresh; all five ExternalSecrets `SecretSynced` at 17:39Z; **37/37 ExternalSecrets ready cluster-wide.**
|
||||
- **T06** (delete the two dead token Secrets) is due after 24 h of clean syncs, i.e. not before 2026-09-22T17:40Z.
|
||||
|
||||
## Execution record — 2026-09-22
|
||||
|
||||
- **T05 cancelled.** Rollback is not needed. At 20:40Z both stores are
|
||||
`Valid`/Ready on Kubernetes auth, and all five ExternalSecrets synced at
|
||||
20:39Z, more than 24 h after the T04 switch.
|
||||
- **T06 preconditions met, deletion not run.** The no-reference check returned
|
||||
no output: no store references either token Secret. The deletion was blocked
|
||||
by the session's permission guard, so it waits for the founder to run it:
|
||||
`ssh railiance01 'kubectl -n external-secrets delete secret openbao-activity-core-eso-token openbao-email-connect-eso-token'`.
|
||||
The bootstrap-target retirements in activity-core and email-connect were
|
||||
handed to their owners.
|
||||
- **New incident, outside this plan:** `openbao-core-hub-database` and
|
||||
`openbao-tenant-engine-database` (both static-token) have failed
|
||||
`lookup-self` with 403 since about 2026-09-21T22:00Z. Six ExternalSecrets are
|
||||
failing (four in core-hub, two in tenant-engine). This is the failure mode
|
||||
named in the Risks section above. It needs the same Kubernetes-auth
|
||||
migration, with an attended admin login.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue