coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retract the public OpenBao Ingress after exact operator confirm.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Delete only openbao/openbao-ui-gateway. Private ClusterIP gateway and
named tunnel stay healthy; public hostname returns 404. DNS withdrawal
is handed to railiance-infra.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 02:36:25 +02:00
parent 28424a615d
commit f3668f4f0a
4 changed files with 31 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/RPF-WP-0025-openbao-operator-only-access.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Retract public OpenBao listener behind operator-only access"
domain: financials
repo: railiance-platform
status: blocked
status: active
flavor: implementation
owner: codex
topic_slug: railiance
@ -55,7 +55,7 @@ It deletes only the Ingress and provides an exact rollback path.
```task
id: RPF-WP-0025-T03
status: wait
status: progress
priority: high
state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"
```
@ -143,7 +143,12 @@ OIDC callback, not the UI loopback origin. T03 still needs one MFA login at
Operator reported 2026-09-15 loopback UI MFA at `http://127.0.0.1:18200`
succeeded (boolean only; no token or screenshot). Named tunnel remains
lifecycle-healthy and public Ingress is still present. Guarded retraction is
the next hold: it requires the exact confirm phrase
`RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER`. Do not treat the UI
login "yes" as that phrase.
lifecycle-healthy. Guarded retraction ran after the exact confirm phrase
`RETRACT RMASTER-WP-0020-T09 PUBLIC OPENBAO LISTENER`. Ingress
`openbao/openbao-ui-gateway` is absent; ClusterIP gateway 1/1 Ready; named
tunnel healthy; private presets HTTP 200; public `https://bao.coulomb.social/`
HTTP 404. Evidence:
`docs/evidence/2026-09-15-openbao-public-listener-retract.json`.
Remaining T03: public DNS withdrawal with railiance-infra and non-secret
acceptance to Railiance Master. Rollback phrase remains available during the
observation window.