0cc3281ab3
Networkless disposable Docker target (--network none, read-only, tmpfs only, no volumes/ports/kubeconfig), metadata-only preflight before any prompt, SSH-signed admission in namespace railiance-openbao-restore-attempt, hidden custody prompts with sealed memfds, throwaway init + forced Raft restore from stdin, original-share unseal, generate-root readback credential (revoked), metadata-only readback against committed sources, reaper for parent loss and hard deadline. Original material refuses until T06 sets the image digest pin. Fix stale v2.5.3 app version in docs/openbao.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4384@bnt-lap001 Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
40 lines
2.4 KiB
JSON
40 lines
2.4 KiB
JSON
{
|
|
"schema": "railiance-openbao-restore-admission/v1",
|
|
"namespace": "railiance-openbao-restore-attempt",
|
|
"attempt_id": "RPF-WP-0064-T07-YYYYMMDD-01",
|
|
"phase": "A",
|
|
"phase_b_admitted": false,
|
|
"material": "original",
|
|
"not_before": "YYYY-MM-DDTHH:MM:SSZ",
|
|
"not_after": "YYYY-MM-DDTHH:MM:SSZ",
|
|
"max_duration_seconds": 2700,
|
|
"abort_operator": "founder",
|
|
"image": "quay.io/openbao/openbao@sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"adapter_commit": "replace-with-40-hex-adapter-commit",
|
|
"snapshot": {
|
|
"ciphertext_sha256": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
|
|
"ciphertext_bytes": 0,
|
|
"plaintext_sha256": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
|
|
"age_recipient": "replace-with-railiance-backup-age-recipient",
|
|
"source_cluster_id": "replace-with-source-cluster-id",
|
|
"source_applied_index": 0,
|
|
"source_receipt_sha256": "sha256:3333333333333333333333333333333333333333333333333333333333333333"
|
|
},
|
|
"unseal": {
|
|
"key_threshold": 2,
|
|
"key_shares": 3
|
|
},
|
|
"readback_credential": "generate-root-from-entered-shares",
|
|
"source_sha256": {
|
|
"docs/contracts/secrets-engine-openbao-jwt-login.yaml": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"openbao/auth/keycape-services-config.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"openbao/auth/netkingdom-oidc-config.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"openbao/auth/netkingdom-platform-admin-role.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"openbao/auth/secrets-engine-jwt-role.json": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"openbao/policies/secrets-engine-login-self.hcl": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"scripts/openbao-isolated-restore/preflight.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"scripts/openbao-isolated-restore/restore_adapter.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"scripts/openbao-isolated-restore/run-isolated-restore.sh": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
|
|
"scripts/openbao-isolated-restore/verify-restore-receipt.py": "sha256:0000000000000000000000000000000000000000000000000000000000000000"
|
|
}
|
|
}
|