7f71dff945
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
87 lines
3.2 KiB
Markdown
87 lines
3.2 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0027
|
|
type: workplan
|
|
title: "Retract public OpenBao listener behind operator-only access"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- RMASTER-WP-0020-T09
|
|
- RAPP-OPENBAO-WP-0002
|
|
state_hub_workstream_id: "6f8a6cbc-c076-5f0a-ade2-281a7ec71360"
|
|
---
|
|
|
|
# RAILIANCE-WP-0027 — OpenBao operator-only access
|
|
|
|
## Goal
|
|
|
|
Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to
|
|
destructive CoulombCore cleanup.
|
|
|
|
## T01 — Align the retained compatibility source
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0027-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "d84fb3fd-2166-58a0-81d9-2141ca55a67d"
|
|
```
|
|
|
|
The retained platform manifest now matches the canonical package posture:
|
|
Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the
|
|
public-only middleware. The old Ingress remains solely in an explicitly named
|
|
rollback artifact.
|
|
|
|
## T02 — Add guarded retraction and rollback
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0027-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "149fdec9-6735-514e-aad1-0c2daf72d27a"
|
|
```
|
|
|
|
`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
|
|
source and runtime packet posture, requires a lifecycle-healthy named tunnel,
|
|
and gates live deletion on exact confirmation plus attended-login verification.
|
|
It deletes only the Ingress and provides an exact rollback path.
|
|
|
|
## T03 — Complete the attended operator cutover
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0027-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "99f8b41f-e9db-579d-a6fb-b71337048afc"
|
|
```
|
|
|
|
KeyCape revision `d150be1` now admits exactly
|
|
`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` in the
|
|
source-owned `openbao-admin` client and pins it in configuration tests. The
|
|
OpenBao `auth/netkingdom/role/platform-admin` role must still independently
|
|
admit that exact callback, and an attended MFA login must pass. The
|
|
host-namespace preflight already proves `openbao-ui-railiance01`
|
|
lifecycle-healthy and reaches the expected overlay. Then execute the guarded
|
|
retraction, coordinate public DNS withdrawal with railiance-infra, and return
|
|
non-secret acceptance evidence to Railiance Master.
|
|
|
|
Net Kingdom revision `61aeafe` additionally applied the exact KeyCape callback
|
|
live and proved the public authorization endpoint accepts it. Railiance
|
|
Platform now carries the silent, narrowly scoped
|
|
`scripts/openbao-apply-operator-loopback-callback.sh` owner command for the
|
|
governed `openbao-platform-admin-login` lane. The remaining hold is one
|
|
attended OIDC/MFA execution of that command followed by one loopback UI login.
|
|
|
|
An attended attempt on 2026-08-23 failed closed before command handoff. Warden
|
|
contained all login output and did not execute the role update; its cleanup
|
|
could not confirm self-revocation, so the attempt is terminal NO-GO and must
|
|
not be treated as callback evidence. No public-listener or OpenBao role change
|
|
was made. T03 remains `wait` for a fresh attended execution after the operator
|
|
is ready to complete the browser/MFA act.
|
|
|
|
This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
|
|
Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.
|