railiance-platform/workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related
RAILIANCE-WP-0027	workplan	Retract public OpenBao listener behind operator-only access	financials	railiance-platform	blocked	codex	railiance	2026-08-23	2026-08-23	RMASTER-WP-0020-T09 RAPP-OPENBAO-WP-0002

RAILIANCE-WP-0027 — OpenBao operator-only access

Goal

Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to destructive CoulombCore cleanup.

T01 — Align the retained compatibility source

id: RAILIANCE-WP-0027-T01
status: done
priority: high

The retained platform manifest now matches the canonical package posture: Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the public-only middleware. The old Ingress remains solely in an explicitly named rollback artifact.

T02 — Add guarded retraction and rollback

id: RAILIANCE-WP-0027-T02
status: done
priority: high

scripts/openbao-public-listener-transition.sh pins the cluster UID, verifies source and runtime packet posture, requires a lifecycle-healthy named tunnel, and gates live deletion on exact confirmation plus attended-login verification. It deletes only the Ingress and provides an exact rollback path.

T03 — Complete the attended operator cutover

id: RAILIANCE-WP-0027-T03
status: wait
priority: high

Blocked on two facts: KeyCape and the OpenBao role must accept the exact loopback callback, and an attended MFA login must pass. The host-namespace preflight already proves openbao-ui-railiance01 lifecycle-healthy and reaches the expected overlay. Then execute the guarded retraction, coordinate public DNS withdrawal with railiance-infra, and return non-secret acceptance evidence to Railiance Master.

This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.