railiance-platform/workplans/RPF-WP-0025-openbao-operator-only-access.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RPF-WP-0025	workplan	Retract public OpenBao listener behind operator-only access	financials	railiance-platform	blocked	codex	railiance	2026-08-23	2026-09-06	RMASTER-WP-0020-T09 RAPP-OPENBAO-WP-0002	6dda6039-295e-5cac-aef6-3183c3218649

RPF-WP-0025 — OpenBao operator-only access

Goal

Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to destructive CoulombCore cleanup.

T01 — Align the retained compatibility source

id: RPF-WP-0025-T01
status: done
priority: high
state_hub_task_id: "80f9638f-707f-5038-bc77-5962b535949e"

The retained platform manifest now matches the canonical package posture: Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the public-only middleware. The old Ingress remains solely in an explicitly named rollback artifact.

T02 — Add guarded retraction and rollback

id: RPF-WP-0025-T02
status: done
priority: high
state_hub_task_id: "685aba0f-2594-5b99-903a-8c9cd16f6539"

scripts/openbao-public-listener-transition.sh pins the cluster UID, verifies source and runtime packet posture, requires a lifecycle-healthy named tunnel, and gates live deletion on exact confirmation plus attended-login verification. It deletes only the Ingress and provides an exact rollback path.

T03 — Complete the attended operator cutover

id: RPF-WP-0025-T03
status: wait
priority: high
state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"

KeyCape revision d150be1 now admits exactly http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback in the source-owned openbao-admin client and pins it in configuration tests. The OpenBao auth/netkingdom/role/platform-admin role must still independently admit that exact callback, and an attended MFA login must pass. The host-namespace preflight already proves openbao-ui-railiance01 lifecycle-healthy and reaches the expected overlay. Then execute the guarded retraction, coordinate public DNS withdrawal with railiance-infra, and return non-secret acceptance evidence to Railiance Master.

Net Kingdom revision 61aeafe additionally applied the exact KeyCape callback live and proved the public authorization endpoint accepts it. Railiance Platform now carries the silent, narrowly scoped scripts/openbao-apply-operator-loopback-callback.sh owner command for the governed openbao-platform-admin-login lane. The remaining hold is one attended OIDC/MFA execution of that command followed by one loopback UI login.

An attended attempt on 2026-08-23 failed closed before command handoff. Warden contained all login output and did not execute the role update; its cleanup could not confirm self-revocation, so the attempt is terminal NO-GO and must not be treated as callback evidence. No public-listener or OpenBao role change was made. T03 remains wait for a fresh attended execution after the operator is ready to complete the browser/MFA act.

This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.

Portfolio review — 2026-09-05

INTENT binding: secure custody and an operable operator access path. Retain T03 as the one attended cutover task; do not merge its approval/window with incident rotation or reboot. Platform owns the exact OpenBao callback and custody acceptance; rapp-openbao owns package exposure, KeyCape/NetKingdom the issuer callback, ops-bridge the tunnel, and S1/S2 DNS/network primitives. Unblock with a fresh attended OIDC/MFA callback update and loopback login, then the guarded retraction and owner-specific DNS handoff. Existing source readiness is not evidence of a completed live cutover.

Callback preservation repair — 2026-09-06

T03 advanced locally: the attended callback helper now reads and preserves the existing platform-admin role, appends only the exact loopback callback, skips writes when already present, detects observed drift before writing, and verifies all settings on readback. --check-only is silent and returns 3 if absent. The role endpoint has no CAS; exclusive attended administration is still needed. Tests cover settings preservation, idempotence, drift, readback failure and unexpected roles. No live role update or ingress retraction was performed in this follow-up; attended loopback UI login remains the cutover gate.