codex
e4af2a1d10
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
87 lines
3.1 KiB
Markdown
87 lines
3.1 KiB
Markdown
---
|
|
id: RPF-WP-0018
|
|
type: workplan
|
|
title: "Retract public OpenBao listener behind operator-only access"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- RMASTER-WP-0020-T09
|
|
- RAPP-OPENBAO-WP-0002
|
|
state_hub_workstream_id: "4fcb6026-2630-59a3-b5de-15f54efcf59d"
|
|
---
|
|
|
|
# RPF-WP-0018 — OpenBao operator-only access
|
|
|
|
## Goal
|
|
|
|
Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to
|
|
destructive CoulombCore cleanup.
|
|
|
|
## T01 — Align the retained compatibility source
|
|
|
|
```task
|
|
id: RPF-WP-0018-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "88d1342b-5093-5fbc-aa84-1608d163b979"
|
|
```
|
|
|
|
The retained platform manifest now matches the canonical package posture:
|
|
Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the
|
|
public-only middleware. The old Ingress remains solely in an explicitly named
|
|
rollback artifact.
|
|
|
|
## T02 — Add guarded retraction and rollback
|
|
|
|
```task
|
|
id: RPF-WP-0018-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "03f0a5bd-7876-5784-bf02-11cbcdf005bb"
|
|
```
|
|
|
|
`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
|
|
source and runtime packet posture, requires a lifecycle-healthy named tunnel,
|
|
and gates live deletion on exact confirmation plus attended-login verification.
|
|
It deletes only the Ingress and provides an exact rollback path.
|
|
|
|
## T03 — Complete the attended operator cutover
|
|
|
|
```task
|
|
id: RPF-WP-0018-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "b602226f-8eb5-5609-995f-94f9074b0895"
|
|
```
|
|
|
|
KeyCape revision `d150be1` now admits exactly
|
|
`http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` in the
|
|
source-owned `openbao-admin` client and pins it in configuration tests. The
|
|
OpenBao `auth/netkingdom/role/platform-admin` role must still independently
|
|
admit that exact callback, and an attended MFA login must pass. The
|
|
host-namespace preflight already proves `openbao-ui-railiance01`
|
|
lifecycle-healthy and reaches the expected overlay. Then execute the guarded
|
|
retraction, coordinate public DNS withdrawal with railiance-infra, and return
|
|
non-secret acceptance evidence to Railiance Master.
|
|
|
|
Net Kingdom revision `61aeafe` additionally applied the exact KeyCape callback
|
|
live and proved the public authorization endpoint accepts it. Railiance
|
|
Platform now carries the silent, narrowly scoped
|
|
`scripts/openbao-apply-operator-loopback-callback.sh` owner command for the
|
|
governed `openbao-platform-admin-login` lane. The remaining hold is one
|
|
attended OIDC/MFA execution of that command followed by one loopback UI login.
|
|
|
|
An attended attempt on 2026-08-23 failed closed before command handoff. Warden
|
|
contained all login output and did not execute the role update; its cleanup
|
|
could not confirm self-revocation, so the attempt is terminal NO-GO and must
|
|
not be treated as callback evidence. No public-listener or OpenBao role change
|
|
was made. T03 remains `wait` for a fresh attended execution after the operator
|
|
is ready to complete the browser/MFA act.
|
|
|
|
This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
|
|
Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.
|