coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md
repo-manager e8e71191d8
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
chore(registrar): assign State Hub identifiers 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
2026-08-23 12:51:40 +02:00

2.1 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated related state_hub_workstream_id
RAILIANCE-WP-0027 workplan Retract public OpenBao listener behind operator-only access financials railiance-platform blocked codex railiance 2026-08-23 2026-08-23
RMASTER-WP-0020-T09
RAPP-OPENBAO-WP-0002
6f8a6cbc-c076-5f0a-ade2-281a7ec71360

RAILIANCE-WP-0027 — OpenBao operator-only access

Goal

Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to destructive CoulombCore cleanup.

T01 — Align the retained compatibility source

id: RAILIANCE-WP-0027-T01
status: done
priority: high
state_hub_task_id: "d84fb3fd-2166-58a0-81d9-2141ca55a67d"

The retained platform manifest now matches the canonical package posture: Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the public-only middleware. The old Ingress remains solely in an explicitly named rollback artifact.

T02 — Add guarded retraction and rollback

id: RAILIANCE-WP-0027-T02
status: done
priority: high
state_hub_task_id: "149fdec9-6735-514e-aad1-0c2daf72d27a"

scripts/openbao-public-listener-transition.sh pins the cluster UID, verifies source and runtime packet posture, requires a lifecycle-healthy named tunnel, and gates live deletion on exact confirmation plus attended-login verification. It deletes only the Ingress and provides an exact rollback path.

T03 — Complete the attended operator cutover

id: RAILIANCE-WP-0027-T03
status: wait
priority: high
state_hub_task_id: "99f8b41f-e9db-579d-a6fb-b71337048afc"

Blocked on two facts: KeyCape and the OpenBao role must accept the exact loopback callback, and an attended MFA login must pass. The host-namespace preflight already proves openbao-ui-railiance01 lifecycle-healthy and reaches the expected overlay. Then execute the guarded retraction, coordinate public DNS withdrawal with railiance-infra, and return non-secret acceptance evidence to Railiance Master.

This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.