e8e71191d8
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
70 lines
2.1 KiB
Markdown
70 lines
2.1 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0027
|
|
type: workplan
|
|
title: "Retract public OpenBao listener behind operator-only access"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
related:
|
|
- RMASTER-WP-0020-T09
|
|
- RAPP-OPENBAO-WP-0002
|
|
state_hub_workstream_id: "6f8a6cbc-c076-5f0a-ade2-281a7ec71360"
|
|
---
|
|
|
|
# RAILIANCE-WP-0027 — OpenBao operator-only access
|
|
|
|
## Goal
|
|
|
|
Implement the S3-owner half of RMASTER-WP-0020-T09 without coupling it to
|
|
destructive CoulombCore cleanup.
|
|
|
|
## T01 — Align the retained compatibility source
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0027-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "d84fb3fd-2166-58a0-81d9-2141ca55a67d"
|
|
```
|
|
|
|
The retained platform manifest now matches the canonical package posture:
|
|
Deployment plus ClusterIP Service only. Ordinary deploy no longer applies the
|
|
public-only middleware. The old Ingress remains solely in an explicitly named
|
|
rollback artifact.
|
|
|
|
## T02 — Add guarded retraction and rollback
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0027-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "149fdec9-6735-514e-aad1-0c2daf72d27a"
|
|
```
|
|
|
|
`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
|
|
source and runtime packet posture, requires a lifecycle-healthy named tunnel,
|
|
and gates live deletion on exact confirmation plus attended-login verification.
|
|
It deletes only the Ingress and provides an exact rollback path.
|
|
|
|
## T03 — Complete the attended operator cutover
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0027-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "99f8b41f-e9db-579d-a6fb-b71337048afc"
|
|
```
|
|
|
|
Blocked on two facts: KeyCape and the OpenBao role must accept the exact
|
|
loopback callback, and an attended MFA login must pass. The host-namespace
|
|
preflight already proves `openbao-ui-railiance01` lifecycle-healthy and reaches
|
|
the expected overlay. Then execute the guarded retraction, coordinate public
|
|
DNS withdrawal with railiance-infra, and return non-secret acceptance evidence
|
|
to Railiance Master.
|
|
|
|
This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
|
|
Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.
|