coulomb/net-kingdom
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Record OpenBao restore drill evidence

Browse Source
This commit is contained in:
Bernd Worsch
2026-06-02 17:23:20 +02:00
parent eb973621e1
commit c7bbdac03b
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
workplans/NET-WP-0017-it-security-readiness-for-user-onboarding.md
View File

@@ -266,6 +266,17 @@ placeholder values, so T02 cannot be closed by copying example evidence files.
Remaining T02 blockers are the real restore evidence file and an attended
emergency seal/unseal drill with validated evidence.
**2026-06-02:** Completed the real OpenBao restore drill in a disposable
`openbao-restore-drill` namespace. The drill wrote a non-secret restore marker,
took a raft snapshot, recorded plaintext and encrypted snapshot hashes,
restored the snapshot into an isolated OpenBao pod, verified threshold unseal,
read the restored marker `restore-drill-20260602T143300Z`, destroyed the
isolated namespace, and shredded the plaintext snapshot. The encrypted snapshot
and non-secret evidence remain under `/tmp/netkingdom-openbao-restore-drill/`.
`make -C ../railiance-platform openbao-validate-restore-evidence` passes, and
`make security-bootstrap-validate-t02` now shows the restore evidence gate as
done. T02 remains open only for emergency seal/unseal metadata and evidence.
### T03 - Close Trial Taint And Retire Bootstrap Admin Paths
```task