fix(openbao): drop banned k. hostname → openbao.renner.uno + namespace CNP #180

Merged

k.renner merged 1 commits from openbao-hostname-fix into master

2026-07-14 06:06:32 +00:00

Author	SHA1	Message	Date
claude-botandClaude Fable 5	7cb7b9e0d1	fix(openbao): drop banned k.renner.uno hostname; fence namespace with CNP openbao.k.renner.uno -> openbao.renner.uno. The k. subdomain is a migration-era artifact, never a production convention, and is banned per owner directive 2026-07-14 — the wiki note that claimed a dual-hostname convention was wrong and is being corrected. Non-public reachability is a real control, not a hostname: the public edge serves only explicitly configured SNI (openbao is not configured), and the new CiliumNetworkPolicy default-denies the namespace with explicit grants (traefik->8200, ESO->8200, intra-ns for the snapshot CronJob) matching the <app>-ns.yaml pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6	2026-07-14 08:03:19 +02:00

Author

SHA1

Message

Date

claude-botandClaude Fable 5

7cb7b9e0d1

fix(openbao): drop banned k.renner.uno hostname; fence namespace with CNP

openbao.k.renner.uno -> openbao.renner.uno. The k. subdomain is a
migration-era artifact, never a production convention, and is banned
per owner directive 2026-07-14 — the wiki note that claimed a
dual-hostname convention was wrong and is being corrected.

Non-public reachability is a real control, not a hostname: the public
edge serves only explicitly configured SNI (openbao is not configured),
and the new CiliumNetworkPolicy default-denies the namespace with
explicit grants (traefik->8200, ESO->8200, intra-ns for the snapshot
CronJob) matching the <app>-ns.yaml pattern.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

2026-07-14 08:03:19 +02:00