From 9a4f6a4d753b5bbed3f53186b90b975b42034d69 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Wed, 22 Jul 2026 20:34:22 +0200
Subject: [PATCH] feat: enable daily CNPG Option A backup on railiance01

Wire worker kubeconfig hostPath (no PATH override), enable
daily-cnpg-option-a-backup for R01 targets, ESO already synced.
---
 activity-definitions/daily-cnpg-option-a-backup.md | 5 ++++-
 k8s/railiance/20-runtime.yaml                      | 4 ++--
 src/activity_core/context_resolvers/cnpg_backup.py | 4 ++--
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/activity-definitions/daily-cnpg-option-a-backup.md b/activity-definitions/daily-cnpg-option-a-backup.md
index ac4b3d1..3cc0da0 100644
--- a/activity-definitions/daily-cnpg-option-a-backup.md
+++ b/activity-definitions/daily-cnpg-option-a-backup.md
@@ -1,7 +1,7 @@
 ---
 id: daily-cnpg-option-a-backup
 name: Daily CNPG Option A Backup
-enabled: false
+enabled: true
 owner: custodian-agent
 governance: custodian
 status: active
@@ -18,8 +18,11 @@ context_sources:
       backup_script: /opt/railiance-platform/tools/cmd/cnpg-option-a-backup
       dry_run: false
       timeout_seconds: 7200
+      # worker-writable cache
+      # (CLI defaults to /tmp if HOME unwritable)
       kubeconfig_r01: /kube/config-hosteurope
       kubeconfig_core: /kube/config
+      targets: r01-forgejo-db,r01-net-kingdom-pg,r01-state-hub-db
       evidence_sinks:
         - type: state-hub-progress
           event_type: cnpg_option_a_backup
diff --git a/k8s/railiance/20-runtime.yaml b/k8s/railiance/20-runtime.yaml
index 755447c..74ffc83 100644
--- a/k8s/railiance/20-runtime.yaml
+++ b/k8s/railiance/20-runtime.yaml
@@ -1251,8 +1251,8 @@ spec:
               value: /kube/config-hosteurope
             - name: KUBECONFIG_CORE
               value: /kube/config
-            - name: PATH
-              value: /opt/railiance-platform/tools/vendor/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+            # Do not override PATH — image venv must stay first for temporalio/etc.
+            # Backup CLI prepends tools/vendor/bin itself.
           envFrom:
             - configMapRef:
                 name: actcore-runtime-config
diff --git a/src/activity_core/context_resolvers/cnpg_backup.py b/src/activity_core/context_resolvers/cnpg_backup.py
index aa87258..e1e39a2 100644
--- a/src/activity_core/context_resolvers/cnpg_backup.py
+++ b/src/activity_core/context_resolvers/cnpg_backup.py
@@ -26,10 +26,10 @@ def cnpg_option_a_backup(params: dict[str, Any]) -> dict[str, Any]:
     targets = params.get("targets")  # optional CSV
 
     env = os.environ.copy()
-    # Ensure vendor bin (age/kubectl) is visible when hostPath is mounted.
+    # Prepend vendor bin (age/kubectl) without wiping the image PATH/venv.
     vendor = Path("/opt/railiance-platform/tools/vendor/bin")
     if vendor.is_dir():
-        env["PATH"] = f"{vendor}:{env.get('PATH', '')}"
+        env["PATH"] = f"{vendor}:{env.get('PATH', '/usr/local/bin:/usr/bin:/bin')}"
 
     if dry_run:
         env["RAILIANCE_BACKUP_DRY_RUN"] = "1"