tegwick
9a4f6a4d75
Wire worker kubeconfig hostPath (no PATH override), enable daily-cnpg-option-a-backup for R01 targets, ESO already synced.
53 lines
1.7 KiB
Markdown
53 lines
1.7 KiB
Markdown
---
|
||
id: daily-cnpg-option-a-backup
|
||
name: Daily CNPG Option A Backup
|
||
enabled: true
|
||
owner: custodian-agent
|
||
governance: custodian
|
||
status: active
|
||
trigger:
|
||
type: cron
|
||
cron_expression: "30 2 * * *"
|
||
timezone: UTC
|
||
misfire_policy: skip
|
||
context_sources:
|
||
- type: shell
|
||
query: cnpg_option_a_backup
|
||
required: true
|
||
params:
|
||
backup_script: /opt/railiance-platform/tools/cmd/cnpg-option-a-backup
|
||
dry_run: false
|
||
timeout_seconds: 7200
|
||
# worker-writable cache
|
||
# (CLI defaults to /tmp if HOME unwritable)
|
||
kubeconfig_r01: /kube/config-hosteurope
|
||
kubeconfig_core: /kube/config
|
||
targets: r01-forgejo-db,r01-net-kingdom-pg,r01-state-hub-db
|
||
evidence_sinks:
|
||
- type: state-hub-progress
|
||
event_type: cnpg_option_a_backup
|
||
author: activity-core
|
||
bind_to: context.backup
|
||
---
|
||
|
||
# Daily CNPG Option A Backup
|
||
|
||
Runs daily at **02:30 UTC** (RPO 24h). Invokes
|
||
`railiance-platform/tools/cmd/cnpg-option-a-backup` on the railiance01
|
||
activity-core worker to age-encrypt logical dumps and upload to Nextcloud.
|
||
|
||
**Workplan:** `RAILIANCE-WP-0016` (railiance-apps).
|
||
|
||
## Enable checklist
|
||
|
||
1. Vendor tools on railiance01 hostPath tree:
|
||
`tools/cmd/install-cnpg-backup-vendor-tools` (age + kubectl).
|
||
2. ExternalSecret `actcore-backup-offsite` synced into `actcore-runtime-secret`
|
||
(`NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PUBLIC_KEY`).
|
||
3. Worker mounts: `/opt/railiance-platform`, `/kube` (host kubeconfigs).
|
||
4. CoulombCore kubeconfig present at `/kube/config` for Core clusters; R01 at
|
||
`/kube/config-hosteurope`.
|
||
5. `enabled: true` + `make sync` / schedule reconcile on railiance01.
|
||
6. Forced run succeeds; `make cnpg-backup-status` stays healthy.
|
||
|
||
**Starts disabled** until T02–T04 wiring is verified on railiance01.
|