retarget: mason plan backup-object-storage replaces Barman draft
This commit is contained in:
parent
cbe19c9bb0
commit
a6cb560d01
3 changed files with 110 additions and 102 deletions
107
plans/backup-object-storage.md
Normal file
107
plans/backup-object-storage.md
Normal file
|
|
@ -0,0 +1,107 @@
|
|||
---
|
||||
id: backup-object-storage
|
||||
demand_source: resource-control/workplans/RESOURCE-WP-0002-T04
|
||||
consumer_repo: rapp-postgres
|
||||
credential_type: openbao-kv-founder-provision
|
||||
status: draft
|
||||
approved_by: null
|
||||
approved_at: null
|
||||
created: "2026-08-14"
|
||||
updated: "2026-08-14"
|
||||
---
|
||||
|
||||
# Construction plan: resource-control scoped backup key
|
||||
|
||||
## 1. Demand
|
||||
|
||||
`RESOURCE-WP-0002` T04 needs a Scaleway API key for **backup object
|
||||
storage in general**, not a Barman-only identity. Founder uses IAM
|
||||
application `resource-control` and binds policy / API-key
|
||||
`Scoped backup access` on the project that owns the backup bucket.
|
||||
The key lives in OpenBao. External Secrets later projects it into
|
||||
consumer Secrets (first: `platform-pg-backup-s3` in `databases`).
|
||||
The bootstrap key cannot create IAM. ops-mason builds the empty
|
||||
lane. Values never appear in git or chat.
|
||||
|
||||
## 2. Existing-structure survey
|
||||
|
||||
Checked 2026-08-14, retargeted the same day:
|
||||
|
||||
- **KV path does not exist.**
|
||||
`platform/data/workloads/railiance/backup/object-storage` is 404.
|
||||
The earlier draft path `…/backup/platform-pg-backup-s3` was not
|
||||
built and must not be used.
|
||||
- **CCR-2026-0012** now reserves
|
||||
`platform/workloads/railiance/backup/object-storage`. Reuse it.
|
||||
- **CCR-2026-0011** is the bootstrap key
|
||||
(`platform/workloads/railiance/scaleway/bootstrap`). Different
|
||||
purpose. Do not reuse those values. Do not hang that key on
|
||||
application `resource-control`.
|
||||
- **CCR-2026-0004** is Nextcloud/age offsite. Different provider.
|
||||
- **Catalog.** No `backup-object-storage` lane.
|
||||
- **Auth.** First delivery is External Secrets into `databases`.
|
||||
Kubernetes auth role `external-secrets-backup-object-storage` is
|
||||
the CCR-declared steady state. railiance01 may need the interim
|
||||
AppRole/token pattern; that apply is after placeholders are
|
||||
replaced.
|
||||
- **Does an existing lane already satisfy this?** No live secret.
|
||||
|
||||
## 3. Proposed changes
|
||||
|
||||
| # | Action | Object | Reuse-vs-new rationale |
|
||||
|---|---|---|---|
|
||||
| 1 | reuse | CCR-2026-0012 path | Already reserved after retarget |
|
||||
| 2 | create | policy `workload-kv-read-backup-object-storage` | File already written; apply after approval |
|
||||
| 3 | create | empty KV v2 path (placeholders `xxx`) | Paste-once / UI replace has a home |
|
||||
| 4 | defer | Kubernetes auth role / AppRole / ESO store | After real values exist |
|
||||
| 5 | defer | catalog `backup-object-storage` | Pointer only; `warden_executes: false` until verified |
|
||||
| 6 | defer | Scaleway bucket policy principal | Needs `APPLICATION_ID` of `resource-control` |
|
||||
|
||||
No new rail. Scaleway operates S3. No second IAM application.
|
||||
|
||||
## 4. Review notes
|
||||
|
||||
- **Naming:** path is `…/backup/object-storage`. IAM application is
|
||||
`resource-control`. Policy and key label are `Scoped backup access`.
|
||||
- **IAM fact:** policies attach to the application, not one key. Only
|
||||
backup-scoped keys belong on `resource-control`.
|
||||
- **TTL/scoping:** the Scaleway key is long-lived until rotated. The
|
||||
OpenBao reader is ESO, 15m Kubernetes auth TTL in the CCR.
|
||||
- **Redundancy:** does not reuse the bootstrap path or the Nextcloud
|
||||
offsite lane. Supersedes the Barman-named draft of the same CCR.
|
||||
- **Secret values:** mason does not read, write, or log them. Founder
|
||||
uses the OpenBao UI or
|
||||
`railiance-platform/docs/put-backup-object-storage.md`.
|
||||
- **Founder remaining acts:** approve this plan and CCR-2026-0012;
|
||||
create or reuse application `resource-control`; bind policy and key
|
||||
`Scoped backup access`; replace `xxx`; say “the backup key is in
|
||||
bao.”
|
||||
|
||||
## 5. Executive summary
|
||||
|
||||
**One-line ask:** approve an OpenBao home for the resource-control
|
||||
backup key so first consumer `rapp-postgres` (and later backup
|
||||
consumers) can receive a projected Secret without putting keys in git
|
||||
or chat.
|
||||
|
||||
**Who gets access:** you (founder) to write the three fields; later,
|
||||
External Secrets, first bound to namespace `databases`.
|
||||
|
||||
**To what:** only
|
||||
`platform/workloads/railiance/backup/object-storage`
|
||||
(`ACCESS_KEY_ID`, `ACCESS_SECRET_KEY`, `APPLICATION_ID`). Not the
|
||||
bootstrap path.
|
||||
|
||||
**For how long:** until you rotate or revoke the Scaleway key.
|
||||
|
||||
**Blast radius if the credential leaks:** read/write/delete objects
|
||||
on the backup bucket. Revoke the key in the Scaleway console, delete
|
||||
the KV version, rotate.
|
||||
|
||||
**Cost to reverse:** delete the KV path, policy, and unused drafts.
|
||||
WAL is not enabled yet, so there is no production archive to migrate.
|
||||
|
||||
**Decision:** approve, reject, or send back to phase 1.
|
||||
Approval authorizes structure (empty path, policy). It does not
|
||||
authorize ops-mason to handle the Scaleway secret values, and it does
|
||||
not enable continuous archiving.
|
||||
|
|
@ -1,99 +0,0 @@
|
|||
---
|
||||
id: platform-pg-backup-s3
|
||||
demand_source: resource-control/workplans/RESOURCE-WP-0002-T04
|
||||
consumer_repo: rapp-postgres
|
||||
credential_type: openbao-kv-founder-provision
|
||||
status: draft
|
||||
approved_by: null
|
||||
approved_at: null
|
||||
created: "2026-08-14"
|
||||
updated: "2026-08-14"
|
||||
---
|
||||
|
||||
# Construction plan: scoped Barman key for platform-pg
|
||||
|
||||
## 1. Demand
|
||||
|
||||
`RESOURCE-WP-0002` T04 needs a Scaleway API key that can only operate
|
||||
on bucket `railiance-platform-pg-backup` prefix `platform-pg/`, stored
|
||||
in OpenBao, and later synced by External Secrets into Kubernetes Secret
|
||||
`platform-pg-backup-s3` in namespace `databases`. CNPG/Barman is the
|
||||
only runtime consumer. Founder mints the key in the Scaleway console
|
||||
(the bootstrap key cannot `list application` / create IAM). ops-mason
|
||||
builds the empty lane. Values never appear in git or chat.
|
||||
|
||||
## 2. Existing-structure survey
|
||||
|
||||
Checked 2026-08-14:
|
||||
|
||||
- **KV path does not exist.**
|
||||
`platform/data/workloads/railiance/backup/platform-pg-backup-s3` is 404.
|
||||
- **CCR-2026-0012** reserves that path and fields `ACCESS_KEY_ID`,
|
||||
`ACCESS_SECRET_KEY`, `APPLICATION_ID`. Reuse it. Do not invent a
|
||||
second path.
|
||||
- **CCR-2026-0011** is the bootstrap key
|
||||
(`platform/workloads/railiance/scaleway/bootstrap`). Different
|
||||
purpose. Do not reuse those values as the runtime key.
|
||||
- **CCR-2026-0004** is Nextcloud/age offsite. Different provider.
|
||||
- **Catalog.** No `platform-pg-backup-s3` / `s3-backup` lane.
|
||||
- **Auth.** Runtime delivery is External Secrets into `databases`.
|
||||
Kubernetes auth role `external-secrets-platform-pg-backup` is the
|
||||
CCR-declared steady state. railiance01 may need the same interim
|
||||
AppRole/token pattern as email-connect / audit-core; that apply is
|
||||
after the founder replaces placeholders.
|
||||
- **Does an existing lane already satisfy this?** No live secret.
|
||||
|
||||
## 3. Proposed changes
|
||||
|
||||
| # | Action | Object | Reuse-vs-new rationale |
|
||||
|---|---|---|---|
|
||||
| 1 | reuse | CCR-2026-0012 path | Already reserved |
|
||||
| 2 | create | policy `workload-kv-read-platform-pg-backup-s3` | File already written; apply after approval |
|
||||
| 3 | create | empty KV v2 path (placeholders `xxx`) | Paste-once / UI replace has a home |
|
||||
| 4 | defer | Kubernetes auth role / AppRole / ESO store | After real values exist |
|
||||
| 5 | defer | catalog `platform-pg-backup-s3` | Pointer only; `warden_executes: false` until verified |
|
||||
| 6 | defer | Scaleway bucket policy principal | Needs `APPLICATION_ID` from the founder |
|
||||
|
||||
No new rail. Scaleway operates S3.
|
||||
|
||||
## 4. Review notes
|
||||
|
||||
- **Naming:** path follows `platform/workloads/railiance/backup/…`.
|
||||
Policy name matches the CCR.
|
||||
- **TTL/scoping:** the Scaleway key is long-lived until rotated. The
|
||||
OpenBao reader is ESO, 15m Kubernetes auth TTL in the CCR.
|
||||
- **Redundancy:** does not reuse the bootstrap path or the Nextcloud
|
||||
offsite lane.
|
||||
- **Secret values:** mason does not read, write, or log them. Founder
|
||||
uses the OpenBao UI or `docs/put-platform-pg-backup-s3.md`.
|
||||
- **Founder remaining acts:** approve this plan and CCR-2026-0012;
|
||||
create the IAM application and project-scoped key; replace `xxx`;
|
||||
say “the Barman key is in bao.”
|
||||
|
||||
## 5. Executive summary
|
||||
|
||||
**One-line ask:** approve an OpenBao home for a bucket-scoped Barman
|
||||
key so `rapp-postgres` can later receive Secret `platform-pg-backup-s3`
|
||||
without putting keys in git or chat.
|
||||
|
||||
**Who gets access:** you (founder) to write the three fields; later,
|
||||
only External Secrets bound to namespace `databases`. No other rapp.
|
||||
|
||||
**To what:** only
|
||||
`platform/workloads/railiance/backup/platform-pg-backup-s3`
|
||||
(`ACCESS_KEY_ID`, `ACCESS_SECRET_KEY`, `APPLICATION_ID`). Not the
|
||||
bootstrap path.
|
||||
|
||||
**For how long:** until you rotate or revoke the Scaleway key.
|
||||
|
||||
**Blast radius if the credential leaks:** read/write/delete objects
|
||||
under the backup prefix. Revoke the key in the Scaleway console,
|
||||
delete the KV version, rotate.
|
||||
|
||||
**Cost to reverse:** delete the KV path, policy, and unused drafts.
|
||||
WAL is not enabled yet, so there is no production archive to migrate.
|
||||
|
||||
**Decision:** approve, reject, or send back to phase 1.
|
||||
Approval authorizes structure (empty path, policy). It does not
|
||||
authorize ops-mason to handle the Scaleway secret values, and it does
|
||||
not enable continuous archiving.
|
||||
|
|
@ -29,8 +29,8 @@ Checked 2026-08-14:
|
|||
|
||||
- **KV path does not exist.**
|
||||
`platform/metadata/workloads/railiance/scaleway/bootstrap` is 404.
|
||||
Same for the later Barman path
|
||||
`platform/workloads/railiance/backup/platform-pg-backup-s3`.
|
||||
Same for the later backup path
|
||||
`platform/workloads/railiance/backup/object-storage`.
|
||||
- **CCR already reserved the path.**
|
||||
`railiance-platform` `CCR-2026-0011` names
|
||||
`platform/workloads/railiance/scaleway/bootstrap` and the four fields.
|
||||
|
|
@ -66,7 +66,7 @@ Terraform snippet → OpenBao fields (same four facts, scw-native names):
|
|||
| 3 | create | policy `operator-kv-scaleway-bootstrap` (read/write that path only) | Founder desk and the bucket-create script; no sibling paths |
|
||||
| 4 | reuse | founder paste-once desk + optional local tfvars ingest | ops-mason never sees values; four fields, four desk pastes or one founder-run ingest |
|
||||
| 5 | propose | catalog `scaleway-bootstrap` (draft) + playbook | Pointer only; `warden_executes: false` |
|
||||
| 6 | defer | AppRole / ESO / scoped Barman key | T04 / CCR for `platform-pg-backup-s3`; not this plan |
|
||||
| 6 | defer | AppRole / ESO / scoped backup key | T04 / CCR for `backup/object-storage`; not this plan |
|
||||
|
||||
No new rail. Scaleway operates S3.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue