diff --git a/plans/backup-object-storage.md b/plans/backup-object-storage.md new file mode 100644 index 0000000..8586def --- /dev/null +++ b/plans/backup-object-storage.md @@ -0,0 +1,107 @@ +--- +id: backup-object-storage +demand_source: resource-control/workplans/RESOURCE-WP-0002-T04 +consumer_repo: rapp-postgres +credential_type: openbao-kv-founder-provision +status: draft +approved_by: null +approved_at: null +created: "2026-08-14" +updated: "2026-08-14" +--- + +# Construction plan: resource-control scoped backup key + +## 1. Demand + +`RESOURCE-WP-0002` T04 needs a Scaleway API key for **backup object +storage in general**, not a Barman-only identity. Founder uses IAM +application `resource-control` and binds policy / API-key +`Scoped backup access` on the project that owns the backup bucket. +The key lives in OpenBao. External Secrets later projects it into +consumer Secrets (first: `platform-pg-backup-s3` in `databases`). +The bootstrap key cannot create IAM. ops-mason builds the empty +lane. Values never appear in git or chat. + +## 2. Existing-structure survey + +Checked 2026-08-14, retargeted the same day: + +- **KV path does not exist.** + `platform/data/workloads/railiance/backup/object-storage` is 404. + The earlier draft path `…/backup/platform-pg-backup-s3` was not + built and must not be used. +- **CCR-2026-0012** now reserves + `platform/workloads/railiance/backup/object-storage`. Reuse it. +- **CCR-2026-0011** is the bootstrap key + (`platform/workloads/railiance/scaleway/bootstrap`). Different + purpose. Do not reuse those values. Do not hang that key on + application `resource-control`. +- **CCR-2026-0004** is Nextcloud/age offsite. Different provider. +- **Catalog.** No `backup-object-storage` lane. +- **Auth.** First delivery is External Secrets into `databases`. + Kubernetes auth role `external-secrets-backup-object-storage` is + the CCR-declared steady state. railiance01 may need the interim + AppRole/token pattern; that apply is after placeholders are + replaced. +- **Does an existing lane already satisfy this?** No live secret. + +## 3. Proposed changes + +| # | Action | Object | Reuse-vs-new rationale | +|---|---|---|---| +| 1 | reuse | CCR-2026-0012 path | Already reserved after retarget | +| 2 | create | policy `workload-kv-read-backup-object-storage` | File already written; apply after approval | +| 3 | create | empty KV v2 path (placeholders `xxx`) | Paste-once / UI replace has a home | +| 4 | defer | Kubernetes auth role / AppRole / ESO store | After real values exist | +| 5 | defer | catalog `backup-object-storage` | Pointer only; `warden_executes: false` until verified | +| 6 | defer | Scaleway bucket policy principal | Needs `APPLICATION_ID` of `resource-control` | + +No new rail. Scaleway operates S3. No second IAM application. + +## 4. Review notes + +- **Naming:** path is `…/backup/object-storage`. IAM application is + `resource-control`. Policy and key label are `Scoped backup access`. +- **IAM fact:** policies attach to the application, not one key. Only + backup-scoped keys belong on `resource-control`. +- **TTL/scoping:** the Scaleway key is long-lived until rotated. The + OpenBao reader is ESO, 15m Kubernetes auth TTL in the CCR. +- **Redundancy:** does not reuse the bootstrap path or the Nextcloud + offsite lane. Supersedes the Barman-named draft of the same CCR. +- **Secret values:** mason does not read, write, or log them. Founder + uses the OpenBao UI or + `railiance-platform/docs/put-backup-object-storage.md`. +- **Founder remaining acts:** approve this plan and CCR-2026-0012; + create or reuse application `resource-control`; bind policy and key + `Scoped backup access`; replace `xxx`; say “the backup key is in + bao.” + +## 5. Executive summary + +**One-line ask:** approve an OpenBao home for the resource-control +backup key so first consumer `rapp-postgres` (and later backup +consumers) can receive a projected Secret without putting keys in git +or chat. + +**Who gets access:** you (founder) to write the three fields; later, +External Secrets, first bound to namespace `databases`. + +**To what:** only +`platform/workloads/railiance/backup/object-storage` +(`ACCESS_KEY_ID`, `ACCESS_SECRET_KEY`, `APPLICATION_ID`). Not the +bootstrap path. + +**For how long:** until you rotate or revoke the Scaleway key. + +**Blast radius if the credential leaks:** read/write/delete objects +on the backup bucket. Revoke the key in the Scaleway console, delete +the KV version, rotate. + +**Cost to reverse:** delete the KV path, policy, and unused drafts. +WAL is not enabled yet, so there is no production archive to migrate. + +**Decision:** approve, reject, or send back to phase 1. +Approval authorizes structure (empty path, policy). It does not +authorize ops-mason to handle the Scaleway secret values, and it does +not enable continuous archiving. diff --git a/plans/platform-pg-backup-s3.md b/plans/platform-pg-backup-s3.md deleted file mode 100644 index 9fcb7c1..0000000 --- a/plans/platform-pg-backup-s3.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -id: platform-pg-backup-s3 -demand_source: resource-control/workplans/RESOURCE-WP-0002-T04 -consumer_repo: rapp-postgres -credential_type: openbao-kv-founder-provision -status: draft -approved_by: null -approved_at: null -created: "2026-08-14" -updated: "2026-08-14" ---- - -# Construction plan: scoped Barman key for platform-pg - -## 1. Demand - -`RESOURCE-WP-0002` T04 needs a Scaleway API key that can only operate -on bucket `railiance-platform-pg-backup` prefix `platform-pg/`, stored -in OpenBao, and later synced by External Secrets into Kubernetes Secret -`platform-pg-backup-s3` in namespace `databases`. CNPG/Barman is the -only runtime consumer. Founder mints the key in the Scaleway console -(the bootstrap key cannot `list application` / create IAM). ops-mason -builds the empty lane. Values never appear in git or chat. - -## 2. Existing-structure survey - -Checked 2026-08-14: - -- **KV path does not exist.** - `platform/data/workloads/railiance/backup/platform-pg-backup-s3` is 404. -- **CCR-2026-0012** reserves that path and fields `ACCESS_KEY_ID`, - `ACCESS_SECRET_KEY`, `APPLICATION_ID`. Reuse it. Do not invent a - second path. -- **CCR-2026-0011** is the bootstrap key - (`platform/workloads/railiance/scaleway/bootstrap`). Different - purpose. Do not reuse those values as the runtime key. -- **CCR-2026-0004** is Nextcloud/age offsite. Different provider. -- **Catalog.** No `platform-pg-backup-s3` / `s3-backup` lane. -- **Auth.** Runtime delivery is External Secrets into `databases`. - Kubernetes auth role `external-secrets-platform-pg-backup` is the - CCR-declared steady state. railiance01 may need the same interim - AppRole/token pattern as email-connect / audit-core; that apply is - after the founder replaces placeholders. -- **Does an existing lane already satisfy this?** No live secret. - -## 3. Proposed changes - -| # | Action | Object | Reuse-vs-new rationale | -|---|---|---|---| -| 1 | reuse | CCR-2026-0012 path | Already reserved | -| 2 | create | policy `workload-kv-read-platform-pg-backup-s3` | File already written; apply after approval | -| 3 | create | empty KV v2 path (placeholders `xxx`) | Paste-once / UI replace has a home | -| 4 | defer | Kubernetes auth role / AppRole / ESO store | After real values exist | -| 5 | defer | catalog `platform-pg-backup-s3` | Pointer only; `warden_executes: false` until verified | -| 6 | defer | Scaleway bucket policy principal | Needs `APPLICATION_ID` from the founder | - -No new rail. Scaleway operates S3. - -## 4. Review notes - -- **Naming:** path follows `platform/workloads/railiance/backup/…`. - Policy name matches the CCR. -- **TTL/scoping:** the Scaleway key is long-lived until rotated. The - OpenBao reader is ESO, 15m Kubernetes auth TTL in the CCR. -- **Redundancy:** does not reuse the bootstrap path or the Nextcloud - offsite lane. -- **Secret values:** mason does not read, write, or log them. Founder - uses the OpenBao UI or `docs/put-platform-pg-backup-s3.md`. -- **Founder remaining acts:** approve this plan and CCR-2026-0012; - create the IAM application and project-scoped key; replace `xxx`; - say “the Barman key is in bao.” - -## 5. Executive summary - -**One-line ask:** approve an OpenBao home for a bucket-scoped Barman -key so `rapp-postgres` can later receive Secret `platform-pg-backup-s3` -without putting keys in git or chat. - -**Who gets access:** you (founder) to write the three fields; later, -only External Secrets bound to namespace `databases`. No other rapp. - -**To what:** only -`platform/workloads/railiance/backup/platform-pg-backup-s3` -(`ACCESS_KEY_ID`, `ACCESS_SECRET_KEY`, `APPLICATION_ID`). Not the -bootstrap path. - -**For how long:** until you rotate or revoke the Scaleway key. - -**Blast radius if the credential leaks:** read/write/delete objects -under the backup prefix. Revoke the key in the Scaleway console, -delete the KV version, rotate. - -**Cost to reverse:** delete the KV path, policy, and unused drafts. -WAL is not enabled yet, so there is no production archive to migrate. - -**Decision:** approve, reject, or send back to phase 1. -Approval authorizes structure (empty path, policy). It does not -authorize ops-mason to handle the Scaleway secret values, and it does -not enable continuous archiving. diff --git a/plans/reef-storage-scaleway-bootstrap.md b/plans/reef-storage-scaleway-bootstrap.md index 7bf932a..f04d989 100644 --- a/plans/reef-storage-scaleway-bootstrap.md +++ b/plans/reef-storage-scaleway-bootstrap.md @@ -29,8 +29,8 @@ Checked 2026-08-14: - **KV path does not exist.** `platform/metadata/workloads/railiance/scaleway/bootstrap` is 404. - Same for the later Barman path - `platform/workloads/railiance/backup/platform-pg-backup-s3`. + Same for the later backup path + `platform/workloads/railiance/backup/object-storage`. - **CCR already reserved the path.** `railiance-platform` `CCR-2026-0011` names `platform/workloads/railiance/scaleway/bootstrap` and the four fields. @@ -66,7 +66,7 @@ Terraform snippet → OpenBao fields (same four facts, scw-native names): | 3 | create | policy `operator-kv-scaleway-bootstrap` (read/write that path only) | Founder desk and the bucket-create script; no sibling paths | | 4 | reuse | founder paste-once desk + optional local tfvars ingest | ops-mason never sees values; four fields, four desk pastes or one founder-run ingest | | 5 | propose | catalog `scaleway-bootstrap` (draft) + playbook | Pointer only; `warden_executes: false` | -| 6 | defer | AppRole / ESO / scoped Barman key | T04 / CCR for `platform-pg-backup-s3`; not this plan | +| 6 | defer | AppRole / ESO / scoped backup key | T04 / CCR for `backup/object-storage`; not this plan | No new rail. Scaleway operates S3.