retarget: mason plan backup-object-storage replaces Barman draft
This commit is contained in:
parent
cbe19c9bb0
commit
a6cb560d01
3 changed files with 110 additions and 102 deletions
107
plans/backup-object-storage.md
Normal file
107
plans/backup-object-storage.md
Normal file
|
|
@ -0,0 +1,107 @@
|
||||||
|
---
|
||||||
|
id: backup-object-storage
|
||||||
|
demand_source: resource-control/workplans/RESOURCE-WP-0002-T04
|
||||||
|
consumer_repo: rapp-postgres
|
||||||
|
credential_type: openbao-kv-founder-provision
|
||||||
|
status: draft
|
||||||
|
approved_by: null
|
||||||
|
approved_at: null
|
||||||
|
created: "2026-08-14"
|
||||||
|
updated: "2026-08-14"
|
||||||
|
---
|
||||||
|
|
||||||
|
# Construction plan: resource-control scoped backup key
|
||||||
|
|
||||||
|
## 1. Demand
|
||||||
|
|
||||||
|
`RESOURCE-WP-0002` T04 needs a Scaleway API key for **backup object
|
||||||
|
storage in general**, not a Barman-only identity. Founder uses IAM
|
||||||
|
application `resource-control` and binds policy / API-key
|
||||||
|
`Scoped backup access` on the project that owns the backup bucket.
|
||||||
|
The key lives in OpenBao. External Secrets later projects it into
|
||||||
|
consumer Secrets (first: `platform-pg-backup-s3` in `databases`).
|
||||||
|
The bootstrap key cannot create IAM. ops-mason builds the empty
|
||||||
|
lane. Values never appear in git or chat.
|
||||||
|
|
||||||
|
## 2. Existing-structure survey
|
||||||
|
|
||||||
|
Checked 2026-08-14, retargeted the same day:
|
||||||
|
|
||||||
|
- **KV path does not exist.**
|
||||||
|
`platform/data/workloads/railiance/backup/object-storage` is 404.
|
||||||
|
The earlier draft path `…/backup/platform-pg-backup-s3` was not
|
||||||
|
built and must not be used.
|
||||||
|
- **CCR-2026-0012** now reserves
|
||||||
|
`platform/workloads/railiance/backup/object-storage`. Reuse it.
|
||||||
|
- **CCR-2026-0011** is the bootstrap key
|
||||||
|
(`platform/workloads/railiance/scaleway/bootstrap`). Different
|
||||||
|
purpose. Do not reuse those values. Do not hang that key on
|
||||||
|
application `resource-control`.
|
||||||
|
- **CCR-2026-0004** is Nextcloud/age offsite. Different provider.
|
||||||
|
- **Catalog.** No `backup-object-storage` lane.
|
||||||
|
- **Auth.** First delivery is External Secrets into `databases`.
|
||||||
|
Kubernetes auth role `external-secrets-backup-object-storage` is
|
||||||
|
the CCR-declared steady state. railiance01 may need the interim
|
||||||
|
AppRole/token pattern; that apply is after placeholders are
|
||||||
|
replaced.
|
||||||
|
- **Does an existing lane already satisfy this?** No live secret.
|
||||||
|
|
||||||
|
## 3. Proposed changes
|
||||||
|
|
||||||
|
| # | Action | Object | Reuse-vs-new rationale |
|
||||||
|
|---|---|---|---|
|
||||||
|
| 1 | reuse | CCR-2026-0012 path | Already reserved after retarget |
|
||||||
|
| 2 | create | policy `workload-kv-read-backup-object-storage` | File already written; apply after approval |
|
||||||
|
| 3 | create | empty KV v2 path (placeholders `xxx`) | Paste-once / UI replace has a home |
|
||||||
|
| 4 | defer | Kubernetes auth role / AppRole / ESO store | After real values exist |
|
||||||
|
| 5 | defer | catalog `backup-object-storage` | Pointer only; `warden_executes: false` until verified |
|
||||||
|
| 6 | defer | Scaleway bucket policy principal | Needs `APPLICATION_ID` of `resource-control` |
|
||||||
|
|
||||||
|
No new rail. Scaleway operates S3. No second IAM application.
|
||||||
|
|
||||||
|
## 4. Review notes
|
||||||
|
|
||||||
|
- **Naming:** path is `…/backup/object-storage`. IAM application is
|
||||||
|
`resource-control`. Policy and key label are `Scoped backup access`.
|
||||||
|
- **IAM fact:** policies attach to the application, not one key. Only
|
||||||
|
backup-scoped keys belong on `resource-control`.
|
||||||
|
- **TTL/scoping:** the Scaleway key is long-lived until rotated. The
|
||||||
|
OpenBao reader is ESO, 15m Kubernetes auth TTL in the CCR.
|
||||||
|
- **Redundancy:** does not reuse the bootstrap path or the Nextcloud
|
||||||
|
offsite lane. Supersedes the Barman-named draft of the same CCR.
|
||||||
|
- **Secret values:** mason does not read, write, or log them. Founder
|
||||||
|
uses the OpenBao UI or
|
||||||
|
`railiance-platform/docs/put-backup-object-storage.md`.
|
||||||
|
- **Founder remaining acts:** approve this plan and CCR-2026-0012;
|
||||||
|
create or reuse application `resource-control`; bind policy and key
|
||||||
|
`Scoped backup access`; replace `xxx`; say “the backup key is in
|
||||||
|
bao.”
|
||||||
|
|
||||||
|
## 5. Executive summary
|
||||||
|
|
||||||
|
**One-line ask:** approve an OpenBao home for the resource-control
|
||||||
|
backup key so first consumer `rapp-postgres` (and later backup
|
||||||
|
consumers) can receive a projected Secret without putting keys in git
|
||||||
|
or chat.
|
||||||
|
|
||||||
|
**Who gets access:** you (founder) to write the three fields; later,
|
||||||
|
External Secrets, first bound to namespace `databases`.
|
||||||
|
|
||||||
|
**To what:** only
|
||||||
|
`platform/workloads/railiance/backup/object-storage`
|
||||||
|
(`ACCESS_KEY_ID`, `ACCESS_SECRET_KEY`, `APPLICATION_ID`). Not the
|
||||||
|
bootstrap path.
|
||||||
|
|
||||||
|
**For how long:** until you rotate or revoke the Scaleway key.
|
||||||
|
|
||||||
|
**Blast radius if the credential leaks:** read/write/delete objects
|
||||||
|
on the backup bucket. Revoke the key in the Scaleway console, delete
|
||||||
|
the KV version, rotate.
|
||||||
|
|
||||||
|
**Cost to reverse:** delete the KV path, policy, and unused drafts.
|
||||||
|
WAL is not enabled yet, so there is no production archive to migrate.
|
||||||
|
|
||||||
|
**Decision:** approve, reject, or send back to phase 1.
|
||||||
|
Approval authorizes structure (empty path, policy). It does not
|
||||||
|
authorize ops-mason to handle the Scaleway secret values, and it does
|
||||||
|
not enable continuous archiving.
|
||||||
|
|
@ -1,99 +0,0 @@
|
||||||
---
|
|
||||||
id: platform-pg-backup-s3
|
|
||||||
demand_source: resource-control/workplans/RESOURCE-WP-0002-T04
|
|
||||||
consumer_repo: rapp-postgres
|
|
||||||
credential_type: openbao-kv-founder-provision
|
|
||||||
status: draft
|
|
||||||
approved_by: null
|
|
||||||
approved_at: null
|
|
||||||
created: "2026-08-14"
|
|
||||||
updated: "2026-08-14"
|
|
||||||
---
|
|
||||||
|
|
||||||
# Construction plan: scoped Barman key for platform-pg
|
|
||||||
|
|
||||||
## 1. Demand
|
|
||||||
|
|
||||||
`RESOURCE-WP-0002` T04 needs a Scaleway API key that can only operate
|
|
||||||
on bucket `railiance-platform-pg-backup` prefix `platform-pg/`, stored
|
|
||||||
in OpenBao, and later synced by External Secrets into Kubernetes Secret
|
|
||||||
`platform-pg-backup-s3` in namespace `databases`. CNPG/Barman is the
|
|
||||||
only runtime consumer. Founder mints the key in the Scaleway console
|
|
||||||
(the bootstrap key cannot `list application` / create IAM). ops-mason
|
|
||||||
builds the empty lane. Values never appear in git or chat.
|
|
||||||
|
|
||||||
## 2. Existing-structure survey
|
|
||||||
|
|
||||||
Checked 2026-08-14:
|
|
||||||
|
|
||||||
- **KV path does not exist.**
|
|
||||||
`platform/data/workloads/railiance/backup/platform-pg-backup-s3` is 404.
|
|
||||||
- **CCR-2026-0012** reserves that path and fields `ACCESS_KEY_ID`,
|
|
||||||
`ACCESS_SECRET_KEY`, `APPLICATION_ID`. Reuse it. Do not invent a
|
|
||||||
second path.
|
|
||||||
- **CCR-2026-0011** is the bootstrap key
|
|
||||||
(`platform/workloads/railiance/scaleway/bootstrap`). Different
|
|
||||||
purpose. Do not reuse those values as the runtime key.
|
|
||||||
- **CCR-2026-0004** is Nextcloud/age offsite. Different provider.
|
|
||||||
- **Catalog.** No `platform-pg-backup-s3` / `s3-backup` lane.
|
|
||||||
- **Auth.** Runtime delivery is External Secrets into `databases`.
|
|
||||||
Kubernetes auth role `external-secrets-platform-pg-backup` is the
|
|
||||||
CCR-declared steady state. railiance01 may need the same interim
|
|
||||||
AppRole/token pattern as email-connect / audit-core; that apply is
|
|
||||||
after the founder replaces placeholders.
|
|
||||||
- **Does an existing lane already satisfy this?** No live secret.
|
|
||||||
|
|
||||||
## 3. Proposed changes
|
|
||||||
|
|
||||||
| # | Action | Object | Reuse-vs-new rationale |
|
|
||||||
|---|---|---|---|
|
|
||||||
| 1 | reuse | CCR-2026-0012 path | Already reserved |
|
|
||||||
| 2 | create | policy `workload-kv-read-platform-pg-backup-s3` | File already written; apply after approval |
|
|
||||||
| 3 | create | empty KV v2 path (placeholders `xxx`) | Paste-once / UI replace has a home |
|
|
||||||
| 4 | defer | Kubernetes auth role / AppRole / ESO store | After real values exist |
|
|
||||||
| 5 | defer | catalog `platform-pg-backup-s3` | Pointer only; `warden_executes: false` until verified |
|
|
||||||
| 6 | defer | Scaleway bucket policy principal | Needs `APPLICATION_ID` from the founder |
|
|
||||||
|
|
||||||
No new rail. Scaleway operates S3.
|
|
||||||
|
|
||||||
## 4. Review notes
|
|
||||||
|
|
||||||
- **Naming:** path follows `platform/workloads/railiance/backup/…`.
|
|
||||||
Policy name matches the CCR.
|
|
||||||
- **TTL/scoping:** the Scaleway key is long-lived until rotated. The
|
|
||||||
OpenBao reader is ESO, 15m Kubernetes auth TTL in the CCR.
|
|
||||||
- **Redundancy:** does not reuse the bootstrap path or the Nextcloud
|
|
||||||
offsite lane.
|
|
||||||
- **Secret values:** mason does not read, write, or log them. Founder
|
|
||||||
uses the OpenBao UI or `docs/put-platform-pg-backup-s3.md`.
|
|
||||||
- **Founder remaining acts:** approve this plan and CCR-2026-0012;
|
|
||||||
create the IAM application and project-scoped key; replace `xxx`;
|
|
||||||
say “the Barman key is in bao.”
|
|
||||||
|
|
||||||
## 5. Executive summary
|
|
||||||
|
|
||||||
**One-line ask:** approve an OpenBao home for a bucket-scoped Barman
|
|
||||||
key so `rapp-postgres` can later receive Secret `platform-pg-backup-s3`
|
|
||||||
without putting keys in git or chat.
|
|
||||||
|
|
||||||
**Who gets access:** you (founder) to write the three fields; later,
|
|
||||||
only External Secrets bound to namespace `databases`. No other rapp.
|
|
||||||
|
|
||||||
**To what:** only
|
|
||||||
`platform/workloads/railiance/backup/platform-pg-backup-s3`
|
|
||||||
(`ACCESS_KEY_ID`, `ACCESS_SECRET_KEY`, `APPLICATION_ID`). Not the
|
|
||||||
bootstrap path.
|
|
||||||
|
|
||||||
**For how long:** until you rotate or revoke the Scaleway key.
|
|
||||||
|
|
||||||
**Blast radius if the credential leaks:** read/write/delete objects
|
|
||||||
under the backup prefix. Revoke the key in the Scaleway console,
|
|
||||||
delete the KV version, rotate.
|
|
||||||
|
|
||||||
**Cost to reverse:** delete the KV path, policy, and unused drafts.
|
|
||||||
WAL is not enabled yet, so there is no production archive to migrate.
|
|
||||||
|
|
||||||
**Decision:** approve, reject, or send back to phase 1.
|
|
||||||
Approval authorizes structure (empty path, policy). It does not
|
|
||||||
authorize ops-mason to handle the Scaleway secret values, and it does
|
|
||||||
not enable continuous archiving.
|
|
||||||
|
|
@ -29,8 +29,8 @@ Checked 2026-08-14:
|
||||||
|
|
||||||
- **KV path does not exist.**
|
- **KV path does not exist.**
|
||||||
`platform/metadata/workloads/railiance/scaleway/bootstrap` is 404.
|
`platform/metadata/workloads/railiance/scaleway/bootstrap` is 404.
|
||||||
Same for the later Barman path
|
Same for the later backup path
|
||||||
`platform/workloads/railiance/backup/platform-pg-backup-s3`.
|
`platform/workloads/railiance/backup/object-storage`.
|
||||||
- **CCR already reserved the path.**
|
- **CCR already reserved the path.**
|
||||||
`railiance-platform` `CCR-2026-0011` names
|
`railiance-platform` `CCR-2026-0011` names
|
||||||
`platform/workloads/railiance/scaleway/bootstrap` and the four fields.
|
`platform/workloads/railiance/scaleway/bootstrap` and the four fields.
|
||||||
|
|
@ -66,7 +66,7 @@ Terraform snippet → OpenBao fields (same four facts, scw-native names):
|
||||||
| 3 | create | policy `operator-kv-scaleway-bootstrap` (read/write that path only) | Founder desk and the bucket-create script; no sibling paths |
|
| 3 | create | policy `operator-kv-scaleway-bootstrap` (read/write that path only) | Founder desk and the bucket-create script; no sibling paths |
|
||||||
| 4 | reuse | founder paste-once desk + optional local tfvars ingest | ops-mason never sees values; four fields, four desk pastes or one founder-run ingest |
|
| 4 | reuse | founder paste-once desk + optional local tfvars ingest | ops-mason never sees values; four fields, four desk pastes or one founder-run ingest |
|
||||||
| 5 | propose | catalog `scaleway-bootstrap` (draft) + playbook | Pointer only; `warden_executes: false` |
|
| 5 | propose | catalog `scaleway-bootstrap` (draft) + playbook | Pointer only; `warden_executes: false` |
|
||||||
| 6 | defer | AppRole / ESO / scoped Barman key | T04 / CCR for `platform-pg-backup-s3`; not this plan |
|
| 6 | defer | AppRole / ESO / scoped backup key | T04 / CCR for `backup/object-storage`; not this plan |
|
||||||
|
|
||||||
No new rail. Scaleway operates S3.
|
No new rail. Scaleway operates S3.
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue