---
id: platform-pg-backup-s3
demand_source: resource-control/workplans/RESOURCE-WP-0002-T04
consumer_repo: rapp-postgres
credential_type: openbao-kv-founder-provision
status: draft
approved_by: null
approved_at: null
created: "2026-08-14"
updated: "2026-08-14"
---

# Construction plan: scoped Barman key for platform-pg

## 1. Demand

`RESOURCE-WP-0002` T04 needs a Scaleway API key that can only operate
on bucket `railiance-platform-pg-backup` prefix `platform-pg/`, stored
in OpenBao, and later synced by External Secrets into Kubernetes Secret
`platform-pg-backup-s3` in namespace `databases`. CNPG/Barman is the
only runtime consumer. Founder mints the key in the Scaleway console
(the bootstrap key cannot `list application` / create IAM). ops-mason
builds the empty lane. Values never appear in git or chat.

## 2. Existing-structure survey

Checked 2026-08-14:

- **KV path does not exist.**
  `platform/data/workloads/railiance/backup/platform-pg-backup-s3` is 404.
- **CCR-2026-0012** reserves that path and fields `ACCESS_KEY_ID`,
  `ACCESS_SECRET_KEY`, `APPLICATION_ID`. Reuse it. Do not invent a
  second path.
- **CCR-2026-0011** is the bootstrap key
  (`platform/workloads/railiance/scaleway/bootstrap`). Different
  purpose. Do not reuse those values as the runtime key.
- **CCR-2026-0004** is Nextcloud/age offsite. Different provider.
- **Catalog.** No `platform-pg-backup-s3` / `s3-backup` lane.
- **Auth.** Runtime delivery is External Secrets into `databases`.
  Kubernetes auth role `external-secrets-platform-pg-backup` is the
  CCR-declared steady state. railiance01 may need the same interim
  AppRole/token pattern as email-connect / audit-core; that apply is
  after the founder replaces placeholders.
- **Does an existing lane already satisfy this?** No live secret.

## 3. Proposed changes

| # | Action | Object | Reuse-vs-new rationale |
|---|---|---|---|
| 1 | reuse | CCR-2026-0012 path | Already reserved |
| 2 | create | policy `workload-kv-read-platform-pg-backup-s3` | File already written; apply after approval |
| 3 | create | empty KV v2 path (placeholders `xxx`) | Paste-once / UI replace has a home |
| 4 | defer | Kubernetes auth role / AppRole / ESO store | After real values exist |
| 5 | defer | catalog `platform-pg-backup-s3` | Pointer only; `warden_executes: false` until verified |
| 6 | defer | Scaleway bucket policy principal | Needs `APPLICATION_ID` from the founder |

No new rail. Scaleway operates S3.

## 4. Review notes

- **Naming:** path follows `platform/workloads/railiance/backup/…`.
  Policy name matches the CCR.
- **TTL/scoping:** the Scaleway key is long-lived until rotated. The
  OpenBao reader is ESO, 15m Kubernetes auth TTL in the CCR.
- **Redundancy:** does not reuse the bootstrap path or the Nextcloud
  offsite lane.
- **Secret values:** mason does not read, write, or log them. Founder
  uses the OpenBao UI or `docs/put-platform-pg-backup-s3.md`.
- **Founder remaining acts:** approve this plan and CCR-2026-0012;
  create the IAM application and project-scoped key; replace `xxx`;
  say “the Barman key is in bao.”

## 5. Executive summary

**One-line ask:** approve an OpenBao home for a bucket-scoped Barman
key so `rapp-postgres` can later receive Secret `platform-pg-backup-s3`
without putting keys in git or chat.

**Who gets access:** you (founder) to write the three fields; later,
only External Secrets bound to namespace `databases`. No other rapp.

**To what:** only
`platform/workloads/railiance/backup/platform-pg-backup-s3`
(`ACCESS_KEY_ID`, `ACCESS_SECRET_KEY`, `APPLICATION_ID`). Not the
bootstrap path.

**For how long:** until you rotate or revoke the Scaleway key.

**Blast radius if the credential leaks:** read/write/delete objects
under the backup prefix. Revoke the key in the Scaleway console,
delete the KV version, rotate.

**Cost to reverse:** delete the KV path, policy, and unused drafts.
WAL is not enabled yet, so there is no production archive to migrate.

**Decision:** approve, reject, or send back to phase 1.
Approval authorizes structure (empty path, policy). It does not
authorize ops-mason to handle the Scaleway secret values, and it does
not enable continuous archiving.