coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RAILIANCE-WP-0015: use workstation cron; suspend in-cluster CronJobs
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Cluster egress blocks age installs (github + Alpine CDN). Declare
workstation-cron schedule ConfigMap as the unattended path and keep
Option A CronJobs suspended until a prebuilt image is available.
This commit is contained in:
tegwick 2026-07-22 18:06:06 +02:00
parent cf742a0868
commit 1376b4f34c
4 changed files with 96 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/app-data-backup-restore-handoff.md
View file

@ -71,11 +71,19 @@ Nextcloud WebDAV via CronJobs in `manifests/cnpg-option-a-backup.yaml`.
```bash
bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
make cnpg-backup-offsite-secret-apply # Secret from OpenBao (no private key)
make cnpg-option-a-apply # CronJobs + RBAC
make cnpg-logical-backup # optional immediate workstation run
make cnpg-option-a-apply # schedule CM + RBAC + suspended CronJobs
make cnpg-logical-backup # immediate / daily workstation run
make cnpg-backup-status
```
**Unattended schedule (primary):** workstation cron (cluster pods lack egress to
install `age`; in-cluster CronJobs ship suspended until a prebuilt image exists):
```cron
# Daily 02:30 UTC — Option A multi-cluster logical backup (RPO 24h)
30 2 * * * cd $HOME/railiance-apps && make cnpg-logical-backup >>$HOME/.cache/railiance/backups/cnpg/cron.log 2>&1
```
Barman `ObjectStore` / CNPG `ScheduledBackup` remain deferred (Phase 2 stubs in
`manifests/cnpg-backup-readiness.yaml`).

4
docs/evidence/cnpg-option-a-backup-20260722.json
View file

@ -43,7 +43,9 @@
"rto_note": "decrypt + isolated restore completed under 5 minutes on operator workstation"
},
"notes": [
"First success wave seeded via workstation tools/cnpg-logical-backup.sh; CronJobs schedule daily 02:30–02:45 UTC.",
"First success wave seeded via workstation tools/cnpg-logical-backup.sh.",
"In-cluster CronJobs are suspended: cluster egress blocks github.com and Alpine CDN age installs.",
"Unattended path is workstation cron at 02:30 UTC (ConfigMap cnpg-option-a-schedule mode=workstation-cron).",
"AGE_PRIVATE_KEY remains OpenBao recovery escrow only — not stored in-cluster.",
"No secret values recorded in this evidence file."
]