coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RAILIANCE-WP-0015: Option A CNPG logical backup coverage healthy
Some checks failed
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs,
generalize multi-cluster logical backup + status health for Option A,
seed encrypted uploads and restore-drill evidence; workplan finished.
This commit is contained in:
tegwick 2026-07-22 18:00:48 +02:00
parent 374ebed349
commit 6635fdc976
11 changed files with 929 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/credential-routing-railiance-apps.md
View file

@ -43,12 +43,21 @@ OIDC (`railiance-backup-workload-kv-read`). Agent sessions cannot complete the
browser callback to `localhost:8250` — run login in an interactive operator shell,
then `make apps-pg-backup` or `tools/check-backup-lane-auth.sh`.
## CNPG Option A offsite Secret (RAILIANCE-WP-0015)
```bash
bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
make cnpg-backup-offsite-secret-apply # databases/cnpg-backup-offsite
make cnpg-option-a-apply # CronJobs
```
Secret keys: `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PUBLIC_KEY` only —
`AGE_PRIVATE_KEY` stays in OpenBao recovery escrow (never in-cluster).
## CNPG barman ObjectStore (Phase 2 — deferred)
Barman `ObjectStore` + `ScheduledBackup` templates live in
`manifests/cnpg-backup-readiness.yaml`. Apply only after platform provisions
object-store credentials at a confirmed path. Coordinate via `railiance-platform`;
do not invent S3 secrets in this repo.
Barman stubs remain in `manifests/cnpg-backup-readiness.yaml`. Do not apply
unless platform re-decides away from Option A and provisions S3 credentials.
## Core Hub runtime secrets