coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RAILIANCE-WP-0015: Option A CNPG logical backup coverage healthy
Some checks failed
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs,
generalize multi-cluster logical backup + status health for Option A,
seed encrypted uploads and restore-drill evidence; workplan finished.
This commit is contained in:
tegwick 2026-07-22 18:00:48 +02:00
parent 374ebed349
commit 6635fdc976
11 changed files with 929 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

33
manifests/cnpg-backup-readiness.yaml
View file

@ -1,16 +1,25 @@
# Operator-ready CNPG backup wiring template for railiance01 production DB clusters.
# Do not apply until platform supplies object-store credentials and destinationPath.
# Secrets referenced below are placeholders — create them via OpenBao/operator paths.
# CNPG backup readiness — Option A is the decided lane (RAILIANCE-WP-0015).
#
# Clusters covered: apps-pg, forgejo-db, net-kingdom-pg, state-hub-db
# Active manifests: manifests/cnpg-option-a-backup.yaml
# - CronJobs per cluster (logical pg_dump → age → Nextcloud WebDAV)
# - ServiceAccount + RBAC for pods/exec
# - Runner ConfigMap
#
# Apply sequence:
# 1. bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
# 2. make cnpg-backup-offsite-secret-apply # Secret cnpg-backup-offsite (no private key)
# 3. make cnpg-option-a-apply # CronJobs + RBAC
# 4. make cnpg-logical-backup # optional immediate workstation run
# 5. make cnpg-backup-status
#
# Barman ObjectStore / CNPG ScheduledBackup remains deferred (Phase 2). Do not
# apply the commented stubs below unless platform provisions an S3 ObjectStore
# and explicitly re-decides away from Option A.
#
# Clusters covered (CoulombCore databases): apps-pg, gitea-db, net-kingdom-pg, state-hub-db
# Check posture: make cnpg-backup-status
#
# Apply sequence (after credentials exist):
# 1. Create Secret cnpg-backup-s3 in namespace databases
# 2. Uncomment and patch ObjectStore + cluster backup patches per cluster
# 3. Apply ScheduledBackup resources
# 4. Run restore drill in isolated namespace; record non-secret evidence
---
# Deferred Phase 2 — barman ObjectStore (not active)
# apiVersion: barmancloud.cnpg.io/v1
# kind: ObjectStore
# metadata:
@ -36,7 +45,7 @@
# immediateCheckpoint: true
# retentionPolicy: 14d
---
# Example ScheduledBackup for apps-pg (repeat per cluster with spec.cluster.name)
# Deferred Phase 2 — example ScheduledBackup (not active)
# apiVersion: postgresql.cnpg.io/v1
# kind: ScheduledBackup
# metadata:
@ -49,4 +58,4 @@
# backupOwnerReference: self
# cluster:
# name: apps-pg
# immediate: true
# immediate: true