coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0013/0014: warden credential routing, CoulombCore kubeconfig, apps-pg backup dry-run
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 13s
Details

Browse source 
Document OpenBao/warden paths for the offsite backup lane and flag the sealed
Vault blocker. Point production Makefile targets at CoulombCore, auto-discover
CNPG clusters in backup status, add apps-pg pg_dump dry-run tooling, and
record Core Hub Helm cutover findings (live gitea image, adopt required).
This commit is contained in:
tegwick 2026-07-10 15:46:02 +02:00
parent cd7e7035ce
commit a689270f18
7 changed files with 229 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md
View file

@ -16,7 +16,7 @@ state_hub_workstream_id: "764c2447-0713-45d5-a14d-810a13027b8b"
Follow-up to `RAILIANCE-WP-0012-T04` and custodian inbox `a1957cce`. Observability
and manifest templates exist; production clusters on railiance01 still report
degraded backup posture via `make cnpg-backup-status`.
degraded backup posture via `make cnpg-backup-status` on CoulombCore production.
Evidence baseline:
`the-custodian/docs/evidence/vergabe-teilnahme-delivery-lane-20260710.json`
@ -31,15 +31,18 @@ the longer-term target in `manifests/cnpg-backup-readiness.yaml`.
```task
id: RAILIANCE-WP-0013-T01
status: todo
status: progress
priority: high
needs_human: true
intervention_note: "OpenBao sealed at bao.coulomb.social — operator unseal + OIDC login (railiance-backup-workload-kv-read) required"
state_hub_task_id: "f2051213-0a9f-418e-82ad-9bd7c79fd0dc"
```
Record the approved backup mechanism per cluster: Phase 1 logical dump vs barman
`ObjectStore` + `ScheduledBackup`. Identify OpenBao/operator paths for
`cnpg-backup-s3` or equivalent without copying secret values into Git,
workplans, or State Hub notes.
Credential routing in `docs/credential-routing-railiance-apps.md`. `warden access`
reaches the platform broker; KV fetch fails while OpenBao is sealed. Phase 1 lane:
`platform/workloads/railiance/backup/offsite-lane`. CoulombCore clusters:
`apps-pg`, `gitea-db`, `net-kingdom-pg`, `state-hub-db`. `make apps-pg-backup-dry-run`
succeeded (pg_dump + age encrypt; upload blocked on offsite-lane).
## Wire apps-pg backup coverage

11
workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md
View file

@ -24,18 +24,19 @@ deployed at `f95de14` while the source repo head is `1061f3e` (14-commit drift).
Production-touching deploy steps require explicit image tags and operator
approval. Do not store secrets in workplans.
## Core Hub server dry-run on Railiance01
## Core Hub server dry-run on CoulombCore
```task
id: RAILIANCE-WP-0014-T01
status: todo
status: progress
priority: high
state_hub_task_id: "b9dea9f3-f0c0-41c1-b9c4-ec4c44d43d55"
```
Run `CORE_HUB_IMAGE_TAG=<sha> make check-core-hub-image`,
`core-hub-server-dry-run`, and `core-hub-dry-run` against Railiance01. Record the
chosen image tag and any schema or secret prerequisites before apply.
Production on CoulombCore (`PRODUCTION_KUBECONFIG=~/.kube/config`). Live image:
`gitea.coulomb.social/coulomb/core-hub:a33191a`. `core-hub-prod-env` exists.
`core-hub-server-dry-run` blocked: existing Service/Deployment lack Helm ownership
metadata — needs adopt/patch before `helm upgrade --install`.
## Adopt Helm-managed Core Hub release