tegwick
6635fdc976
Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs, generalize multi-cluster logical backup + status health for Option A, seed encrypted uploads and restore-drill evidence; workplan finished.
50 lines
2.1 KiB
JSON
50 lines
2.1 KiB
JSON
{
|
||
"workplan": "RAILIANCE-WP-0015",
|
||
"lane": "option-a",
|
||
"recorded_at": "2026-07-22T16:00:00Z",
|
||
"cluster_api": "CoulombCore databases namespace",
|
||
"rpo_target_hours": 24,
|
||
"rto_target_hours": 4,
|
||
"artifacts": {
|
||
"secret": "databases/cnpg-backup-offsite",
|
||
"secret_keys": ["NC_WEBDAV_TOKEN", "NC_WEBDAV_URL", "AGE_PUBLIC_KEY"],
|
||
"cronjobs": [
|
||
"cnpg-logical-backup-apps-pg",
|
||
"cnpg-logical-backup-gitea-db",
|
||
"cnpg-logical-backup-net-kingdom-pg",
|
||
"cnpg-logical-backup-state-hub-db"
|
||
],
|
||
"status_configmap": "databases/cnpg-option-a-status",
|
||
"last_success": {
|
||
"apps-pg": "20260722T155755Z",
|
||
"gitea-db": "20260722T155755Z",
|
||
"net-kingdom-pg": "20260722T155755Z",
|
||
"state-hub-db": "20260722T155732Z"
|
||
}
|
||
},
|
||
"uploads": [
|
||
"apps-pg/apps-pg-apps_meta-20260722T155755Z.dump.age",
|
||
"apps-pg/apps-pg-core_hub-20260722T155755Z.dump.age",
|
||
"apps-pg/apps-pg-core_hub_staging-20260722T155755Z.dump.age",
|
||
"apps-pg/apps-pg-vergabe_db-20260722T155755Z.dump.age",
|
||
"gitea-db/gitea-db-gitea-20260722T155755Z.dump.age",
|
||
"net-kingdom-pg/net-kingdom-pg-interhub-20260722T155755Z.dump.age",
|
||
"net-kingdom-pg/net-kingdom-pg-privacyidea_db-20260722T155755Z.dump.age",
|
||
"state-hub-db/state-hub-db-state_hub-20260722T155732Z.dump.age"
|
||
],
|
||
"status_command": "make cnpg-backup-status",
|
||
"status_result": "ok — all tracked clusters have healthy Option A (or barman) backup coverage",
|
||
"restore_drill": {
|
||
"cluster": "apps-pg",
|
||
"database": "vergabe_db",
|
||
"source_artifact": "apps-pg-vergabe_db-20260722T155755Z.dump.age",
|
||
"evidence": "docs/evidence/apps-pg-restore-drill-20260722T155951Z.json",
|
||
"row_gate": "195/195 pass",
|
||
"rto_note": "decrypt + isolated restore completed under 5 minutes on operator workstation"
|
||
},
|
||
"notes": [
|
||
"First success wave seeded via workstation tools/cnpg-logical-backup.sh; CronJobs schedule daily 02:30–02:45 UTC.",
|
||
"AGE_PRIVATE_KEY remains OpenBao recovery escrow only — not stored in-cluster.",
|
||
"No secret values recorded in this evidence file."
|
||
]
|
||
}
|