tegwick
6635fdc976
Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs, generalize multi-cluster logical backup + status health for Option A, seed encrypted uploads and restore-drill evidence; workplan finished.
61 lines
2 KiB
YAML
61 lines
2 KiB
YAML
# CNPG backup readiness — Option A is the decided lane (RAILIANCE-WP-0015).
|
|
#
|
|
# Active manifests: manifests/cnpg-option-a-backup.yaml
|
|
# - CronJobs per cluster (logical pg_dump → age → Nextcloud WebDAV)
|
|
# - ServiceAccount + RBAC for pods/exec
|
|
# - Runner ConfigMap
|
|
#
|
|
# Apply sequence:
|
|
# 1. bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
|
|
# 2. make cnpg-backup-offsite-secret-apply # Secret cnpg-backup-offsite (no private key)
|
|
# 3. make cnpg-option-a-apply # CronJobs + RBAC
|
|
# 4. make cnpg-logical-backup # optional immediate workstation run
|
|
# 5. make cnpg-backup-status
|
|
#
|
|
# Barman ObjectStore / CNPG ScheduledBackup remains deferred (Phase 2). Do not
|
|
# apply the commented stubs below unless platform provisions an S3 ObjectStore
|
|
# and explicitly re-decides away from Option A.
|
|
#
|
|
# Clusters covered (CoulombCore databases): apps-pg, gitea-db, net-kingdom-pg, state-hub-db
|
|
# Check posture: make cnpg-backup-status
|
|
---
|
|
# Deferred Phase 2 — barman ObjectStore (not active)
|
|
# apiVersion: barmancloud.cnpg.io/v1
|
|
# kind: ObjectStore
|
|
# metadata:
|
|
# name: railiance-cnpg-backups
|
|
# namespace: databases
|
|
# labels:
|
|
# app.kubernetes.io/part-of: railiance-apps
|
|
# spec:
|
|
# configuration:
|
|
# destinationPath: s3://REPLACE_ME/railiance-cnpg/
|
|
# endpointURL: https://REPLACE_ME
|
|
# s3Credentials:
|
|
# accessKeyId:
|
|
# name: cnpg-backup-s3
|
|
# key: ACCESS_KEY_ID
|
|
# secretAccessKey:
|
|
# name: cnpg-backup-s3
|
|
# key: SECRET_ACCESS_KEY
|
|
# wal:
|
|
# compression: gzip
|
|
# data:
|
|
# compression: gzip
|
|
# immediateCheckpoint: true
|
|
# retentionPolicy: 14d
|
|
---
|
|
# Deferred Phase 2 — example ScheduledBackup (not active)
|
|
# apiVersion: postgresql.cnpg.io/v1
|
|
# kind: ScheduledBackup
|
|
# metadata:
|
|
# name: apps-pg-daily
|
|
# namespace: databases
|
|
# labels:
|
|
# app.kubernetes.io/part-of: railiance-apps
|
|
# spec:
|
|
# schedule: "0 0 2 * * *"
|
|
# backupOwnerReference: self
|
|
# cluster:
|
|
# name: apps-pg
|
|
# immediate: true
|