tegwick
1376b4f34c
Cluster egress blocks age installs (github + Alpine CDN). Declare workstation-cron schedule ConfigMap as the unattended path and keep Option A CronJobs suspended until a prebuilt image is available.
52 lines
2.2 KiB
JSON
52 lines
2.2 KiB
JSON
{
|
|
"workplan": "RAILIANCE-WP-0015",
|
|
"lane": "option-a",
|
|
"recorded_at": "2026-07-22T16:00:00Z",
|
|
"cluster_api": "CoulombCore databases namespace",
|
|
"rpo_target_hours": 24,
|
|
"rto_target_hours": 4,
|
|
"artifacts": {
|
|
"secret": "databases/cnpg-backup-offsite",
|
|
"secret_keys": ["NC_WEBDAV_TOKEN", "NC_WEBDAV_URL", "AGE_PUBLIC_KEY"],
|
|
"cronjobs": [
|
|
"cnpg-logical-backup-apps-pg",
|
|
"cnpg-logical-backup-gitea-db",
|
|
"cnpg-logical-backup-net-kingdom-pg",
|
|
"cnpg-logical-backup-state-hub-db"
|
|
],
|
|
"status_configmap": "databases/cnpg-option-a-status",
|
|
"last_success": {
|
|
"apps-pg": "20260722T155755Z",
|
|
"gitea-db": "20260722T155755Z",
|
|
"net-kingdom-pg": "20260722T155755Z",
|
|
"state-hub-db": "20260722T155732Z"
|
|
}
|
|
},
|
|
"uploads": [
|
|
"apps-pg/apps-pg-apps_meta-20260722T155755Z.dump.age",
|
|
"apps-pg/apps-pg-core_hub-20260722T155755Z.dump.age",
|
|
"apps-pg/apps-pg-core_hub_staging-20260722T155755Z.dump.age",
|
|
"apps-pg/apps-pg-vergabe_db-20260722T155755Z.dump.age",
|
|
"gitea-db/gitea-db-gitea-20260722T155755Z.dump.age",
|
|
"net-kingdom-pg/net-kingdom-pg-interhub-20260722T155755Z.dump.age",
|
|
"net-kingdom-pg/net-kingdom-pg-privacyidea_db-20260722T155755Z.dump.age",
|
|
"state-hub-db/state-hub-db-state_hub-20260722T155732Z.dump.age"
|
|
],
|
|
"status_command": "make cnpg-backup-status",
|
|
"status_result": "ok — all tracked clusters have healthy Option A (or barman) backup coverage",
|
|
"restore_drill": {
|
|
"cluster": "apps-pg",
|
|
"database": "vergabe_db",
|
|
"source_artifact": "apps-pg-vergabe_db-20260722T155755Z.dump.age",
|
|
"evidence": "docs/evidence/apps-pg-restore-drill-20260722T155951Z.json",
|
|
"row_gate": "195/195 pass",
|
|
"rto_note": "decrypt + isolated restore completed under 5 minutes on operator workstation"
|
|
},
|
|
"notes": [
|
|
"First success wave seeded via workstation tools/cnpg-logical-backup.sh.",
|
|
"In-cluster CronJobs are suspended: cluster egress blocks github.com and Alpine CDN age installs.",
|
|
"Unattended path is workstation cron at 02:30 UTC (ConfigMap cnpg-option-a-schedule mode=workstation-cron).",
|
|
"AGE_PRIVATE_KEY remains OpenBao recovery escrow only — not stored in-cluster.",
|
|
"No secret values recorded in this evidence file."
|
|
]
|
|
}
|