feat: propose CCR-2026-0012 for platform-pg Barman key

Workload KV path and ESO drafts for Secret platform-pg-backup-s3.
Founder mints the project-scoped Scaleway application; values stay
out of git.

credential-change-requests/CCR-2026-0012-platform-pg-backup-s3.yaml

@@ -0,0 +1,103 @@
+id: CCR-2026-0012
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Scaleway scoped Barman key for platform-pg backup
+status: proposed
+created: '2026-08-14'
+updated: '2026-08-14'
+requester:
+  agent: grok
+  reason: >-
+    RESOURCE-WP-0002 T04 needs a renewable, revocable, bucket-and-prefix
+    scoped Scaleway key in OpenBao so railiance-platform can vend Secret
+    platform-pg-backup-s3 into the databases namespace. The bootstrap key
+    (CCR-2026-0011) can create buckets and must not be the runtime key.
+review:
+  required: true
+  required_approvers:
+  - platform-operator
+  comments: []
+target:
+  domain: financials
+  tenant: railiance
+  workload: platform-pg-backup
+  rapp: rapp-postgres
+  environment: production
+  purpose: >-
+    CNPG/Barman object-store credentials for platform-pg WAL and base
+    backups. Secret keys ACCESS_KEY_ID and ACCESS_SECRET_KEY only.
+    Endpoint, bucket, prefix, and region stay on reef-storage.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/railiance/backup/platform-pg-backup-s3
+  fields:
+  - ACCESS_KEY_ID
+  - ACCESS_SECRET_KEY
+  - APPLICATION_ID
+  policy_name: workload-kv-read-platform-pg-backup-s3
+  policy_file: openbao/policies/workload-kv-read-platform-pg-backup-s3.hcl
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: external-secrets-platform-pg-backup
+    bound_claims:
+      service_account_names:
+      - external-secrets
+      service_account_namespaces:
+      - external-secrets
+    bound_claims_confirmed: false
+    policies:
+    - workload-kv-read-platform-pg-backup-s3
+    ttl: 15m
+access_frontdoor:
+  type: ops-warden
+  catalog_id: platform-pg-backup-s3
+  selector: platform-pg Barman Scaleway key
+  command: warden access platform-pg-backup-s3 --fetch ACCESS_KEY_ID
+  resolvable: false
+  readiness: pending-review
+delivery:
+  surface: external-secrets
+  target: >-
+    ClusterSecretStore openbao-platform-pg-backup (namespace condition
+    databases) → ExternalSecret databases/platform-pg-backup-s3 → Secret
+    platform-pg-backup-s3 with keys ACCESS_KEY_ID and ACCESS_SECRET_KEY.
+    Drafts live under railiance-platform/argocd/platform-addons/openbao-secretstore/
+    and rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml.
+    Do not apply until this CCR is approved and the KV values are real.
+risk:
+  classification: high
+  notes:
+  - The runtime key can write and delete objects under the backup prefix.
+    Compromise can destroy recovery points or fill the bucket.
+  - The bootstrap key (CCR-2026-0011) must be revoked after this key works.
+  - Do not enable continuous WAL archiving until the empty-archive preflight
+    passes (RESOURCE-WP-0002 T05).
+  - Values must not appear in Git, State Hub, logs, or chat.
+verification:
+  positive:
+  - Field names present on the KV path; values not printed.
+  - An approved databases-namespace ExternalSecret can sync ACCESS_KEY_ID
+    and ACCESS_SECRET_KEY to Secret platform-pg-backup-s3.
+  - The scoped key can list/put/delete only under prefix platform-pg/.
+  negative:
+  - A token without this policy cannot read the KV path.
+  - A namespace outside the ClusterSecretStore condition cannot use the store.
+  - A second, unused key (or revoked key) cannot access the bucket.
+  - The scoped key cannot list sibling buckets or create compute resources.
+  activation_conditions:
+  - Platform-operator approves this CCR.
+  - Founder creates the Scaleway IAM application and project-scoped
+    Object Storage key, then replaces OpenBao placeholders.
+  - ESO store and ExternalSecret applied only after values are real.
+lifecycle:
+  deactivate: Disable the catalog entry, delete the ExternalSecret, revoke
+    the Scaleway API key, delete the IAM application.
+  rotate: Overlap-first. Put a new key in OpenBao, wait for ESO refresh,
+    revoke the old Scaleway key.
+  compromised: Revoke both the Barman key and the bootstrap key at Scaleway,
+    rotate this path, review bucket contents, open incident follow-up.
+state_hub:
+  workplan_id: RESOURCE-WP-0002
+  task_id: RESOURCE-WP-0002-T04