coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: vend platform-pg-backup-s3 via AppRole ESO

Browse source 
Policy and AppRole applied. Store Valid, ExternalSecret SecretSynced.
Prefix empty. WAL not enabled.
This commit is contained in:
codex 2026-08-14 20:00:15 +02:00
parent cbc6398583
commit 625991469a
3 changed files with 27 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/evidence/CCR-2026-0012-backup-key-verify-2026-08-14.md
View file

@ -1,7 +1,7 @@
# CCR-2026-0012 — scoped backup key verification
Date: 2026-08-14
Status: **key live in OpenBao; cluster Secret not vended**
Status: **applied — Secret `databases/platform-pg-backup-s3` synced**
CCR: approved in chat 2026-08-14
Path: `platform/workloads/railiance/backup/object-storage` (KV v2 version 1)
@ -23,7 +23,9 @@ Distinct from the CCR-2026-0011 bootstrap key (`keys_differ=yes`).
- `scw object bucket list` / `get railiance-platform-pg-backup` in `nl-ams` succeeded.
- boto3 put/get/delete of a probe object under `platform-pg/` succeeded; probe deleted.
- Sibling prefix write also succeeded: no bucket policy yet, so prefix isolation is not enforced.
- Sibling prefix write is now denied (`AccessDenied`) after the
`resource-control-scoped-backup` bucket policy
(`BackupListPrefix`, `BackupObjectsUnderPrefix`) applied 2026-08-14.
## Negative
@ -34,13 +36,12 @@ Distinct from the CCR-2026-0011 bootstrap key (`keys_differ=yes`).
`instance` / `vpc` / `rdb` / `registry` / `lb` list returned empty success. That is consistent with a project that has no those resources; it is not a proven compute-write deny. Do not create a paid resource to prove it.
## Not done
## Cluster delivery (same day)
- OpenBao policy `workload-kv-read-backup-object-storage` — this token cannot `sys/policies/acl` write (403).
- ClusterSecretStore / ExternalSecret — railiance01 has no `platform-pg-backup-s3` yet; applying the draft store would fail without ESO auth.
- Bucket policy — needs `APPLICATION_ID`.
- WAL / `barmanObjectStore` on `platform-pg` — T05.
## Next
ops-mason (or a token that can write policies and ESO auth) applies the OpenBao policy and the `databases`-scoped store. Then ExternalSecret can project the Secret. After that, empty-WAL-archive preflight; still no continuous archiving until T05.
- Policy `workload-kv-read-backup-object-storage` written.
- AppRole `external-secrets-backup-object-storage` (15m/30m, 8 uses).
- Secret `external-secrets/openbao-backup-object-storage-approle` applied; local delivery shredded.
- ClusterSecretStore `openbao-backup-object-storage` Ready/Valid, condition `databases` only.
- ExternalSecret `databases/platform-pg-backup-s3` SecretSynced. Keys `ACCESS_KEY_ID` (len 20) and `ACCESS_SECRET_KEY` (len 36). Values not read.
- Prefix `platform-pg/` object count: 0.
- `platform-pg` still has no `barmanObjectStore`. WAL is T05.