retarget: CCR-2026-0012 is the general backup object-store lane
Use IAM application resource-control and policy Scoped backup access. OpenBao path is platform/workloads/railiance/backup/object-storage. rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.
This commit is contained in:
codex
parent
2769258631
commit
94b2f7cc9c
8 changed files with 160 additions and 143 deletions
|
|
@ -55,7 +55,7 @@ risk:
|
|||
classification: high
|
||||
notes:
|
||||
- Bootstrap key can create projects/buckets; rotate or delete after scoped key exists.
|
||||
- Scoped Barman key is a different path: platform/workloads/railiance/backup/platform-pg-backup-s3
|
||||
- Scoped backup key is a different path: platform/workloads/railiance/backup/object-storage
|
||||
- Values must not appear in Git, State Hub, or chat.
|
||||
verification:
|
||||
positive:
|
||||
|
|
@ -64,5 +64,5 @@ verification:
|
|||
- default-policy token denied on the data path.
|
||||
lifecycle:
|
||||
deactivate: Delete bootstrap key at Scaleway after the scoped bucket key works.
|
||||
rotate: Put a new bootstrap key; do not reuse the Barman key.
|
||||
rotate: Put a new bootstrap key; do not reuse the scoped backup key.
|
||||
compromised: Revoke both Scaleway keys; rotate bucket policy.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,112 @@
|
|||
id: CCR-2026-0012
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: Scaleway scoped backup object-storage key
|
||||
status: proposed
|
||||
created: '2026-08-14'
|
||||
updated: '2026-08-14'
|
||||
requester:
|
||||
agent: grok
|
||||
reason: >-
|
||||
RESOURCE-WP-0002 T04 needs a renewable, revocable, project-scoped
|
||||
Scaleway backup key in OpenBao. Custody is the resource-control
|
||||
procuring identity, not a Barman-specific application. First
|
||||
consumer is rapp-postgres (Secret platform-pg-backup-s3). The
|
||||
bootstrap key (CCR-2026-0011) must not be the runtime key.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: railiance
|
||||
workload: backup
|
||||
rapp: rapp-postgres
|
||||
environment: production
|
||||
purpose: >-
|
||||
Object-store credentials for Railiance backup destinations.
|
||||
Secret keys ACCESS_KEY_ID and ACCESS_SECRET_KEY. APPLICATION_ID
|
||||
is the resource-control IAM application (for a later bucket
|
||||
policy). Endpoint, bucket, prefix, and region stay on reef-storage.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/railiance/backup/object-storage
|
||||
fields:
|
||||
- ACCESS_KEY_ID
|
||||
- ACCESS_SECRET_KEY
|
||||
- APPLICATION_ID
|
||||
policy_name: workload-kv-read-backup-object-storage
|
||||
policy_file: openbao/policies/workload-kv-read-backup-object-storage.hcl
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-backup-object-storage
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: false
|
||||
policies:
|
||||
- workload-kv-read-backup-object-storage
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: ops-warden
|
||||
catalog_id: backup-object-storage
|
||||
selector: resource-control scoped backup access
|
||||
command: warden access backup-object-storage --fetch ACCESS_KEY_ID
|
||||
resolvable: false
|
||||
readiness: pending-review
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: >-
|
||||
ClusterSecretStore openbao-backup-object-storage (first namespace
|
||||
condition: databases) → ExternalSecret databases/platform-pg-backup-s3
|
||||
→ Secret platform-pg-backup-s3 (consumer projection). Drafts live
|
||||
under railiance-platform/argocd/platform-addons/openbao-secretstore/
|
||||
and rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml.
|
||||
Do not apply until this CCR is approved and the KV values are real.
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- Scaleway policies attach to the IAM application, not to one API key.
|
||||
Application resource-control must hold only backup-scoped keys.
|
||||
- The runtime key can write and delete backup objects. Compromise can
|
||||
destroy recovery points or fill the bucket.
|
||||
- The bootstrap key (CCR-2026-0011) must stay off this application and
|
||||
be revoked after this key works.
|
||||
- Do not enable continuous WAL archiving until the empty-archive
|
||||
preflight passes (RESOURCE-WP-0002 T05).
|
||||
- Values must not appear in Git, State Hub, logs, or chat.
|
||||
verification:
|
||||
positive:
|
||||
- Field names present on the KV path; values not printed.
|
||||
- An approved databases-namespace ExternalSecret can sync ACCESS_KEY_ID
|
||||
and ACCESS_SECRET_KEY to Secret platform-pg-backup-s3.
|
||||
- The scoped key can list/put/delete backup prefixes on the procured
|
||||
bucket.
|
||||
negative:
|
||||
- A token without this policy cannot read the KV path.
|
||||
- A namespace outside the ClusterSecretStore condition cannot use the store.
|
||||
- A second, unused key (or revoked key) cannot access the bucket.
|
||||
- The scoped key cannot create compute resources.
|
||||
activation_conditions:
|
||||
- Platform-operator approves this CCR.
|
||||
- Founder creates or reuses IAM application resource-control, binds
|
||||
policy Scoped backup access, mints the API key of that name, then
|
||||
replaces OpenBao placeholders.
|
||||
- ESO store and ExternalSecret applied only after values are real.
|
||||
lifecycle:
|
||||
deactivate: Disable the catalog entry, delete consumer ExternalSecrets,
|
||||
revoke the Scoped backup access API key. Keep application
|
||||
resource-control if other backup keys remain.
|
||||
rotate: Overlap-first. Put a new key in OpenBao, wait for ESO refresh,
|
||||
revoke the old Scaleway key.
|
||||
compromised: Revoke the Scoped backup access key and the bootstrap key
|
||||
at Scaleway, rotate this path, review bucket contents, open incident
|
||||
follow-up.
|
||||
state_hub:
|
||||
workplan_id: RESOURCE-WP-0002
|
||||
task_id: RESOURCE-WP-0002-T04
|
||||
|
|
@ -1,103 +0,0 @@
|
|||
id: CCR-2026-0012
|
||||
kind: credential-change-request
|
||||
schema_version: 1
|
||||
request_type: workload-kv-read
|
||||
title: Scaleway scoped Barman key for platform-pg backup
|
||||
status: proposed
|
||||
created: '2026-08-14'
|
||||
updated: '2026-08-14'
|
||||
requester:
|
||||
agent: grok
|
||||
reason: >-
|
||||
RESOURCE-WP-0002 T04 needs a renewable, revocable, bucket-and-prefix
|
||||
scoped Scaleway key in OpenBao so railiance-platform can vend Secret
|
||||
platform-pg-backup-s3 into the databases namespace. The bootstrap key
|
||||
(CCR-2026-0011) can create buckets and must not be the runtime key.
|
||||
review:
|
||||
required: true
|
||||
required_approvers:
|
||||
- platform-operator
|
||||
comments: []
|
||||
target:
|
||||
domain: financials
|
||||
tenant: railiance
|
||||
workload: platform-pg-backup
|
||||
rapp: rapp-postgres
|
||||
environment: production
|
||||
purpose: >-
|
||||
CNPG/Barman object-store credentials for platform-pg WAL and base
|
||||
backups. Secret keys ACCESS_KEY_ID and ACCESS_SECRET_KEY only.
|
||||
Endpoint, bucket, prefix, and region stay on reef-storage.
|
||||
openbao:
|
||||
mount: platform
|
||||
kv_path: platform/workloads/railiance/backup/platform-pg-backup-s3
|
||||
fields:
|
||||
- ACCESS_KEY_ID
|
||||
- ACCESS_SECRET_KEY
|
||||
- APPLICATION_ID
|
||||
policy_name: workload-kv-read-platform-pg-backup-s3
|
||||
policy_file: openbao/policies/workload-kv-read-platform-pg-backup-s3.hcl
|
||||
auth:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
role: external-secrets-platform-pg-backup
|
||||
bound_claims:
|
||||
service_account_names:
|
||||
- external-secrets
|
||||
service_account_namespaces:
|
||||
- external-secrets
|
||||
bound_claims_confirmed: false
|
||||
policies:
|
||||
- workload-kv-read-platform-pg-backup-s3
|
||||
ttl: 15m
|
||||
access_frontdoor:
|
||||
type: ops-warden
|
||||
catalog_id: platform-pg-backup-s3
|
||||
selector: platform-pg Barman Scaleway key
|
||||
command: warden access platform-pg-backup-s3 --fetch ACCESS_KEY_ID
|
||||
resolvable: false
|
||||
readiness: pending-review
|
||||
delivery:
|
||||
surface: external-secrets
|
||||
target: >-
|
||||
ClusterSecretStore openbao-platform-pg-backup (namespace condition
|
||||
databases) → ExternalSecret databases/platform-pg-backup-s3 → Secret
|
||||
platform-pg-backup-s3 with keys ACCESS_KEY_ID and ACCESS_SECRET_KEY.
|
||||
Drafts live under railiance-platform/argocd/platform-addons/openbao-secretstore/
|
||||
and rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml.
|
||||
Do not apply until this CCR is approved and the KV values are real.
|
||||
risk:
|
||||
classification: high
|
||||
notes:
|
||||
- The runtime key can write and delete objects under the backup prefix.
|
||||
Compromise can destroy recovery points or fill the bucket.
|
||||
- The bootstrap key (CCR-2026-0011) must be revoked after this key works.
|
||||
- Do not enable continuous WAL archiving until the empty-archive preflight
|
||||
passes (RESOURCE-WP-0002 T05).
|
||||
- Values must not appear in Git, State Hub, logs, or chat.
|
||||
verification:
|
||||
positive:
|
||||
- Field names present on the KV path; values not printed.
|
||||
- An approved databases-namespace ExternalSecret can sync ACCESS_KEY_ID
|
||||
and ACCESS_SECRET_KEY to Secret platform-pg-backup-s3.
|
||||
- The scoped key can list/put/delete only under prefix platform-pg/.
|
||||
negative:
|
||||
- A token without this policy cannot read the KV path.
|
||||
- A namespace outside the ClusterSecretStore condition cannot use the store.
|
||||
- A second, unused key (or revoked key) cannot access the bucket.
|
||||
- The scoped key cannot list sibling buckets or create compute resources.
|
||||
activation_conditions:
|
||||
- Platform-operator approves this CCR.
|
||||
- Founder creates the Scaleway IAM application and project-scoped
|
||||
Object Storage key, then replaces OpenBao placeholders.
|
||||
- ESO store and ExternalSecret applied only after values are real.
|
||||
lifecycle:
|
||||
deactivate: Disable the catalog entry, delete the ExternalSecret, revoke
|
||||
the Scaleway API key, delete the IAM application.
|
||||
rotate: Overlap-first. Put a new key in OpenBao, wait for ESO refresh,
|
||||
revoke the old Scaleway key.
|
||||
compromised: Revoke both the Barman key and the bootstrap key at Scaleway,
|
||||
rotate this path, review bucket contents, open incident follow-up.
|
||||
state_hub:
|
||||
workplan_id: RESOURCE-WP-0002
|
||||
task_id: RESOURCE-WP-0002-T04
|
||||
Loading…
Add table
Add a link
Reference in a new issue