coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

retarget: CCR-2026-0012 is the general backup object-store lane

Browse source 
Use IAM application resource-control and policy Scoped backup access.
OpenBao path is platform/workloads/railiance/backup/object-storage.
rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.
This commit is contained in:
codex 2026-08-14 19:19:56 +02:00
parent 2769258631
commit 94b2f7cc9c
8 changed files with 160 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

72
docs/put-platform-pg-backup-s3.md
View file

@ -1,72 +0,0 @@
# Put the scoped Barman key (founder, local only)
Do this on a trusted terminal. **Do not paste ACCESS_KEY_ID or
ACCESS_SECRET_KEY into chat, Git, or State Hub.**
CCR: `credential-change-requests/CCR-2026-0012-platform-pg-backup-s3.yaml`
Path: `platform/workloads/railiance/backup/platform-pg-backup-s3`
This is **not** the bootstrap key (`…/scaleway/bootstrap`). That key
created the bucket. This key is the CNPG/Barman runtime identity.
## 1. Create a dedicated IAM application
In [console.scaleway.com](https://console.scaleway.com) → IAM → Applications:
1. Create application `railiance-barman-platform-pg`.
2. Create an API key **on that application** (not on your user):
- Description: `platform-pg Barman runtime`
- **Preferred Project for Object Storage:** the project that owns
bucket `railiance-platform-pg-backup`
3. Copy the access key and secret key into a local scratch file
(`chmod 600`). The secret is shown once.
## 2. Attach a project-scoped Object Storage policy
IAM → Policies → create `railiance-barman-platform-pg-objects`:
- Principal: the application from step 1
- Scope: **that one project**, not the whole Organization
- Permission sets, if the console lists them:
- `ObjectStorageBucketsRead`
- `ObjectStorageObjectsRead`
- `ObjectStorageObjectsWrite`
- `ObjectStorageObjectsDelete`
- If those sets are not listed, `ObjectStorageFullAccess` **on this
project only** is acceptable because the project should contain only
this backup bucket.
Do **not** attach `IAM*` or compute permission sets.
## 3. Put the values in OpenBao
On this host, with a token that can write the `platform` mount:
```bash
bao kv put platform/workloads/railiance/backup/platform-pg-backup-s3 \
ACCESS_KEY_ID='SCWxxxxxxxx' \
ACCESS_SECRET_KEY='xxxxxxxx' \
APPLICATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
```
Or replace the `xxx` placeholders in the OpenBao UI on that same path.
`APPLICATION_ID` is the IAM application UUID (not a secret). It is needed
later for the bucket policy.
## 4. Confirm without printing values
```bash
bao kv metadata get platform/workloads/railiance/backup/platform-pg-backup-s3
```
You should see a current version greater than any placeholder version.
Then tell the agent: **“the Barman key is in bao.”** Also say the
application name if `APPLICATION_ID` is in bao.
Do not enable WAL archiving yourself. T04 still has to prove a negative
key cannot access the bucket and to vend Secret `platform-pg-backup-s3`.
T05 enables continuous archiving.
After the scoped key works, delete or lock down the bootstrap key from
CCR-2026-0011.