coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

retarget: CCR-2026-0012 is the general backup object-store lane

Browse source 
Use IAM application resource-control and policy Scoped backup access.
OpenBao path is platform/workloads/railiance/backup/object-storage.
rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.
This commit is contained in:
codex 2026-08-14 19:19:56 +02:00
parent 2769258631
commit 94b2f7cc9c
8 changed files with 160 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/rapp-credential-lane-binding.md
View file

@ -47,7 +47,8 @@ the list does not say who provisions the thing that satisfies a name.
`openbao-database-secrets-engine` and `s3-backup-target` are capabilities.
The database engine is configured by S3 from statements the package
owns; the backup bucket is a `resource-control` resource and the
provider credential is S3 custody (`Secret platform-pg-backup-s3`).
provider credential is S3 custody (`secret:railiance-platform/backup`,
first projection Secret `platform-pg-backup-s3`).
Fail-closed until that handoff lands is correct, not a hole in the
package.
@ -180,7 +181,7 @@ shape unless it *is* a secrets engine.
| --- | --- | --- | --- |
| `rapp-openbao` | none | none — package is the store | correct |
| `rapp-postgres` | `consumer_contract` + `openbao-database-secrets-engine` | `rapp-postgres/audit-core-runtime`, `rapp-postgres/audit-core-migration` | bound |
| `rapp-postgres` | `s3-backup-target` / `secret_references: platform/workloads/railiance/backup/platform-pg-backup-s3` | `CCR-2026-0012` | pointer set; CCR `proposed`; Secret not vended |
| `rapp-postgres` | `s3-backup-target` / `secret_references: platform/workloads/railiance/backup/object-storage` | `CCR-2026-0012` | pointer set; CCR `proposed`; first consumer of the general backup key; Secret not vended |
| `rapp-qonto` | `secret_references: tenants/binky/qonto-api` | `CCR-2026-0009` | pointer set; CCR itself is still `proposed` |
Live CCRs without `target.rapp` are un-rapped workloads. They stay on