coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

retarget: CCR-2026-0012 is the general backup object-store lane

Browse source 
Use IAM application resource-control and policy Scoped backup access.
OpenBao path is platform/workloads/railiance/backup/object-storage.
rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.
This commit is contained in:
codex 2026-08-14 19:19:56 +02:00
parent 2769258631
commit 94b2f7cc9c
8 changed files with 160 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

11
openbao/policies/workload-kv-read-backup-object-storage.hcl Normal file
View file

@ -0,0 +1,11 @@
# Least-privilege read of the resource-control backup object-store key.
# ESO (or the later Kubernetes auth role) is the only in-cluster reader.
# Values never belong in Git.
path "platform/data/workloads/railiance/backup/object-storage" {
capabilities = ["read"]
}
path "platform/metadata/workloads/railiance/backup/object-storage" {
capabilities = ["read"]
}

11
openbao/policies/workload-kv-read-platform-pg-backup-s3.hcl
View file

@ -1,11 +0,0 @@
# Least-privilege read of the Barman runtime key for platform-pg.
# ESO (or the later Kubernetes auth role) is the only in-cluster reader.
# Values never belong in Git.
path "platform/data/workloads/railiance/backup/platform-pg-backup-s3" {
capabilities = ["read"]
}
path "platform/metadata/workloads/railiance/backup/platform-pg-backup-s3" {
capabilities = ["read"]
}