coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Broker audit-core dynamic database credentials
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
codex 2026-08-10 19:36:30 +02:00
parent d140e829eb
commit 9f6bdffec4
5 changed files with 245 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/rapp-postgres-boundary.md Normal file
View file

@ -0,0 +1,17 @@
# rapp-postgres package boundary
`rapp-postgres` owns the PostgreSQL package manifests, consumer declarations,
role/database provisioning surface, isolation tests, database-specific
operations, and recovery procedure for the shared `platform-pg` service.
`railiance-platform` retains cluster-wide governance: the CNPG operator,
Kubernetes access, storage-class policy, monitoring substrate, approved S3
backup target and its credentials, and the OpenBao credential-broker grant
catalog. It configures the OpenBao database secrets engine from the creation
and revocation statements owned in the rapp-postgres playbook; it does not copy
those procedures into this repo.
The package never commits credentials. A consumer request is declared and
provisioned by rapp-postgres, while the workload receives a short-lived lease
through the platform broker. The upstream backup target and database-engine
bootstrap are governance prerequisites, not package-owned secret material.