Finish RPF-WP-0019 apps-pg controls and recovery

helm/apps-pg-2-cluster.yaml

@@ -36,7 +36,7 @@ spec:
   backup:
     retentionPolicy: "30d"
     barmanObjectStore:
-      destinationPath: s3://railiance-platform-pg-backup/apps-pg-2/
+      destinationPath: s3://railiance-platform-pg-backup/platform-pg/apps-pg-2/
       endpointURL: https://s3.nl-ams.scw.cloud
       s3Credentials:
         accessKeyId: {name: platform-pg-backup-s3, key: ACCESS_KEY_ID}

helm/apps-pg-cluster.yaml

@@ -70,7 +70,9 @@ spec:
   backup:
     retentionPolicy: "30d"
     barmanObjectStore:
-      destinationPath: s3://railiance-platform-pg-backup/apps-pg/
+      # The bucket policy grants this runtime identity only platform-pg/*.
+      # Keep apps-pg distinct beneath that governed top-level prefix.
+      destinationPath: s3://railiance-platform-pg-backup/platform-pg/apps-pg/
       endpointURL: https://s3.nl-ams.scw.cloud
       s3Credentials:
         accessKeyId:

helm/apps-pg-consumer-controls.sql

@@ -5,3 +5,11 @@ ALTER ROLE vergabe SET statement_timeout = '15s';
 ALTER ROLE vergabe SET idle_in_transaction_session_timeout = '15s';
 ALTER ROLE coulomb_social SET statement_timeout = '15s';
 ALTER ROLE coulomb_social SET idle_in_transaction_session_timeout = '15s';
+
+-- PostgreSQL grants CONNECT and TEMPORARY to PUBLIC by default. A database per
+-- consumer is not an isolation boundary until those defaults are removed.
+REVOKE CONNECT, TEMPORARY ON DATABASE apps_meta FROM PUBLIC;
+REVOKE CONNECT, TEMPORARY ON DATABASE vergabe_db FROM PUBLIC;
+REVOKE CONNECT, TEMPORARY ON DATABASE coulomb_social_db FROM PUBLIC;
+GRANT CONNECT, TEMPORARY ON DATABASE vergabe_db TO vergabe;
+GRANT CONNECT, TEMPORARY ON DATABASE coulomb_social_db TO coulomb_social;

helm/apps-pg-isolation-probe.yaml

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: apps-pg-isolation-probe
+  labels:
+    railiance.io/postgres-client: apps-pg
+    railiance.io/purpose: apps-pg-isolation-probe
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: coulomb-probe
+  namespace: apps-pg-isolation-probe
+  labels:
+    app.kubernetes.io/name: apps-pg-isolation-probe
+spec:
+  restartPolicy: Never
+  automountServiceAccountToken: false
+  containers:
+    - name: psql
+      image: ghcr.io/cloudnative-pg/postgresql:16
+      command: [sh, -c, "sleep 1800"]
+      env:
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: coulomb-social-app-credentials
+              key: password
+      resources:
+        requests: {cpu: 10m, memory: 32Mi}
+        limits: {cpu: 100m, memory: 128Mi}
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities: {drop: [ALL]}
+        runAsNonRoot: true
+        runAsUser: 26
+        seccompProfile: {type: RuntimeDefault}
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: vergabe-probe
+  namespace: apps-pg-isolation-probe
+  labels:
+    app.kubernetes.io/name: apps-pg-isolation-probe
+spec:
+  restartPolicy: Never
+  automountServiceAccountToken: false
+  containers:
+    - name: psql
+      image: ghcr.io/cloudnative-pg/postgresql:16
+      command: [sh, -c, "sleep 1800"]
+      env:
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: vergabe-app-credentials
+              key: password
+      resources:
+        requests: {cpu: 10m, memory: 32Mi}
+        limits: {cpu: 100m, memory: 128Mi}
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities: {drop: [ALL]}
+        runAsNonRoot: true
+        runAsUser: 26
+        seccompProfile: {type: RuntimeDefault}