coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

approve: CCR-2026-0012; verify scoped backup key in OpenBao

Browse source 
Founder put ACCESS_KEY/SECRET_KEY. S3 prefix CRUD works. IAM write
and ESO apply remain gated. WAL not enabled.
This commit is contained in:
codex 2026-08-14 19:34:40 +02:00
parent 94b2f7cc9c
commit ddce013cac
3 changed files with 80 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/put-backup-object-storage.md
View file

@ -51,15 +51,18 @@ On this host, with a token that can write the `platform` mount:
```bash
bao kv put platform/workloads/railiance/backup/object-storage \
ACCESS_KEY_ID='SCWxxxxxxxx' \
ACCESS_SECRET_KEY='xxxxxxxx' \
APPLICATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
ACCESS_KEY='SCWxxxxxxxx' \
SECRET_KEY='xxxxxxxx' \
DEFAULT_ORGANIZATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' \
DEFAULT_PROJECT_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
```
Or replace the `xxx` placeholders in the OpenBao UI on that same path.
Same four field names as the bootstrap path. External Secrets projects
`ACCESS_KEY` / `SECRET_KEY` to Kubernetes `ACCESS_KEY_ID` /
`ACCESS_SECRET_KEY`.
`APPLICATION_ID` is the `resource-control` IAM application UUID (not a
secret). It is needed later for the bucket policy.
Optional later field: `APPLICATION_ID` (the `resource-control` IAM
application UUID, not a secret) so we can attach a bucket policy.
## 4. Confirm without printing values