id: CCR-2026-0012
kind: credential-change-request
schema_version: 1
request_type: workload-kv-read
title: Scaleway scoped Barman key for platform-pg backup
status: proposed
created: '2026-08-14'
updated: '2026-08-14'
requester:
  agent: grok
  reason: >-
    RESOURCE-WP-0002 T04 needs a renewable, revocable, bucket-and-prefix
    scoped Scaleway key in OpenBao so railiance-platform can vend Secret
    platform-pg-backup-s3 into the databases namespace. The bootstrap key
    (CCR-2026-0011) can create buckets and must not be the runtime key.
review:
  required: true
  required_approvers:
  - platform-operator
  comments: []
target:
  domain: financials
  tenant: railiance
  workload: platform-pg-backup
  rapp: rapp-postgres
  environment: production
  purpose: >-
    CNPG/Barman object-store credentials for platform-pg WAL and base
    backups. Secret keys ACCESS_KEY_ID and ACCESS_SECRET_KEY only.
    Endpoint, bucket, prefix, and region stay on reef-storage.
openbao:
  mount: platform
  kv_path: platform/workloads/railiance/backup/platform-pg-backup-s3
  fields:
  - ACCESS_KEY_ID
  - ACCESS_SECRET_KEY
  - APPLICATION_ID
  policy_name: workload-kv-read-platform-pg-backup-s3
  policy_file: openbao/policies/workload-kv-read-platform-pg-backup-s3.hcl
  auth:
    method: kubernetes
    mount: kubernetes
    role: external-secrets-platform-pg-backup
    bound_claims:
      service_account_names:
      - external-secrets
      service_account_namespaces:
      - external-secrets
    bound_claims_confirmed: false
    policies:
    - workload-kv-read-platform-pg-backup-s3
    ttl: 15m
access_frontdoor:
  type: ops-warden
  catalog_id: platform-pg-backup-s3
  selector: platform-pg Barman Scaleway key
  command: warden access platform-pg-backup-s3 --fetch ACCESS_KEY_ID
  resolvable: false
  readiness: pending-review
delivery:
  surface: external-secrets
  target: >-
    ClusterSecretStore openbao-platform-pg-backup (namespace condition
    databases) → ExternalSecret databases/platform-pg-backup-s3 → Secret
    platform-pg-backup-s3 with keys ACCESS_KEY_ID and ACCESS_SECRET_KEY.
    Drafts live under railiance-platform/argocd/platform-addons/openbao-secretstore/
    and rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml.
    Do not apply until this CCR is approved and the KV values are real.
risk:
  classification: high
  notes:
  - The runtime key can write and delete objects under the backup prefix.
    Compromise can destroy recovery points or fill the bucket.
  - The bootstrap key (CCR-2026-0011) must be revoked after this key works.
  - Do not enable continuous WAL archiving until the empty-archive preflight
    passes (RESOURCE-WP-0002 T05).
  - Values must not appear in Git, State Hub, logs, or chat.
verification:
  positive:
  - Field names present on the KV path; values not printed.
  - An approved databases-namespace ExternalSecret can sync ACCESS_KEY_ID
    and ACCESS_SECRET_KEY to Secret platform-pg-backup-s3.
  - The scoped key can list/put/delete only under prefix platform-pg/.
  negative:
  - A token without this policy cannot read the KV path.
  - A namespace outside the ClusterSecretStore condition cannot use the store.
  - A second, unused key (or revoked key) cannot access the bucket.
  - The scoped key cannot list sibling buckets or create compute resources.
  activation_conditions:
  - Platform-operator approves this CCR.
  - Founder creates the Scaleway IAM application and project-scoped
    Object Storage key, then replaces OpenBao placeholders.
  - ESO store and ExternalSecret applied only after values are real.
lifecycle:
  deactivate: Disable the catalog entry, delete the ExternalSecret, revoke
    the Scaleway API key, delete the IAM application.
  rotate: Overlap-first. Put a new key in OpenBao, wait for ESO refresh,
    revoke the old Scaleway key.
  compromised: Revoke both the Barman key and the bootstrap key at Scaleway,
    rotate this path, review bucket contents, open incident follow-up.
state_hub:
  workplan_id: RESOURCE-WP-0002
  task_id: RESOURCE-WP-0002-T04