coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/rapp-postgres-boundary.md
codex 9f6bdffec4
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Broker audit-core dynamic database credentials
2026-08-10 19:36:30 +02:00

974 B
Raw Permalink Blame History

rapp-postgres package boundary

rapp-postgres owns the PostgreSQL package manifests, consumer declarations, role/database provisioning surface, isolation tests, database-specific operations, and recovery procedure for the shared platform-pg service.

railiance-platform retains cluster-wide governance: the CNPG operator, Kubernetes access, storage-class policy, monitoring substrate, approved S3 backup target and its credentials, and the OpenBao credential-broker grant catalog. It configures the OpenBao database secrets engine from the creation and revocation statements owned in the rapp-postgres playbook; it does not copy those procedures into this repo.

The package never commits credentials. A consumer request is declared and provisioned by rapp-postgres, while the workload receives a short-lived lease through the platform broker. The upstream backup target and database-engine bootstrap are governance prerequisites, not package-owned secret material.