2769258631
Workload KV path and ESO drafts for Secret platform-pg-backup-s3. Founder mints the project-scoped Scaleway application; values stay out of git.
103 lines
4 KiB
YAML
103 lines
4 KiB
YAML
id: CCR-2026-0012
|
|
kind: credential-change-request
|
|
schema_version: 1
|
|
request_type: workload-kv-read
|
|
title: Scaleway scoped Barman key for platform-pg backup
|
|
status: proposed
|
|
created: '2026-08-14'
|
|
updated: '2026-08-14'
|
|
requester:
|
|
agent: grok
|
|
reason: >-
|
|
RESOURCE-WP-0002 T04 needs a renewable, revocable, bucket-and-prefix
|
|
scoped Scaleway key in OpenBao so railiance-platform can vend Secret
|
|
platform-pg-backup-s3 into the databases namespace. The bootstrap key
|
|
(CCR-2026-0011) can create buckets and must not be the runtime key.
|
|
review:
|
|
required: true
|
|
required_approvers:
|
|
- platform-operator
|
|
comments: []
|
|
target:
|
|
domain: financials
|
|
tenant: railiance
|
|
workload: platform-pg-backup
|
|
rapp: rapp-postgres
|
|
environment: production
|
|
purpose: >-
|
|
CNPG/Barman object-store credentials for platform-pg WAL and base
|
|
backups. Secret keys ACCESS_KEY_ID and ACCESS_SECRET_KEY only.
|
|
Endpoint, bucket, prefix, and region stay on reef-storage.
|
|
openbao:
|
|
mount: platform
|
|
kv_path: platform/workloads/railiance/backup/platform-pg-backup-s3
|
|
fields:
|
|
- ACCESS_KEY_ID
|
|
- ACCESS_SECRET_KEY
|
|
- APPLICATION_ID
|
|
policy_name: workload-kv-read-platform-pg-backup-s3
|
|
policy_file: openbao/policies/workload-kv-read-platform-pg-backup-s3.hcl
|
|
auth:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
role: external-secrets-platform-pg-backup
|
|
bound_claims:
|
|
service_account_names:
|
|
- external-secrets
|
|
service_account_namespaces:
|
|
- external-secrets
|
|
bound_claims_confirmed: false
|
|
policies:
|
|
- workload-kv-read-platform-pg-backup-s3
|
|
ttl: 15m
|
|
access_frontdoor:
|
|
type: ops-warden
|
|
catalog_id: platform-pg-backup-s3
|
|
selector: platform-pg Barman Scaleway key
|
|
command: warden access platform-pg-backup-s3 --fetch ACCESS_KEY_ID
|
|
resolvable: false
|
|
readiness: pending-review
|
|
delivery:
|
|
surface: external-secrets
|
|
target: >-
|
|
ClusterSecretStore openbao-platform-pg-backup (namespace condition
|
|
databases) → ExternalSecret databases/platform-pg-backup-s3 → Secret
|
|
platform-pg-backup-s3 with keys ACCESS_KEY_ID and ACCESS_SECRET_KEY.
|
|
Drafts live under railiance-platform/argocd/platform-addons/openbao-secretstore/
|
|
and rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml.
|
|
Do not apply until this CCR is approved and the KV values are real.
|
|
risk:
|
|
classification: high
|
|
notes:
|
|
- The runtime key can write and delete objects under the backup prefix.
|
|
Compromise can destroy recovery points or fill the bucket.
|
|
- The bootstrap key (CCR-2026-0011) must be revoked after this key works.
|
|
- Do not enable continuous WAL archiving until the empty-archive preflight
|
|
passes (RESOURCE-WP-0002 T05).
|
|
- Values must not appear in Git, State Hub, logs, or chat.
|
|
verification:
|
|
positive:
|
|
- Field names present on the KV path; values not printed.
|
|
- An approved databases-namespace ExternalSecret can sync ACCESS_KEY_ID
|
|
and ACCESS_SECRET_KEY to Secret platform-pg-backup-s3.
|
|
- The scoped key can list/put/delete only under prefix platform-pg/.
|
|
negative:
|
|
- A token without this policy cannot read the KV path.
|
|
- A namespace outside the ClusterSecretStore condition cannot use the store.
|
|
- A second, unused key (or revoked key) cannot access the bucket.
|
|
- The scoped key cannot list sibling buckets or create compute resources.
|
|
activation_conditions:
|
|
- Platform-operator approves this CCR.
|
|
- Founder creates the Scaleway IAM application and project-scoped
|
|
Object Storage key, then replaces OpenBao placeholders.
|
|
- ESO store and ExternalSecret applied only after values are real.
|
|
lifecycle:
|
|
deactivate: Disable the catalog entry, delete the ExternalSecret, revoke
|
|
the Scaleway API key, delete the IAM application.
|
|
rotate: Overlap-first. Put a new key in OpenBao, wait for ESO refresh,
|
|
revoke the old Scaleway key.
|
|
compromised: Revoke both the Barman key and the bootstrap key at Scaleway,
|
|
rotate this path, review bucket contents, open incident follow-up.
|
|
state_hub:
|
|
workplan_id: RESOURCE-WP-0002
|
|
task_id: RESOURCE-WP-0002-T04
|