coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/put-platform-pg-backup-s3.md
codex 2769258631 feat: propose CCR-2026-0012 for platform-pg Barman key 
Workload KV path and ESO drafts for Secret platform-pg-backup-s3.
Founder mints the project-scoped Scaleway application; values stay
out of git.
2026-08-14 19:01:08 +02:00

2.6 KiB
Raw Blame History

Put the scoped Barman key (founder, local only)

Do this on a trusted terminal. Do not paste ACCESS_KEY_ID or ACCESS_SECRET_KEY into chat, Git, or State Hub.

CCR: credential-change-requests/CCR-2026-0012-platform-pg-backup-s3.yaml
Path: platform/workloads/railiance/backup/platform-pg-backup-s3

This is not the bootstrap key (…/scaleway/bootstrap). That key created the bucket. This key is the CNPG/Barman runtime identity.

1. Create a dedicated IAM application

In console.scaleway.com → IAM → Applications:

  1. Create application railiance-barman-platform-pg.
  2. Create an API key on that application (not on your user):
    • Description: platform-pg Barman runtime
    • Preferred Project for Object Storage: the project that owns bucket railiance-platform-pg-backup
  3. Copy the access key and secret key into a local scratch file (chmod 600). The secret is shown once.

2. Attach a project-scoped Object Storage policy

IAM → Policies → create railiance-barman-platform-pg-objects:

  • Principal: the application from step 1
  • Scope: that one project, not the whole Organization
  • Permission sets, if the console lists them:
    • ObjectStorageBucketsRead
    • ObjectStorageObjectsRead
    • ObjectStorageObjectsWrite
    • ObjectStorageObjectsDelete
  • If those sets are not listed, ObjectStorageFullAccess on this project only is acceptable because the project should contain only this backup bucket.

Do not attach IAM* or compute permission sets.

3. Put the values in OpenBao

On this host, with a token that can write the platform mount:

bao kv put platform/workloads/railiance/backup/platform-pg-backup-s3 \
  ACCESS_KEY_ID='SCWxxxxxxxx' \
  ACCESS_SECRET_KEY='xxxxxxxx' \
  APPLICATION_ID='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'

Or replace the xxx placeholders in the OpenBao UI on that same path.

APPLICATION_ID is the IAM application UUID (not a secret). It is needed later for the bucket policy.

4. Confirm without printing values

bao kv metadata get platform/workloads/railiance/backup/platform-pg-backup-s3

You should see a current version greater than any placeholder version. Then tell the agent: “the Barman key is in bao.” Also say the application name if APPLICATION_ID is in bao.

Do not enable WAL archiving yourself. T04 still has to prove a negative key cannot access the bucket and to vend Secret platform-pg-backup-s3. T05 enables continuous archiving.

After the scoped key works, delete or lock down the bootstrap key from CCR-2026-0011.