17 lines
974 B
Markdown
17 lines
974 B
Markdown
# rapp-postgres package boundary
|
|
|
|
`rapp-postgres` owns the PostgreSQL package manifests, consumer declarations,
|
|
role/database provisioning surface, isolation tests, database-specific
|
|
operations, and recovery procedure for the shared `platform-pg` service.
|
|
|
|
`railiance-platform` retains cluster-wide governance: the CNPG operator,
|
|
Kubernetes access, storage-class policy, monitoring substrate, approved S3
|
|
backup target and its credentials, and the OpenBao credential-broker grant
|
|
catalog. It configures the OpenBao database secrets engine from the creation
|
|
and revocation statements owned in the rapp-postgres playbook; it does not copy
|
|
those procedures into this repo.
|
|
|
|
The package never commits credentials. A consumer request is declared and
|
|
provisioned by rapp-postgres, while the workload receives a short-lived lease
|
|
through the platform broker. The upstream backup target and database-engine
|
|
bootstrap are governance prerequisites, not package-owned secret material.
|