From 644d5391bde60c1852d785f4d7bb9dd465b5e4c8 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 19:19:56 +0200 Subject: [PATCH] retarget: T04 backup key is resource-control, not Barman Handle becomes secret:railiance-platform/backup. IAM application is resource-control; policy and API key are Scoped backup access. --- data/resources/platform-audit-storage.json | 2 +- ...CE-WP-0002-primary-selection-2026-08-14.md | 4 +-- docs/operational-reference-convention.md | 6 ++-- ...WP-0002-procure-postgres-backup-storage.md | 34 +++++++++++-------- ...E-WP-0006-resource-object-and-reef-refs.md | 2 +- 5 files changed, 27 insertions(+), 21 deletions(-) diff --git a/data/resources/platform-audit-storage.json b/data/resources/platform-audit-storage.json index 2b3c8b6..7aea4b6 100644 --- a/data/resources/platform-audit-storage.json +++ b/data/resources/platform-audit-storage.json @@ -29,7 +29,7 @@ "reef:storage/substrate/object-stores/platform-audit-storage.yaml#provider_project_ref" ], "credential_handles": [ - "secret:railiance-platform/platform-pg-backup-s3" + "secret:railiance-platform/backup" ], "consumers": { "potential": ["rapp-postgres"], diff --git a/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md b/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md index 8ec4e6e..eb3f6ad 100644 --- a/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md +++ b/docs/evidence/RESOURCE-WP-0002-primary-selection-2026-08-14.md @@ -15,7 +15,7 @@ Object Storage policy attached, list/get succeeded. Private bucket owner-only. Live attributes are in `reef-storage/substrate/object-stores/platform-audit-storage.yaml`. Founder set a Scaleway billing alert (email). Scaleway has no euro -hard-stop that refuses usage; that gap is accepted. Scoped Barman key +hard-stop that refuses usage; that gap is accepted. Scoped backup key is T04. ## Recommendation @@ -61,7 +61,7 @@ workload. - Cost alert: on the Scaleway project - Owner in inventory: `resource-control` - Attribute home: `reef-storage/substrate/object-stores/platform-audit-storage.yaml` -- Credential home (after T04): `secret:railiance-platform/platform-pg-backup-s3` +- Credential home (after T04): `secret:railiance-platform/backup` - Consumer potential: `rapp-postgres` - Consumer actual: none until WAL flows diff --git a/docs/operational-reference-convention.md b/docs/operational-reference-convention.md index ef4a88b..4ae1be1 100644 --- a/docs/operational-reference-convention.md +++ b/docs/operational-reference-convention.md @@ -67,7 +67,7 @@ secret:/ Example already named by the backup split: ```text -secret:railiance-platform/platform-pg-backup-s3 +secret:railiance-platform/backup ``` The handle may also record `broker` (`openbao`) and `rotation` as non-secret @@ -92,9 +92,9 @@ When a record needs more than a string: { "kind": "credential_handle", "custody_repo": "railiance-platform", - "secret_id": "platform-pg-backup-s3", + "secret_id": "backup", "broker": "openbao", - "ref": "secret:railiance-platform/platform-pg-backup-s3" + "ref": "secret:railiance-platform/backup" } ``` diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md index 1a27aa1..6f9b496 100644 --- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -220,7 +220,7 @@ noncurrent lifecycle applied, ACL owner-only. Inventory is Operating facts live on `reef:storage/substrate/object-stores/platform-audit-storage.yaml`. Founder set a Scaleway billing alert (email). Scaleway has no -euro hard-stop; that gap is accepted. Scoped Barman key remains T04. +euro hard-stop; that gap is accepted. Scoped backup key remains T04. ## T04 — Establish credential custody and hand off to rapp-postgres @@ -231,27 +231,33 @@ priority: high state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a" ``` -Route the scoped bucket credential to `railiance-platform` through the approved -OpenBao/credential-broker lane. Permit only the bucket/prefix operations CNPG -requires. Keep credential values out of Git, State Hub, shell history, logs, -and chat. +Route the scoped **backup** object-store credential to +`railiance-platform` through the approved OpenBao/credential-broker +lane. Principal is IAM application `resource-control`; API key and +policy are `Scoped backup access`. Permit only the project-scoped +object-store operations backup consumers need. Keep credential values +out of Git, State Hub, shell history, logs, and chat. -Hand the non-secret endpoint, bucket/prefix, region, CA/TLS requirements, and -retention parameters to `rapp-postgres`. Verify Barman's empty-WAL-archive check -before enabling continuous archiving. +Hand the non-secret endpoint, bucket/prefix, region, CA/TLS +requirements, and retention parameters to `rapp-postgres` as the first +consumer. Verify the empty-WAL-archive check before enabling continuous +archiving. Done when credential delivery is renewable/revocable, a negative credential cannot access the bucket, and `rapp-postgres` can perform the storage preflight without disclosing a value. Started 2026-08-14: bootstrap key cannot create IAM applications. Lane -prepared — `CCR-2026-0012` (proposed), policy file, mason plan -`platform-pg-backup-s3` (draft), founder put instructions, non-secret -destination handed at +retargeted the same day to a general backup identity — `CCR-2026-0012` +(proposed), mason plan `backup-object-storage` (draft), founder put +instructions, handle `secret:railiance-platform/backup`, first consumer +projection Secret `platform-pg-backup-s3`. Non-secret destination +handed at `rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`. -Waiting on founder: approve the CCR, mint the project-scoped IAM -application and key, put values in OpenBao, say “the Barman key is in -bao.” Do not enable WAL yet. +Waiting on founder: approve the CCR, use IAM application +`resource-control`, bind policy and key `Scoped backup access`, put +values in OpenBao, say “the backup key is in bao.” Do not enable WAL +yet. ## T05 — Prove backup, full restore, and PITR diff --git a/workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md b/workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md index 5e9dde5..acb86a1 100644 --- a/workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md +++ b/workplans/RESOURCE-WP-0006-resource-object-and-reef-refs.md @@ -101,7 +101,7 @@ operational/credential refs or explicit gaps on every `data/resources/` record. The proposed backup resource is the proving case: consumers potential = `rapp-postgres`; actual = empty until WAL flows; attribute refs wait on `reef-storage`; credential handle = -`secret:railiance-platform/platform-pg-backup-s3` once custody exists. +`secret:railiance-platform/backup` once custody exists. Done when no live record relies on undifferentiated `workload_ids` as the only consumer list.