coulomb/resource-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: finish WP-0002 T04; T05 is unblocked

Browse source 
Secret databases/platform-pg-backup-s3 is synced. Cluster stays
fail-closed until T05 enables barmanObjectStore.
This commit is contained in:
tegwick 2026-08-14 20:00:16 +02:00
parent 314e3abe67
commit e665975bcd
1 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
View file

@ -226,7 +226,7 @@ euro hard-stop; that gap is accepted. Scoped backup key remains T04.
```task
id: RESOURCE-WP-0002-T04
status: progress
status: done
priority: high
state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
```
@ -258,16 +258,18 @@ handed at
OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1).
Positive S3 list/get and prefix put/get/delete succeeded. Negative:
bogus secret denied; IAM/billing/k8s list denied. Distinct from the
bootstrap key. Bucket policy applied 2026-08-14: prefix `platform-pg/` write ok,
sibling prefix `AccessDenied`. Not done: OpenBao policy apply (this
token 403), ESO Secret `platform-pg-backup-s3` (absent on
railiance01). WAL still off.
bootstrap key. Done 2026-08-14: OpenBao policy `workload-kv-read-backup-object-storage`
and AppRole `external-secrets-backup-object-storage` applied.
ClusterSecretStore `openbao-backup-object-storage` Valid; ExternalSecret
synced Secret `databases/platform-pg-backup-s3` (keys present, values
not read). Prefix `platform-pg/` is empty (0 objects). Cluster still
has no `barmanObjectStore`. WAL remains T05.
## T05 — Prove backup, full restore, and PITR
```task
id: RESOURCE-WP-0002-T05
status: wait
status: todo
priority: high
state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02"
```