From e665975bcd5f2c035b1196bf2392a504b8508d7f Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 20:00:16 +0200 Subject: [PATCH] feat: finish WP-0002 T04; T05 is unblocked Secret databases/platform-pg-backup-s3 is synced. Cluster stays fail-closed until T05 enables barmanObjectStore. --- ...URCE-WP-0002-procure-postgres-backup-storage.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md index 74e10fc..27013ae 100644 --- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -226,7 +226,7 @@ euro hard-stop; that gap is accepted. Scoped backup key remains T04. ```task id: RESOURCE-WP-0002-T04 -status: progress +status: done priority: high state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a" ``` @@ -258,16 +258,18 @@ handed at OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1). Positive S3 list/get and prefix put/get/delete succeeded. Negative: bogus secret denied; IAM/billing/k8s list denied. Distinct from the -bootstrap key. Bucket policy applied 2026-08-14: prefix `platform-pg/` write ok, -sibling prefix `AccessDenied`. Not done: OpenBao policy apply (this -token 403), ESO Secret `platform-pg-backup-s3` (absent on -railiance01). WAL still off. +bootstrap key. Done 2026-08-14: OpenBao policy `workload-kv-read-backup-object-storage` +and AppRole `external-secrets-backup-object-storage` applied. +ClusterSecretStore `openbao-backup-object-storage` Valid; ExternalSecret +synced Secret `databases/platform-pg-backup-s3` (keys present, values +not read). Prefix `platform-pg/` is empty (0 objects). Cluster still +has no `barmanObjectStore`. WAL remains T05. ## T05 — Prove backup, full restore, and PITR ```task id: RESOURCE-WP-0002-T05 -status: wait +status: todo priority: high state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02" ```