From 9381cf65350bd29611416e5792f8560161677a07 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 19:34:40 +0200 Subject: [PATCH 1/3] note: WP-0002 T04 backup key verified; Secret still not vended --- ...ESOURCE-WP-0002-procure-postgres-backup-storage.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md index 6f9b496..140a395 100644 --- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -254,10 +254,13 @@ instructions, handle `secret:railiance-platform/backup`, first consumer projection Secret `platform-pg-backup-s3`. Non-secret destination handed at `rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`. -Waiting on founder: approve the CCR, use IAM application -`resource-control`, bind policy and key `Scoped backup access`, put -values in OpenBao, say “the backup key is in bao.” Do not enable WAL -yet. +2026-08-14: founder approved CCR-2026-0012 and put the backup key in +OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1). +Positive S3 list/get and prefix put/get/delete succeeded. Negative: +bogus secret denied; IAM/billing/k8s list denied. Distinct from the +bootstrap key. Not done: OpenBao policy apply (this token 403), ESO +Secret `platform-pg-backup-s3` (absent on railiance01), bucket policy +(no `APPLICATION_ID`). WAL still off. ## T05 — Prove backup, full restore, and PITR From 314e3abe67305ecdd0b742234d4ea00b7f547b9c Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 19:55:54 +0200 Subject: [PATCH 2/3] note: WP-0002 T04 prefix-scoped bucket policy is live --- .../RESOURCE-WP-0002-procure-postgres-backup-storage.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md index 140a395..74e10fc 100644 --- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -258,9 +258,10 @@ handed at OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1). Positive S3 list/get and prefix put/get/delete succeeded. Negative: bogus secret denied; IAM/billing/k8s list denied. Distinct from the -bootstrap key. Not done: OpenBao policy apply (this token 403), ESO -Secret `platform-pg-backup-s3` (absent on railiance01), bucket policy -(no `APPLICATION_ID`). WAL still off. +bootstrap key. Bucket policy applied 2026-08-14: prefix `platform-pg/` write ok, +sibling prefix `AccessDenied`. Not done: OpenBao policy apply (this +token 403), ESO Secret `platform-pg-backup-s3` (absent on +railiance01). WAL still off. ## T05 — Prove backup, full restore, and PITR From e665975bcd5f2c035b1196bf2392a504b8508d7f Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 14 Aug 2026 20:00:16 +0200 Subject: [PATCH 3/3] feat: finish WP-0002 T04; T05 is unblocked Secret databases/platform-pg-backup-s3 is synced. Cluster stays fail-closed until T05 enables barmanObjectStore. --- ...URCE-WP-0002-procure-postgres-backup-storage.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md index 74e10fc..27013ae 100644 --- a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -226,7 +226,7 @@ euro hard-stop; that gap is accepted. Scoped backup key remains T04. ```task id: RESOURCE-WP-0002-T04 -status: progress +status: done priority: high state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a" ``` @@ -258,16 +258,18 @@ handed at OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1). Positive S3 list/get and prefix put/get/delete succeeded. Negative: bogus secret denied; IAM/billing/k8s list denied. Distinct from the -bootstrap key. Bucket policy applied 2026-08-14: prefix `platform-pg/` write ok, -sibling prefix `AccessDenied`. Not done: OpenBao policy apply (this -token 403), ESO Secret `platform-pg-backup-s3` (absent on -railiance01). WAL still off. +bootstrap key. Done 2026-08-14: OpenBao policy `workload-kv-read-backup-object-storage` +and AppRole `external-secrets-backup-object-storage` applied. +ClusterSecretStore `openbao-backup-object-storage` Valid; ExternalSecret +synced Secret `databases/platform-pg-backup-s3` (keys present, values +not read). Prefix `platform-pg/` is empty (0 objects). Cluster still +has no `barmanObjectStore`. WAL remains T05. ## T05 — Prove backup, full restore, and PITR ```task id: RESOURCE-WP-0002-T05 -status: wait +status: todo priority: high state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02" ```