coulomb/resource-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: coulomb:644d5391bde60c1852d785f4d7bb9dd465b5e4c8
Branches Tags
coulomb:main
...
compare: coulomb:e665975bcd5f2c035b1196bf2392a504b8508d7f
Branches Tags
coulomb:main

3 commits
644d5391bd ... e665975bcd

Author SHA1 Message Date
tegwick
e665975bcd feat: finish WP-0002 T04; T05 is unblocked 
Secret databases/platform-pg-backup-s3 is synced. Cluster stays
fail-closed until T05 enables barmanObjectStore.
 2026-08-14 20:00:16 +02:00
tegwick
314e3abe67 note: WP-0002 T04 prefix-scoped bucket policy is live 2026-08-14 19:55:54 +02:00
tegwick
9381cf6535 note: WP-0002 T04 backup key verified; Secret still not vended 2026-08-14 19:34:40 +02:00
1 changed files with 12 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md
View file

@ -226,7 +226,7 @@ euro hard-stop; that gap is accepted. Scoped backup key remains T04.
```task
id: RESOURCE-WP-0002-T04
status: progress
status: done
priority: high
state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
```
@ -254,16 +254,22 @@ instructions, handle `secret:railiance-platform/backup`, first consumer
projection Secret `platform-pg-backup-s3`. Non-secret destination
handed at
`rapp-postgres/docs/handoff/RESOURCE-WP-0002-T04-barman-destination.md`.
Waiting on founder: approve the CCR, use IAM application
`resource-control`, bind policy and key `Scoped backup access`, put
values in OpenBao, say “the backup key is in bao.” Do not enable WAL
yet.
2026-08-14: founder approved CCR-2026-0012 and put the backup key in
OpenBao (`ACCESS_KEY`/`SECRET_KEY` + org/project ids, version 1).
Positive S3 list/get and prefix put/get/delete succeeded. Negative:
bogus secret denied; IAM/billing/k8s list denied. Distinct from the
bootstrap key. Done 2026-08-14: OpenBao policy `workload-kv-read-backup-object-storage`
and AppRole `external-secrets-backup-object-storage` applied.
ClusterSecretStore `openbao-backup-object-storage` Valid; ExternalSecret
synced Secret `databases/platform-pg-backup-s3` (keys present, values
not read). Prefix `platform-pg/` is empty (0 objects). Cluster still
has no `barmanObjectStore`. WAL remains T05.
## T05 — Prove backup, full restore, and PITR
```task
id: RESOURCE-WP-0002-T05
status: wait
status: todo
priority: high
state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02"
```