Backup and Restore Service · View 08 of 26 · 3 · Structure
Decisions
- Custody is reached only through the S3 API with short-lived credentials from RGW STS. No component holds an RGW access key, and no path uses the Ceph admin API.
- Source RGW buckets are captured from their notification stream (persistent notifications to Kafka), not by listing. Listing billions of objects every night to find 3% that changed is slow and costly.
- Healthchecks is called with a ping and nothing else. The dead-man monitor must not need the platform's API, database or identity to raise an alarm.
The manual path
- With the control plane gone, a restore needs four things: read access to custody through the break-glass restore role, the envelope manifest beside the artefact, OpenBao to unwrap the data key, and the engine's own tool. The runbook is rehearsed every quarter against that list and nothing else.
Versioning
- The API is OpenAPI-described with additive changes only inside a major version. The envelope manifest has its own schema version, because a copy written today must still be readable by the tooling of 2033.
