Part of https://github.com/helmcode/nan/issues/160. Design §9: https://github.com/helmcode/nan-devops/blob/main/AGENT-AUTOMATIONS.md#9-prerequisites-vault-hardening-blocking-phase-2-secrets - [ ] CronJob `vault operator raft snapshot save` uploading to R2 with `cnpg-r2-creds` (bucket `cnpg-backups-helmcode`, prefix `vault/`), 30d retention - [ ] Vault policy + Kubernetes auth role for the snapshot job (least privilege: `sys/storage/raft/snapshot` read) - [ ] Alert when the last successful snapshot is older than its schedule - [ ] Restore drill into a scratch Vault, documented in BACKUP.md - [ ] Transit batch-decrypt benchmark on the active node (target: p99 well under run-start budget at 10x peak)
Part of #160. Design §9: https://github.com/helmcode/nan-devops/blob/main/AGENT-AUTOMATIONS.md#9-prerequisites-vault-hardening-blocking-phase-2-secrets
vault operator raft snapshot saveuploading to R2 withcnpg-r2-creds(bucketcnpg-backups-helmcode, prefixvault/), 30d retentionsys/storage/raft/snapshotread)