Skip to main content

ADR-0162: Backup and DR, configuration center and deep links in the portal Platform Manager space

Context​

The interface architecture (A4.2, B5.1, B5.2) asks the Platform Manager space for a configuration center, a Backup and DR screen (policies, jobs, restore plans with approvals, DR plans with the last exercise, observed RTO and RPO) and deep links to the operator consoles (Opik, Grafana, Keycloak, LiteLLM, OpenSearch). The Control Plane bridge (ADR-0128) only relayed the summary, clusters, services, nodes and operations; no route exposed the address of the Manager console.

A test against a real Manager showed a defect: under X-NM-On-Behalf-Of delegation, Principal.user_id stayed the bridge service account. The "another person approves" rule of restores and DR exercises therefore always compared the service account with itself: every approval coming from the portal was refused as a self approval.

Decision​

  • The eai.domains.platform_manager domain relays, with the identity of the portal user, the reads of the Backup & Recovery Manager (/backup/plans with the late or failed alerts, /backup/jobs, /backup/backups, /backup/restores, /dr/plans, /dr/exercises), planning and approving a restore, requesting and approving a DR exercise. Each write is audited in the Control Plane chain (allowed or refused). Executing an approved restore, completing an exercise and a real failover stay in the Manager console.
  • The portal configuration center is read only: current configuration of a service (secret values masked by the Manager) and version history. Editing, preview and rolling apply stay in the Manager console, with its validation.
  • GET /v1/platform-manager/console gives the base address of the Manager console (EAI_PLATFORM_MANAGER_CONSOLE_URL, else EAI_PLATFORM_MANAGER_URL) and those of the operator consoles (EAI_OPIK_UI_URL, EAI_GRAFANA_URL, EAI_KEYCLOAK_CONSOLE_URL, EAI_LITELLM_UI_URL, EAI_OPENSEARCH_DASHBOARDS_URL). An address that is not https or that carries credentials is never returned; the answer says which setting is missing or why it is refused. The route does not call the Manager and returns no secret.
  • In the Manager, Principal.acting_user_id names the person behind the call (the delegated user, else the caller). The separation of duties rules of restores and DR compare that person.

Consequences​

The portal shows the real backup and DR, with the two approvers other than the requester that the Manager requires. An operator without a configured Manager console sees an honest text instead of a dead link. The columns of the space screens are checked against the real answers of the bridge (portal/tests/fixtures/platform-manager-live.json).

Evidence​

services/control-plane/tests/test_platform_manager_backup.py (real Manager: services/control-plane/tests/fixtures/platform_manager_backup_server.py), portal/tests/platform-manager.test.ts, navin-manager/server/tests/test_backup_recovery.py, test_backup_dr_extended.py.

note

Since then, the Backup and DR screen of the portal has been removed: backup, DR, configuration and the other operations screens are managed in the Navin Manager console (navigation bar button), and the IT vault now lives only in that console: the portal has no Platform Manager space left (portal/src/screens/registry.tsx). The bridge routes described here stay published; portal/tests/api-conformance.test.ts lists them among the routes handled in the Manager console.