feat(backup-policy): KRO RGD for AWS Backup with gold/silver/bronze tiers + DR-aware StorageClasses

[allamand]

What

Adds the BackupPolicy KRO ResourceGraphDefinition (RGD) and the supporting plumbing so that AWS Backup for EKS can run end-to-end on a hub provisioned by feature/platform-cluster-kro-ack. Workloads opt into a backup tier (gold / silver / bronze) by picking the matching StorageClass; the BackupSelection in the RGD matches volumes by tag and includes them in the right BackupPlan.

Why

PR #642 lands the kind+ACK+KRO bootstrap and the EksClusterWithVpc RGD. There is no equivalent for AWS Backup yet: today, anyone running the platform either writes raw ACK Backup CRs or wires AWS Backup out-of-band. This PR closes that gap with the same KRO/ACK pattern as the rest of the resource-groups directory:

• One CRD (BackupPolicy) per spoke + tier.
• Tier semantics declared in the RGD (RPO, retention, cross-region copy).
• BackupSelection matches on the peeks.io/backup-tier tag emitted by the StorageClass at PVC creation time — workload-driven, no central ConfigMap, no platform ticket.

Scope of this PR

Included — BackupPolicy + the strict set of prereqs that make it functional:

Commit	Scope
7f301532	BackupPolicy RGD with gold / silver / bronze tiers
b37a1167	Merge peeks-gp3 StorageClass into platform-manifests-bootstrap
6d3e5005	Scope ManagePodIdentityAssociations inline policy on ACK capability role
aabebc14	Bind KRO capability STS username for ACK IAM access (multi-acct)
1ef9b694	appset-chart enableACKKRO path for kro+ACK pod identity
efa981e0	Wire ack-backup-controller via kro+ACK pod identity
ae02465c	Move example instances out of GitOps apply path
6e4742ed	Grant kro capability access to backup.services.k8s.aws
6fcb00e5	DR-aware tier StorageClasses (peeks-gold-gp3 / peeks-silver-gp3 / peeks-bronze-gp3) — closes the missing piece (RGD's BackupSelection matches peeks.io/backup-tier, but no SC currently emits this tag)

Excluded (kept on a separate working branch, not part of this PR) — unrelated commits also living on the upstream-fork: ingress modes (cloudfront | tls), kind-kro-ack bootstrap fixes (AWS_PROFILE, wait-for-eks, BYO IdC), cert-manager memory bump, rg-eks-vpc Ready condition. Those are independent scopes and will be proposed separately if useful upstream.

Architecture

Tier policies (in the RGD)

Tier	RPO	Retention	Cold storage	Cross-region copy
gold	1h	30d	after 90d	yes
silver	24h	14d	—	yes
bronze	24h	7d	—	no

Cross-region copy targets are passed in by the claim (copyDestinationVaultARN) — the destination vault is expected to exist in the DR region (could be nested in a future RGD revision; flagged as a known limit in the README).

Tag matching

# BackupSelection conditions in rgd-backup-policy.yaml
conditions:
  stringEquals:
    - conditionKey: "aws:ResourceTag/peeks.io/backup-tier"
      conditionValue: <tier>
    - conditionKey: "aws:ResourceTag/peeks.io/spoke"
      conditionValue: <spokeName>

Volumes inherit the peeks.io/backup-tier and peeks.io/spoke tags from the StorageClass via the EBS CSI driver's tagSpecification_<N> parameter, which the consolidated peeks-storageclass.yaml template renders from a tags: map per StorageClass:

peeks-gold-gp3:
  reclaimPolicy: Retain
  volumeType: gp3
  iops: 3000
  throughput: 125
  tags:
    peeks.io/managed-by: peeks-platform
    peeks.io/backup-tier: gold

spokeName is a top-level value merged into every EBS SC as peeks.io/spoke=<spokeName>.

Resource graph

BackupPolicy CR (claim)
   │
   ▼
┌─ BackupVault (ACK)            ── always
│  name: peeks-<spoke>-<tier>
└────
   │
   ▼
┌─ BackupPlan (ACK)             ── one variant per tier (includeWhen)
│  rules: schedule + lifecycle
│  copyActions for gold/silver
└────
   │
   ▼
┌─ BackupSelection (ACK)        ── one variant per tier
│  iamRoleARN: <from claim>
│  resources:
│    - arn:aws:ec2:*:*:volume/*
│    - arn:aws:eks:*:*:cluster/*
│  conditions: peeks.io/backup-tier + peeks.io/spoke
└────

KRO reconciles the chain in order; BackupSelection waits for the BackupPlan ACK.ResourceSynced condition before applying.

Validation

# RGD syntax
yq eval '.' gitops/addons/charts/kro/resource-groups/manifests/backup-policy/rgd-backup-policy.yaml

# server-side dry-run
kubectl --context hub apply --dry-run=server \
  -f gitops/addons/charts/kro/resource-groups/manifests/backup-policy/rgd-backup-policy.yaml

# Helm rendering — 5 StorageClasses (legacy, default, 3 tiers)
helm template t gitops/addons/charts/platform-manifests-bootstrap/ \
  --set spokeName=spoke-test | grep -c "^kind: StorageClass"
# → 5

# end-to-end — instance expands into BackupVault + BackupPlan + BackupSelection
kubectl --context hub apply -f gitops/addons/charts/kro/resource-groups/examples/backup-policy/instance-bronze.yaml
kubectl --context hub get backupvault,backupplan,backupselection -A

Files changed

 gitops/addons/charts/kro/resource-groups/examples/backup-policy/{README,instance-{bronze,gold,silver}}.yaml      | new (4 files, examples kept out of apply path)
 gitops/addons/charts/kro/resource-groups/manifests/backup-policy/{README.md,rgd-backup-policy.yaml}                 | new (cœur)
 gitops/addons/charts/kro/resource-groups/manifests/eks/rg-eks.yaml                                                  | scope ManagePodIdentityAssociations
 gitops/addons/charts/kro/resource-groups/templates/eks-capabilities-rbac.yaml                                       | KRO STS username binding
 gitops/addons/charts/platform-manifests-bootstrap/{README-storageclasses.md, templates/peeks-storageclass.yaml, values.yaml} | SC consolidation + tiers
 gitops/addons/registry/platform.yaml                                                                                 | register backup-policy & ack-backup
 platform-charts/appset-chart/templates/{_pod_identity_kro.tpl, application-set.yaml}                                  | enableACKKRO pod-identity wiring
 platform/infra/terraform/hub-config.yaml                                                                              | grant capability access to backup.services.k8s.aws

15 files changed, +821 / -0.

Compatibility

• Legacy ebs-sc-gp3 and the previous default peeks-gp3 are preserved unchanged. Workloads that don't opt into a tier keep their current SC.
• No deletions in this PR (additive only).
• Bronze SC uses reclaimPolicy=Delete (cheap / ephemeral); gold and silver use Retain.

Known limits (v1)

• No KMS key rotation / custom encryption — uses the default vault key.
• Heavy stateful workloads (Postgres, Kafka) need an application-level snapshot workflow on top of AWS Backup; AWS Backup gives a crash-consistent FS snapshot, not a logical DB backup.
• copyDestinationVaultARN must be pre-provisioned in the DR region. A future iteration could nest that vault in the same RGD.
• Restore side (how PVs land in a target cluster) is the responsibility of a companion RestoreSelection RGD — not in this PR.

Checklist

• Targets feature/platform-cluster-kro-ack (extends PR feat: kind-kro-ack cluster provider (bootstrap hub via ACK+KRO) #642 family).
• Additive — no existing files renamed or deleted in functional paths (only example instances moved out of the GitOps apply path, on purpose).
• helm template renders cleanly.
• RGD passes kubectl apply --dry-run=server.
• Examples isolated from the GitOps apply path so they don't accidentally reconcile in every spoke.
• Scope kept narrow — unrelated commits (ingress modes, kind bootstrap fixes) excluded for separate PRs if needed.

Related

• Companion architecture doc: docs(exposure): architecture for shared CF/ALB edge + AppExposure RGD #660 (exposure architecture — CloudFront / ALB / AppExposure RGD)
• Builds on: PR feat: kind-kro-ack cluster provider (bootstrap hub via ACK+KRO) #642 (feature/platform-cluster-kro-ack)