# Hybrid-Cloud k3s Backup and Static Delivery

## Purpose and scope

This diagram separates static delivery, encrypted configuration export, cloud
management, monitoring, and security controls. Removed Cloud Run/load-balancer
compute is historical. Aggregate resource types and key controls were verified
read-only on 24 July 2026; identifiers and full policy contents remain omitted.

**Source:** `sources/hybrid-cloud.mmd`  
**Generated:** `generated/hybrid-cloud.svg`

![Hybrid-cloud architecture](generated/hybrid-cloud.svg)

## Components and trust boundaries

The deployment plane joins Git, the dev-only workflow, Firebase Hosting, and
public HTTPS. The data plane joins the k3s CronJob, compression, age encryption,
Workload Identity Federation, and private Cloud Storage. Terraform owns cloud
configuration; Kustomize owns Kubernetes workload/RBAC configuration. DNS,
account administration, key custody, and restore approval remain external or
operator-owned.

## Data flow and failure paths

Static files flow Git → validation/deployment → Firebase → custom-domain HTTPS.
Backup data flows allowlisted Kubernetes configuration → no Secret-object query
and ConfigMap key-only inventory → compression → encryption → federation →
private storage → remote-size/status evidence. Selected workload specs can
retain literal values, so the archive remains sensitive. A failed build,
deployment credential, DNS/TLS check, CronJob, encryption step, token exchange,
upload, object check, or alert is a distinct failure boundary.

Decrypt-and-list inspection checks archive readability only. Dry-run, resource
application, application data, and service acceptance remain separate recovery
steps.

## Omissions and verification

Project, bucket, service-account, provider, and notification IDs; credentials;
keys; internal addresses; configuration values; and account ownership are
omitted. The Firebase apex, `www` redirect, catalogue, case-study route,
security headers, and unknown-route 404 were checked on 24 July 2026. Aggregate
inventory that day confirmed Firebase, one active WIF pool/provider, three
buckets, monitoring controls, no user-managed service-account keys, and no VM,
GKE, Cloud Run, or Cloud SQL runtime. The CronJob last-success evidence remains
dated 16 July; the encrypted upload and decrypt-and-list record remain dated
15 July. Ten snapshots, one Artifact Registry repository, and the default
network remain migration-residue review items rather than deletion approval.

Related: `hybrid-cloud/docs/architecture.md`, `hybrid-cloud/docs/security.md`,
and `hybrid-cloud/docs/disaster-recovery.md`.

**Validation:** `npm run diagrams:check`; review Terraform and Kustomize output
before any change.