review: allowlist netbird-backup on the ClusterSecretStore + hygiene

- The blocking catch: the openbao ClusterSecretStore's namespace
  conditions did not include the new netbird-backup namespace, so the
  ExternalSecret could never sync even after key provisioning. Added
  (sorted, with consumer comment).
- rm -f /backup/*.part up front — aborted-run leftovers are outside the
  retention glob.
- storageClassName: ceph-block explicit, matching the repo's other
  single-PVC manifests.

Keeping the key on root with restrict,command= rather than a dedicated
VPS user: the forced command is the actual privilege boundary (the key
can only ever produce a dump), and a separate user would need read
access to root-owned live SQLite + config either via group surgery on
/opt/netbird or sudo rules — more moving parts for the same effective
capability.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kubernetes/infrastructure/netbird-backup/cronjob.yaml

@@ -49,6 +49,9 @@ spec:
                   # readable, so copy first. Known-hosts is TOFU on first
                   # run, then pinned on the PVC.
                   install -m 600 /ssh/ssh-key /tmp/key
+                  # Leftover .part files from aborted earlier runs are
+                  # outside the retention glob — clear them up front.
+                  rm -f /backup/*.part
                   ts=$(date +%Y-%m-%d)
                   ssh -i /tmp/key \
                       -o StrictHostKeyChecking=accept-new \

kubernetes/infrastructure/netbird-backup/pvc.yaml

@@ -4,8 +4,9 @@ metadata:
   name: netbird-backup
   namespace: netbird-backup
 spec:
-  # ceph-block (cluster default). 14 daily dumps of a small SQLite store
-  # plus config — 5Gi is generous headroom.
+  # 14 daily dumps of a small SQLite store plus config — 5Gi is
+  # generous headroom.
+  storageClassName: ceph-block
   accessModes:
     - ReadWriteOnce
   resources:

kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml

@@ -26,6 +26,7 @@ spec:
         - influxdb
         - ingress
         - monitoring
+        - netbird-backup # netbird-backup-ssh: the VPS-pull backup key
         - paperless
         - velero
   provider: