kubernetes/apps/kustomization.yaml

@@ -8,6 +8,8 @@ resources:
   - gitea/
   - ical-proxy/
   - pve/
-  - woodpecker/
+  # woodpecker/ moved to its own dedicated `woodpecker` Kustomization
+  # (clusters/homelab/woodpecker.yaml) so its wp-pg CNPG cluster's barman
+  # dependency + Cluster health-gating don't contaminate this shared apps KS.
   # Read-only ServiceAccount for the off-site Claude Code workstation.
   - claude-workstation/

kubernetes/apps/woodpecker/kustomization.yaml

@@ -32,3 +32,11 @@ resources:
   # (kubernetes/infrastructure/openbao/rotation/woodpecker.yaml) — intra-ns
   # OpenBao access, no NetworkPolicy needed. server.yaml/agent.yaml keep their
   # Reloader annotations; externalsecret.yaml keeps the 10m refreshInterval.
+  # wp-pg CNPG Postgres backend (moved here from the retired seed-woodpecker KS;
+  # each object carries prune: disabled so ownership transferred without a
+  # teardown). The dedicated `woodpecker` KS depends on infrastructure-cnpg-barman
+  # for the barman plugin behind the ObjectStore/ScheduledBackup.
+  - cluster.yaml
+  - objectstore.yaml
+  - scheduled-backup.yaml
+  - hetzner-creds-externalsecret.yaml

kubernetes/bootstrap.sh

@@ -332,6 +332,7 @@ if phase_runs wait-apps; then
     # is genuinely 5–10 min on a fresh OSD-wiped cluster).
     wait_kustomization apps                "apps"                                                90
     wait_kustomization influxdb            "InfluxDB (HR install + token Jobs)"                  600
+    wait_kustomization woodpecker          "Woodpecker CI (incl. wp-pg CNPG backend)"            600
     wait_kustomization authentik           "Authentik (incl. ak-pg seed)"                        600
     wait_kustomization monitoring          "kube-prometheus-stack (Loki + Prom + AM + Grafana)"  180
     wait_kustomization music-assistant     "Music Assistant (incl. data seed)"                   300

kubernetes/clusters/homelab/woodpecker.yaml

@@ -1,24 +1,25 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: seed-woodpecker
+  name: woodpecker
   namespace: flux-system
 spec:
-  # Owns the wp-pg CNPG Cluster, its ObjectStore + ScheduledBackup, and the
-  # Hetzner S3 creds. Provisions the Postgres backend that woodpecker-server
-  # migrates onto (from its old sqlite-on-PVC), which removes the fragile
-  # ceph-block snapshot backup path that broke #295/#324. Bootstraps an empty
-  # DB via initdb; the sqlite->pg data migration is a one-time manual runbook
-  # (kubernetes/seed/woodpecker/MIGRATION.md).
+  # Dedicated lifecycle owner of Woodpecker CI: the server/agent app (formerly
+  # under the catch-all `apps` KS) plus its wp-pg CNPG Cluster + ObjectStore +
+  # ScheduledBackup (formerly under seed-woodpecker). Pulled into its own KS so
+  # the CNPG barman dependency and Cluster health-gating live here instead of
+  # contaminating the shared `apps` KS. Replaces seed-woodpecker.
   interval: 10m
   retryInterval: 2m
   timeout: 30m
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./kubernetes/seed/woodpecker
+  path: ./kubernetes/apps/woodpecker
   prune: true
   wait: true
+  # sops-free path: woodpecker-secret + barman creds come from OpenBao via ESO
+  # (MIGRATION-sops-openbao.md).
   dependsOn:
     - name: infrastructure
     - name: infrastructure-crds

kubernetes/e2e-test.sh

@@ -108,7 +108,7 @@ check "3 nodes Ready" \
 echo "=== Flux Kustomizations ==="
 for ks in flux-system infrastructure infrastructure-crds infrastructure-ceph-cluster \
           seed-authentik seed-immich seed-paperless influxdb \
-          apps authentik paperless audiobookshelf; do
+          apps authentik paperless audiobookshelf woodpecker; do
     check "kustomization/$ks Ready" \
         bash -c "kubectl -n flux-system get kustomization $ks \
           -o jsonpath='{.status.conditions[?(@.type==\"Ready\")].status}' | grep -q '^True\$'"

kubernetes/seed/woodpecker/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - hetzner-creds-externalsecret.yaml
-  - objectstore.yaml
-  - cluster.yaml
-  - scheduled-backup.yaml