From 38370f90544f36a6b17897c7618cdc57d84f139b Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Sat, 25 Jul 2026 07:34:31 +0200 Subject: [PATCH] chore(immich): pre-stage prune:disabled on the im-pg CNPG objects (stage 1) Stage 1 of folding seed-immich into the existing dedicated immich KS (same pattern as paperless #399/#400). Adds prune: disabled, in place, to the 5 CNPG DB objects under seed/immich/ so the ownership handoff can never prune them: - Cluster/im-pg (pruning deletes its data PVCs) - ObjectStore/im-pg-store, ScheduledBackup/im-pg-daily - ExternalSecret/barman-cloud-creds, ExternalSecret/hetzner-s3-creds The immich-library (300Gi) + ml-cache PVCs already carry the annotation. Metadata-only; no CNPG restart. im-pg has 30 completed barman backups (last ~2.5h) as a backstop. Co-Authored-By: Claude Bot Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/seed/immich/barman-creds-externalsecret.yaml | 3 +++ kubernetes/seed/immich/cluster.yaml | 6 ++++++ kubernetes/seed/immich/hetzner-creds-externalsecret.yaml | 3 +++ kubernetes/seed/immich/objectstore.yaml | 3 +++ kubernetes/seed/immich/scheduled-backup.yaml | 3 +++ 5 files changed, 18 insertions(+) diff --git a/kubernetes/seed/immich/barman-creds-externalsecret.yaml b/kubernetes/seed/immich/barman-creds-externalsecret.yaml index 58fc467e..1a626ec8 100644 --- a/kubernetes/seed/immich/barman-creds-externalsecret.yaml +++ b/kubernetes/seed/immich/barman-creds-externalsecret.yaml @@ -3,6 +3,9 @@ kind: ExternalSecret metadata: name: barman-cloud-creds namespace: immich + annotations: + # Prune-disabled ahead of the seed->immich-KS handoff (barman creds). + kustomize.toolkit.fluxcd.io/prune: disabled spec: refreshInterval: 1h secretStoreRef: diff --git a/kubernetes/seed/immich/cluster.yaml b/kubernetes/seed/immich/cluster.yaml index e58a3bd3..44a57f34 100644 --- a/kubernetes/seed/immich/cluster.yaml +++ b/kubernetes/seed/immich/cluster.yaml @@ -3,6 +3,12 @@ kind: Cluster metadata: name: im-pg namespace: immich + annotations: + # CRITICAL data-guard: prune-disabled so the seed-immich -> immich KS + # ownership handoff can never prune this Cluster (which would delete its data + # PVCs). Landed here first, via seed-immich, so it's live before the move. + # Kept permanently as a standing guard. + kustomize.toolkit.fluxcd.io/prune: disabled spec: # Single instance during pgvecto.rs → VectorChord migration window; # pg_basebackup tar format chokes on the long pg_vectors/indexes/ diff --git a/kubernetes/seed/immich/hetzner-creds-externalsecret.yaml b/kubernetes/seed/immich/hetzner-creds-externalsecret.yaml index d9a33d97..1557f0cb 100644 --- a/kubernetes/seed/immich/hetzner-creds-externalsecret.yaml +++ b/kubernetes/seed/immich/hetzner-creds-externalsecret.yaml @@ -3,6 +3,9 @@ kind: ExternalSecret metadata: name: hetzner-s3-creds namespace: immich + annotations: + # Prune-disabled ahead of the seed->immich-KS handoff (barman S3 creds). + kustomize.toolkit.fluxcd.io/prune: disabled spec: refreshInterval: 1h secretStoreRef: diff --git a/kubernetes/seed/immich/objectstore.yaml b/kubernetes/seed/immich/objectstore.yaml index 51827ddb..949a5d12 100644 --- a/kubernetes/seed/immich/objectstore.yaml +++ b/kubernetes/seed/immich/objectstore.yaml @@ -4,6 +4,9 @@ kind: ObjectStore metadata: name: im-pg-store namespace: immich + annotations: + # Prune-disabled ahead of the seed->immich-KS handoff (backup target). + kustomize.toolkit.fluxcd.io/prune: disabled spec: configuration: # Offsite Hetzner Object Storage (fsn1) — replaces Garage on nas-1. diff --git a/kubernetes/seed/immich/scheduled-backup.yaml b/kubernetes/seed/immich/scheduled-backup.yaml index c271a32d..ec820aad 100644 --- a/kubernetes/seed/immich/scheduled-backup.yaml +++ b/kubernetes/seed/immich/scheduled-backup.yaml @@ -6,6 +6,9 @@ kind: ScheduledBackup metadata: name: im-pg-daily namespace: immich + annotations: + # Prune-disabled ahead of the seed->immich-KS handoff (backup schedule). + kustomize.toolkit.fluxcd.io/prune: disabled spec: schedule: "0 0 3 * * *" immediate: true -- 2.54.0