kubernetes/seed/immich/barman-creds-externalsecret.yaml

@@ -3,6 +3,9 @@ kind: ExternalSecret
 metadata:
   name: barman-cloud-creds
   namespace: immich
+  annotations:
+    # Prune-disabled ahead of the seed->immich-KS handoff (barman creds).
+    kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
   secretStoreRef:

kubernetes/seed/immich/cluster.yaml

@@ -3,6 +3,12 @@ kind: Cluster
 metadata:
   name: im-pg
   namespace: immich
+  annotations:
+    # CRITICAL data-guard: prune-disabled so the seed-immich -> immich KS
+    # ownership handoff can never prune this Cluster (which would delete its data
+    # PVCs). Landed here first, via seed-immich, so it's live before the move.
+    # Kept permanently as a standing guard.
+    kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   # Single instance during pgvecto.rs → VectorChord migration window;
   # pg_basebackup tar format chokes on the long pg_vectors/indexes/<uuid>

kubernetes/seed/immich/hetzner-creds-externalsecret.yaml

@@ -3,6 +3,9 @@ kind: ExternalSecret
 metadata:
   name: hetzner-s3-creds
   namespace: immich
+  annotations:
+    # Prune-disabled ahead of the seed->immich-KS handoff (barman S3 creds).
+    kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h
   secretStoreRef:

kubernetes/seed/immich/objectstore.yaml

@@ -4,6 +4,9 @@ kind: ObjectStore
 metadata:
   name: im-pg-store
   namespace: immich
+  annotations:
+    # Prune-disabled ahead of the seed->immich-KS handoff (backup target).
+    kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:
     # Offsite Hetzner Object Storage (fsn1) — replaces Garage on nas-1.

kubernetes/seed/immich/scheduled-backup.yaml

@@ -6,6 +6,9 @@ kind: ScheduledBackup
 metadata:
   name: im-pg-daily
   namespace: immich
+  annotations:
+    # Prune-disabled ahead of the seed->immich-KS handoff (backup schedule).
+    kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 0 3 * * *"
   immediate: true