kubernetes/apps/immich/kustomization.yaml

@@ -6,3 +6,13 @@ resources:
   - machine-learning.yaml
   - server.yaml
   - ingress.yaml
+  # im-pg CNPG Postgres + library/ml-cache PVCs (moved here from the retired
+  # seed-immich KS; each carries prune: disabled so ownership transferred without
+  # a teardown). This KS gains the infrastructure-cnpg-barman dep + CNPG Cluster
+  # healthCheckExprs (see clusters/homelab/immich.yaml).
+  - cluster.yaml
+  - objectstore.yaml
+  - scheduled-backup.yaml
+  - barman-creds-externalsecret.yaml
+  - hetzner-creds-externalsecret.yaml
+  - pvcs.yaml

kubernetes/clusters/homelab/immich.yaml

@@ -4,8 +4,10 @@ metadata:
   name: immich
   namespace: flux-system
 spec:
-  # DB cluster + library PVC are populated by the seed phase; this
-  # Kustomization reconciles app manifests only.
+  # Owns the immich app plus its im-pg CNPG Cluster + ObjectStore +
+  # ScheduledBackup and the library/ml-cache PVCs (folded in from the retired
+  # seed-immich KS). The one-shot pg_restore + library-rsync seed Jobs that
+  # originally populated them are long gone.
   interval: 10m
   retryInterval: 1m
   timeout: 30m
@@ -21,4 +23,9 @@ spec:
     - name: infrastructure
     - name: infrastructure-crds
     - name: infrastructure-ceph-cluster
-    - name: seed-immich
+    - name: infrastructure-cnpg-barman
+  healthCheckExprs:
+    - apiVersion: postgresql.cnpg.io/v1
+      kind: Cluster
+      failed: "has(status.phase) && status.phase.startsWith('Failed')"
+      current: "has(status.phase) && (status.phase == 'Cluster in healthy state' || status.readyInstances > 0)"

kubernetes/clusters/homelab/seed-immich.yaml

@@ -1,35 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: seed-immich
-  namespace: flux-system
-spec:
-  # Per-app slice of the former monolithic `seed` KS — owns the im-pg
-  # CNPG Cluster, ObjectStore, ScheduledBackup, the pg_restore seed Job,
-  # and the long library-seed rsync (~250 GiB, the wall-time pole of
-  # the rebuild). Only the downstream `immich` KS gates on this; other
-  # apps are no longer blocked by it. The Cluster bootstraps via `initdb`
-  # (empty DB on cold rebuild); CNPG restore is manual — see the runbook
-  # at kubernetes/seed/RECOVERY.md (issue #190).
-  interval: 10m
-  retryInterval: 2m
-  # Long enough for the worst-case immich-library rsync (~30–45 min).
-  timeout: 4h
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./kubernetes/seed/immich
-  prune: true
-  wait: true
-  # decryption block dropped 2026-07-14: path is sops-free — secrets come
-  # from OpenBao via ESO (MIGRATION-sops-openbao.md).
-  dependsOn:
-    - name: infrastructure
-    - name: infrastructure-crds
-    - name: infrastructure-ceph-cluster
-    - name: infrastructure-cnpg-barman
-  healthCheckExprs:
-    - apiVersion: postgresql.cnpg.io/v1
-      kind: Cluster
-      failed: "has(status.phase) && status.phase.startsWith('Failed')"
-      current: "has(status.phase) && (status.phase == 'Cluster in healthy state' || status.readyInstances > 0)"

kubernetes/e2e-test.sh

@@ -107,8 +107,8 @@ check "3 nodes Ready" \
 
 echo "=== Flux Kustomizations ==="
 for ks in flux-system infrastructure infrastructure-crds infrastructure-ceph-cluster \
-          seed-authentik seed-immich influxdb \
-          apps authentik paperless audiobookshelf woodpecker; do
+          seed-authentik influxdb \
+          apps authentik paperless audiobookshelf woodpecker immich; do
     check "kustomization/$ks Ready" \
         bash -c "kubectl -n flux-system get kustomization $ks \
           -o jsonpath='{.status.conditions[?(@.type==\"Ready\")].status}' | grep -q '^True\$'"

kubernetes/infrastructure/openbao/snapshot-pvc.yaml

@@ -8,7 +8,7 @@ metadata:
     # snapshots — the raft data PVC itself is NOT backed up). Shield it from
     # Flux prune so a rename/removal/move of this manifest can never delete
     # the backup volume out from under a disaster recovery, matching the
-    # sibling data PVCs (apps/home-assistant, seed/immich, apps/paperless).
+    # sibling data PVCs (apps/home-assistant, apps/immich, apps/paperless).
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
     # Velero's openbao-daily Schedule selects exactly this label — the raft

kubernetes/seed/immich/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - barman-creds-externalsecret.yaml
-  - hetzner-creds-externalsecret.yaml
-  - objectstore.yaml
-  - cluster.yaml
-  - scheduled-backup.yaml
-  - pvcs.yaml