kubernetes/apps/authentik/barman-creds-externalsecret.yaml

@@ -4,7 +4,7 @@ metadata:
   name: barman-cloud-creds
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (barman creds).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (barman creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/authentik/hetzner-creds-externalsecret.yaml

@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/authentik/objectstore.yaml

@@ -5,7 +5,7 @@ metadata:
   name: ak-pg-store
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:

kubernetes/apps/authentik/scheduled-backup.yaml

@@ -11,7 +11,7 @@ metadata:
   name: ak-pg-daily
   namespace: authentik
   annotations:
-    # Prune-disabled ahead of the seed->authentik-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 30 2 * * *"

kubernetes/apps/immich/barman-creds-externalsecret.yaml

@@ -4,7 +4,7 @@ metadata:
   name: barman-cloud-creds
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (barman creds).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (barman creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/immich/hetzner-creds-externalsecret.yaml

@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/immich/objectstore.yaml

@@ -5,7 +5,7 @@ metadata:
   name: im-pg-store
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:

kubernetes/apps/immich/scheduled-backup.yaml

@@ -7,7 +7,7 @@ metadata:
   name: im-pg-daily
   namespace: immich
   annotations:
-    # Prune-disabled ahead of the seed->immich-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 0 3 * * *"

kubernetes/apps/influxdb/externalsecret.yaml

@@ -4,8 +4,8 @@ metadata:
   name: influxdb-bootstrap
   namespace: influxdb
   annotations:
-    # Prune-disabled ahead of the seed->apps handoff so the bootstrap Secret
-    # (admin token) can't be deleted out from under the token Jobs mid-move.
+    # Prune-disabled — a standing guard on the bootstrap Secret (admin token);
+    # kept from the seed->apps move so ESO/the token Jobs always have it.
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/paperless/barman-creds-externalsecret.yaml

@@ -4,7 +4,7 @@ metadata:
   name: barman-cloud-creds
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (barman creds).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (barman creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/paperless/hetzner-creds-externalsecret.yaml

@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/paperless/objectstore.yaml

@@ -5,7 +5,7 @@ metadata:
   name: pprl-pg-store
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:

kubernetes/apps/paperless/scheduled-backup.yaml

@@ -11,7 +11,7 @@ metadata:
   name: pprl-pg-daily
   namespace: paperless
   annotations:
-    # Prune-disabled ahead of the seed->paperless-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 30 2 * * *"

kubernetes/apps/woodpecker/hetzner-creds-externalsecret.yaml

@@ -4,7 +4,7 @@ metadata:
   name: hetzner-s3-creds
   namespace: apps
   annotations:
-    # Prune-disabled ahead of the seed->dedicated-KS handoff (barman S3 creds).
+    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (barman S3 creds).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   refreshInterval: 1h

kubernetes/apps/woodpecker/objectstore.yaml

@@ -5,7 +5,7 @@ metadata:
   name: wp-pg-store
   namespace: apps
   annotations:
-    # Prune-disabled ahead of the seed->dedicated-KS handoff (backup target).
+    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (backup target).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   configuration:

kubernetes/apps/woodpecker/scheduled-backup.yaml

@@ -9,7 +9,7 @@ metadata:
   name: wp-pg-daily
   namespace: apps
   annotations:
-    # Prune-disabled ahead of the seed->dedicated-KS handoff (backup schedule).
+    # Prune-disabled — a standing guard kept from the seed->dedicated-KS handoff (backup schedule).
     kustomize.toolkit.fluxcd.io/prune: disabled
 spec:
   schedule: "0 35 2 * * *"