From 2f3d95265642ed0439b7d192406a2c3cbc064fc1 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Thu, 27 Aug 2026 21:18:08 +0200 Subject: [PATCH] refactor(secrets): drop the unused barman-cloud-creds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three ExternalSecrets synced a Secret that nothing reads. Established rather than assumed, from three directions: every live ObjectStore names hetzner-s3-creds, no CNPG Cluster uses the legacy inline barmanObjectStore (all seven run the barman-cloud plugin against an ObjectStore CR), and no pod in the cluster mounts barman-cloud-creds. They are almost certainly left from before the plugin migration, when the inline configuration read a Secret of that name. Worth stating plainly because it is not merely untidy: seed/{authentik,immich, paperless}/barman-creds hold a Hetzner S3 credential that is NOT the one in use. Fingerprint c2c5cf3e against 87954b64 for the live hetzner-s3 path, with the three copies identical to each other. A valid key with no consumer is exposure without benefit, so if it is a distinct S3 key it wants revoking at Hetzner, which only a human can do — deleting our copies does not. Removing the manifests does NOT remove the objects. All three carry kustomize.toolkit.fluxcd.io/prune: disabled from the seed->app-KS handoffs, so Flux skips them during garbage collection by design. The ExternalSecrets, their Secrets and the three OpenBao paths have to be deleted explicitly after this merges; git alone leaves them live and orphaned, which is worse than leaving them declared. The OpenBao paths deliberately stay until then. Deleting them first would leave three ExternalSecrets failing to sync against a key that no longer exists, for no gain. --- .../authentik/barman-creds-externalsecret.yaml | 18 ------------------ kubernetes/apps/authentik/kustomization.yaml | 1 - .../immich/barman-creds-externalsecret.yaml | 18 ------------------ kubernetes/apps/immich/kustomization.yaml | 1 - .../paperless/barman-creds-externalsecret.yaml | 18 ------------------ kubernetes/apps/paperless/kustomization.yaml | 1 - 6 files changed, 57 deletions(-) delete mode 100644 kubernetes/apps/authentik/barman-creds-externalsecret.yaml delete mode 100644 kubernetes/apps/immich/barman-creds-externalsecret.yaml delete mode 100644 kubernetes/apps/paperless/barman-creds-externalsecret.yaml diff --git a/kubernetes/apps/authentik/barman-creds-externalsecret.yaml b/kubernetes/apps/authentik/barman-creds-externalsecret.yaml deleted file mode 100644 index 40a1877c..00000000 --- a/kubernetes/apps/authentik/barman-creds-externalsecret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: barman-cloud-creds - namespace: authentik - annotations: - # Prune-disabled — a standing guard kept from the seed->authentik-KS handoff (barman creds). - kustomize.toolkit.fluxcd.io/prune: disabled -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: openbao - target: - name: barman-cloud-creds # keeps the old Secret's name — consumers unchanged - dataFrom: - - extract: - key: seed/authentik/barman-creds diff --git a/kubernetes/apps/authentik/kustomization.yaml b/kubernetes/apps/authentik/kustomization.yaml index d5ffae33..8c1a9028 100644 --- a/kubernetes/apps/authentik/kustomization.yaml +++ b/kubernetes/apps/authentik/kustomization.yaml @@ -27,5 +27,4 @@ resources: - cluster.yaml - objectstore.yaml - scheduled-backup.yaml - - barman-creds-externalsecret.yaml - hetzner-creds-externalsecret.yaml diff --git a/kubernetes/apps/immich/barman-creds-externalsecret.yaml b/kubernetes/apps/immich/barman-creds-externalsecret.yaml deleted file mode 100644 index bc17618e..00000000 --- a/kubernetes/apps/immich/barman-creds-externalsecret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: barman-cloud-creds - namespace: immich - annotations: - # Prune-disabled — a standing guard kept from the seed->immich-KS handoff (barman creds). - kustomize.toolkit.fluxcd.io/prune: disabled -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: openbao - target: - name: barman-cloud-creds # keeps the old Secret's name — consumers unchanged - dataFrom: - - extract: - key: seed/immich/barman-creds diff --git a/kubernetes/apps/immich/kustomization.yaml b/kubernetes/apps/immich/kustomization.yaml index ad1b5458..258d32c7 100644 --- a/kubernetes/apps/immich/kustomization.yaml +++ b/kubernetes/apps/immich/kustomization.yaml @@ -13,6 +13,5 @@ resources: - cluster.yaml - objectstore.yaml - scheduled-backup.yaml - - barman-creds-externalsecret.yaml - hetzner-creds-externalsecret.yaml - pvcs.yaml diff --git a/kubernetes/apps/paperless/barman-creds-externalsecret.yaml b/kubernetes/apps/paperless/barman-creds-externalsecret.yaml deleted file mode 100644 index e2758342..00000000 --- a/kubernetes/apps/paperless/barman-creds-externalsecret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: barman-cloud-creds - namespace: paperless - annotations: - # Prune-disabled — a standing guard kept from the seed->paperless-KS handoff (barman creds). - kustomize.toolkit.fluxcd.io/prune: disabled -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: openbao - target: - name: barman-cloud-creds # keeps the old Secret's name — consumers unchanged - dataFrom: - - extract: - key: seed/paperless/barman-creds diff --git a/kubernetes/apps/paperless/kustomization.yaml b/kubernetes/apps/paperless/kustomization.yaml index fa32e724..1f18a190 100644 --- a/kubernetes/apps/paperless/kustomization.yaml +++ b/kubernetes/apps/paperless/kustomization.yaml @@ -20,7 +20,6 @@ resources: - cluster.yaml - objectstore.yaml - scheduled-backup.yaml - - barman-creds-externalsecret.yaml - hetzner-creds-externalsecret.yaml - pvcs.yaml configMapGenerator: -- 2.54.0