ci: decommission migration-only rebuild-k8s; point access tooling at Hetzner #73

2026-06-27T10:18:15Z

k.renner commented

2026-06-27 10:18:15 +00:00

Tier 2 (CI/access half) of the nas-1/Garage decoupling.

Decommission rebuild-k8s.yml — the one-shot PVE→K8s migration/rebuild pipeline, no longer needed and still pointing at the retired Garage S3 on the now-off nas-1. DR restore is via Velero + flux bootstrap.

⚠️ Heads-up: the project record treats rebuild-k8s as the disaster-recovery pipeline. Removing per your call that it was migration-only — fully git-recoverable if needed. Its export-access step was the only thing refreshing the S3 kubeconfig that e2e fetches; with it gone the existing object persists (fine for a stable cluster).

Migrate the live cluster-access path off Garage → Hetzner (renner-uno-k8s-secrets, fsn1.your-objectstorage.com, region fsn1, hetzner_s3_* keypair):

scripts/ci/fetch-kubeconfig.sh — env vars GARAGE_SECRETS_* → S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY.
.woodpecker/e2e.yml + e2e-test.yml — the live cron e2e pipeline was broken against dead nas-1; now uses the Hetzner keypair.
scripts/import-cluster-access.sh — endpoint/bucket/region. Action needed: the workstation aws-cli secrets profile must now hold the Hetzner Object Storage keypair.

Also deletes the orphaned test-garage-smoke play+pipeline and fixes two dangling rebuild-k8s.yml doc references.

Assumption to verify: kubeconfig.sops/talosconfig.sops were migrated into renner-uno-k8s-secrets. If not, e2e/import need a one-time re-upload.

Not included (your call): install-garage-synology (play + pipeline) still provisions Garage on the NAS — left in place since removing the provisioning capability is a deliberate decommissioning decision, not auto-cleanup.

🤖 Generated with Claude Code

Tier 2 (CI/access half) of the nas-1/Garage decoupling. **Decommission** `rebuild-k8s.yml` — the one-shot PVE→K8s migration/rebuild pipeline, no longer needed and still pointing at the retired Garage S3 on the now-off nas-1. DR restore is via Velero + flux bootstrap. > ⚠️ Heads-up: the project record treats `rebuild-k8s` as the disaster-recovery pipeline. Removing per your call that it was migration-only — fully git-recoverable if needed. Its `export-access` step was the only thing refreshing the S3 kubeconfig that e2e fetches; with it gone the existing object persists (fine for a stable cluster). **Migrate the live cluster-access path off Garage → Hetzner** (`renner-uno-k8s-secrets`, `fsn1.your-objectstorage.com`, region `fsn1`, `hetzner_s3_*` keypair): - `scripts/ci/fetch-kubeconfig.sh` — env vars `GARAGE_SECRETS_*` → `S3_ACCESS_KEY_ID`/`S3_SECRET_ACCESS_KEY`. - `.woodpecker/e2e.yml` + `e2e-test.yml` — the live **cron** e2e pipeline was broken against dead nas-1; now uses the Hetzner keypair. - `scripts/import-cluster-access.sh` — endpoint/bucket/region. **Action needed:** the workstation aws-cli `secrets` profile must now hold the Hetzner Object Storage keypair. Also deletes the orphaned `test-garage-smoke` play+pipeline and fixes two dangling `rebuild-k8s.yml` doc references. **Assumption to verify:** `kubeconfig.sops`/`talosconfig.sops` were migrated into `renner-uno-k8s-secrets`. If not, e2e/import need a one-time re-upload. **Not included (your call):** `install-garage-synology` (play + pipeline) still provisions Garage on the NAS — left in place since removing the provisioning capability is a deliberate decommissioning decision, not auto-cleanup. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-27 10:18:15 +00:00

ci: decommission migration-only rebuild-k8s; point access tooling at Hetzner 0ce60164e1

rebuild-k8s.yml was the one-shot PVE->K8s migration/rebuild pipeline; it
is no longer needed and still pointed at the retired Garage S3 on the
now-off nas-1. Remove it (DR restore is via Velero + flux bootstrap).

The live cluster-access path is kept and migrated off Garage onto Hetzner
Object Storage (renner-uno-k8s-secrets, fsn1.your-objectstorage.com,
region fsn1, hetzner_s3_* keypair):
- scripts/ci/fetch-kubeconfig.sh: Garage -> Hetzner; env vars renamed
  GARAGE_SECRETS_* -> S3_ACCESS_KEY_ID/S3_SECRET_ACCESS_KEY.
- .woodpecker/e2e.yml, e2e-test.yml: pass hetzner_s3_access_key/secret_key
  (the live cron e2e pipeline needs this — it was broken against dead nas-1).
- scripts/import-cluster-access.sh: Garage -> Hetzner endpoint/bucket/region.
  NOTE: the workstation aws-cli "secrets" profile must now hold the Hetzner
  Object Storage keypair.

Also: delete the orphaned test-garage-smoke play + pipeline, and fix the
two dangling rebuild-k8s.yml references (zfs-tuning play comment;
update-audit prompt Talos-pin file list).

Assumes cluster-access objects (kubeconfig.sops/talosconfig.sops) were
migrated into renner-uno-k8s-secrets; with rebuild-k8s gone, nothing
auto-refreshes them, which is fine for a stable cluster.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit e875e672b4 into master

2026-06-27 10:37:45 +00:00

k.renner referenced this issue from a commit

2026-06-27 10:37:47 +00:00

Merge pull request 'ci: decommission migration-only rebuild-k8s; point access tooling at Hetzner' (#73) from decouple-garage-decomm-rebuild into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#73