k.rennerandClaude Opus 4.7
b4975fabbb
The rebuild-k8s pipeline previously SOPS-encrypted talosconfig and kubeconfig and pushed them back to master. The git push raced with concurrent commits and forced workstation users to `git pull --rebase` after every rebuild. Replace the transport with Garage's k8s-secrets bucket (s3://k8s-secrets/cluster-access/), reusing the existing secrets-key that the install-garage-synology playbook already provisions. SOPS encryption is unchanged — only the storage layer moves. - New scripts/ci/fetch-kubeconfig.sh helper: 9 CI steps that previously inlined `sops -d kubernetes/access/kubeconfig.sops` now call this. - scripts/import-cluster-access.sh rewritten to pull both files from Garage; no more git fetch/checkout. - export-access step uploads via aws s3 cp; gitea_token + git config removed. - All consuming Woodpecker steps gain garage_secrets_key_id / garage_secrets_secret_key from_secret env vars, and bump to ci-k8s:2026-05-01 (the tag with aws-cli baked in). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>