The three backed-up CNPG clusters (ak-pg/im-pg/pprl-pg) bootstrap via
bootstrap.initdb, so a cold rebuild silently comes up with EMPTY databases:
barman WAL+base backups archive to Hetzner but are never wired back into a
rebuild, and the restore path was undocumented (issue #190).
- Add kubernetes/seed/RECOVERY.md: a tested manual recovery runbook with
per-cluster bootstrap.recovery + externalClusters blocks, precondition
checks, verify/revert steps, and a non-destructive CNPG restore-test drill.
- Explain the safety model: CNPG bootstrap is inert on a live cluster, so an
initdb->recovery swap cannot clobber live data; recovery has no initdb
fallback (hangs on an empty bucket), which is why permanent recovery is an
owner decision, not flipped here.
- Fix the seed-authentik Flux KS comment that falsely claimed rebuilds
auto-recover from Garage (decommissioned; backups are on Hetzner now).
- Point seed-immich / seed-paperless KS comments at the runbook.
Refs #190
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
claude-botandClaude Opus 4.8
260aec3d0b