Revert "fix(secrets): populate the empty sops placeholders and drop the unused one"

This reverts commit f6207ff2b0.

k8s/apps/paperless/backup-cronjob.yaml

@@ -48,7 +48,7 @@ spec:
                   mountPath: /backup
           containers:
             - name: mc-mirror
-              image: docker.io/bitnamilegacy/minio-client:2025.7.21-debian-12-r3@sha256:73bd39f7899a0cef12b8dd5df13aa93a3ed1aaa44236542442e9ac76819ac158
+              image: quay.io/minio/mc:latest
               env:
                 - name: ACCESS_KEY
                   valueFrom:

k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Secret
-type: Opaque
-metadata:
-    name: pi-code-agent-api-keys
-    namespace: poimen-sandbox
-stringData:
-    ANTHROPIC_API_KEY: ENC[AES256_GCM,data:TBcno/dzj3qykHjeX96UKZekuA/WMQT2E7a1ziPyYo5J6lWLPydgli84KeJZhH62/8CnnFtFOhVIe4FWCGPGjvqKH6M8WbiQHaP9y7FN0qQUpFHKNVAQ2R+s0wInhw0eUmANvd7bRx8aIZ2X,iv:oex19yVtWUevoJ0A3mkMLCfWu85o1gPSNp43x1iV0LE=,tag:BW3zQnwvagPceeNird9CZg==,type:str]
-    DEEPSEEK_API_KEY: ENC[AES256_GCM,data:vq/5gOsMVjlVMd0oXiBtHFHFEr+IF2YR2iP2OBFWx3ZFNoQ=,iv:QhLU/BRIJb/7QKDCRyw+HWPphZifVEhIOLywYDgOb20=,tag:BZdtXw+WsuK+P4E0caTa0Q==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqNm1LNE5nWktnd3c3STg3
-            UlVWbWJxWElxUHMwa0JVMk81Z0c4d0JaQm1vCnpLQWJWV3hxOU00NzJIaG51Mmlr
-            ZWpNTFJWcmdtV0w4YndQeHpvSUx2MTAKLS0tIDVnNkNuVWhPUFZ5V2hFOEt1eitG
-            blVqRy8yNnYzSU1FNzZGNkxrRElvWVEKL3J77INje75+CvKXaJHC3CvONgHv7d0a
-            a10MITvfreFr6M4AN3Z/mno49SDMp15Q4oQRagHHxSTS1K54mWHo8g==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-10-06T01:19:49Z"
-    mac: ENC[AES256_GCM,data:GpYl8IRefms36GvO3RW41c0US7SOgoOhd4rumxsCdEf5ME9kJ0eOxPx8klMgnlYrkBnwHmad8jj7C+HcA5Eim7mdUaYOZZWPFohvC6N4GLHX85aH78P09CelqG5tdm/Gm+1QfxYu0vANYGCAVjLK7YbBbZjbZmbvVfQvAbs3mOY=,iv:y3lglGu8FhTHQpO1poSIKgGYJFu5J9yjIaOjulda6fY=,tag:5Sgh4TbtNFMw7xOJjYRn0g==,type:str]
-    version: 3.13.2

k8s/argocd/secrets/secret-generator.yaml

@@ -33,4 +33,3 @@ files:
   - gotify-smtp-secrets.enc.yaml
   - forgejo-smtp-secrets.enc.yaml
   - paperless-ai-secrets.enc.yaml
-    - pi-sandbox-secrets.enc.yaml

k8s/infra/minio/minio-provision-paperless-job.yaml

@@ -52,14 +52,14 @@ spec:
       restartPolicy: Never
       initContainers:
         - name: kubectl-copy
-          image: bitnami/kubectl:latest@sha256:f7f9e4f64d9e114650c115a4ac6fd383394b3d494061a8f17b1a0f6c8d55bc25
+          image: bitnami/kubectl:latest
           command: ["sh", "-c", "cp $(which kubectl) /shared/kubectl"]
           volumeMounts:
             - name: shared
               mountPath: /shared
       containers:
         - name: provision
-          image: docker.io/bitnamilegacy/minio-client:2025.7.21-debian-12-r3@sha256:73bd39f7899a0cef12b8dd5df13aa93a3ed1aaa44236542442e9ac76819ac158
+          image: quay.io/minio/mc:latest
           volumeMounts:
             - name: shared
               mountPath: /shared

k8s/infra/minio/minio-tenant.yaml

@@ -16,10 +16,7 @@ spec:
   # backend could not resolve minio-cluster-hl. Official images now need registry auth
   # (quay.io/minio/minio returns 401), so this pins a public mirror of the same upstream
   # release; swap it for the official image once MinIO registry credentials exist.
-  # The digest freezes those bytes, so a retag or a deletion on the mirror cannot break
+  image: coollabsio/minio:RELEASE.2025-10-15T17-29-55Z
-  # the pull again. The same digest already sits in the containerd cache on talos-cp-1,
-  # so the first start needs no registry access.
-  image: docker.io/coollabsio/minio:RELEASE.2025-10-15T17-29-55Z@sha256:69b55a1c1c5dc285ce04db96689f5b2102317fc77a50680a1874ca6efd1c87f9
 
   # Disable operator auto-TLS: MinIO serves plain HTTP internally on 9000.
   # External TLS is terminated at nginx ingress (wildcard riotpiao-com-tls cert).

k8s/infra/monitoring/alerts/cluster-alerts.yaml

@@ -27,24 +27,6 @@ spec:
           annotations:
             summary: "{{ $value }} pod(s) stuck in Pending state for >10m"
 
-        # ImagePullBackOff on a vendor-deleted image produced no alert for 13 days
-        - alert: PodImagePullFailure
-          expr: sum(kube_pod_container_status_waiting_reason{reason=~"ImagePullBackOff|ErrImagePull"}) by (namespace, pod) > 0
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "{{ $labels.namespace }}/{{ $labels.pod }} cannot pull its image"
-
-        # Pod not ready
-        - alert: PodNotReady
-          expr: sum(kube_pod_status_ready{condition="false"}) by (namespace, pod) > 0
-          for: 15m
-          labels:
-            severity: warning
-          annotations:
-            summary: "{{ $labels.namespace }}/{{ $labels.pod }} is not ready"
-
         # CrashLoopBackOff
         - alert: PodCrashLooping
           expr: sum(kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff"}) by (namespace, pod) > 0

k8s/infra/poimen/kustomization.yaml

@@ -9,4 +9,3 @@ resources:
   - poimen-sandbox-namespace.yaml
   - poimen-sandbox-quota.yaml
   - pi-session-netpol.yaml
-  - pi-agent-workspace-pv.yaml

k8s/infra/poimen/pi-agent-workspace-pv.yaml

@@ -1,57 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  finalizers:
-  - kubernetes.io/pv-protection
-  labels:
-    app: pi-coding-agent-sandbox
-    part-of: poimen-toolkit
-  name: pi-agent-workspace-pv
-  annotations:
-    argocd.argoproj.io/sync-wave: '-1'
-spec:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 10Gi
-  claimRef:
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    name: pi-agent-workspace
-    namespace: poimen-sandbox
-  hostPath:
-    path: /var/lib/pi-agent-sandbox
-    type: DirectoryOrCreate
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-      - matchExpressions:
-        - key: kubernetes.io/hostname
-          operator: In
-          values:
-          - talos-cp-2
-  persistentVolumeReclaimPolicy: Retain
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  annotations:
-    pv.kubernetes.io/bind-completed: 'yes'
-    argocd.argoproj.io/sync-wave: '-1'
-  finalizers:
-  - kubernetes.io/pvc-protection
-  labels:
-    app: pi-coding-agent-sandbox
-    part-of: poimen-toolkit
-  name: pi-agent-workspace
-  namespace: poimen-sandbox
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
-  storageClassName: ''
-  volumeMode: Filesystem
-  volumeName: pi-agent-workspace-pv

terraform/files/coredns/Corefile

@@ -39,7 +39,6 @@
     rewrite name comfy.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name comfyui.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name gotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
-    rewrite name pi.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name igotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local