Story Crater Bot 19089e0514 fix(agent-pod): register agent-pod-models.enc.yaml with ksops generator ...

Secret was created but never listed in secret-generator.yaml's files
allowlist, so ksops never decrypted it — pod stuck on FailedMount
waiting for secret "pi-models".

2026-08-16 00:27:10 -07:00

..

_deferred-values-fragments

fix(logging): deploy loki-s3-creds as kind:Secret via ksops — was a helm-values fragment wired to nothing, loki extraEnvFrom secretRef loki-s3-creds never resolved (CreateContainerConfigError); provides access_key_id/secret_access_key for MinIO S3 backend

2026-08-12 13:46:07 -07:00

agent-pod-models.enc.yaml

feat(agent-pod): deploy pi coding-agent pod for in-cluster harness

2026-08-16 00:23:30 -07:00

authentik-secrets.enc.yaml

fix(iam): deploy authentik-secrets as kind:Secret via ksops — was a helm-values fragment wired to nothing, so envFrom secretRef authentik-secrets never resolved (CreateContainerConfigError); provides AUTHENTIK_SECRET_KEY/BOOTSTRAP_PASSWORD/BOOTSTRAP_TOKEN

2026-08-12 13:37:39 -07:00

cloudflare-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

forgejo-runner-token.enc.yaml

feat(forgejo): add runner-token Secret via ksops — forgejo-runner register initContainer needs the registration token (from gitea actions generate-runner-token); was missing so runner deploy stuck 0/1

2026-08-12 16:19:38 -07:00

forgejo-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

grafana-oidc-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

grafana-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

homarr-auth-oidc.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-12 14:08:18 -07:00

homarr-db-encryption.enc.yaml

fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError

2026-08-12 14:08:18 -07:00

homarr-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

homelab-ca-secrets.enc.yaml

fix(cert-manager): regenerate homelab-ca cert with basicConstraints CA:TRUE — old self-signed cert lacked CA:TRUE so the homelab-ca ClusterIssuer rejected it ('certificate is not a CA'); regen keypair Secret + trust-bundle ConfigMaps (4 ns) with matching CA cert

2026-08-12 13:56:37 -07:00

kustomization.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

loki-secrets.enc.yaml

fix(logging): deploy loki-s3-creds as kind:Secret via ksops — was a helm-values fragment wired to nothing, loki extraEnvFrom secretRef loki-s3-creds never resolved (CreateContainerConfigError); provides access_key_id/secret_access_key for MinIO S3 backend

2026-08-12 13:46:07 -07:00

minio-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

model-invoke-apikey.enc.yaml

feat(api): add Kong key-auth for the model API — static API key (ksops-managed model-invoke-apikey) via KongConsumer model-invoker + key-auth plugin on all 5 model routes, OpenAI-SDK compatible (Authorization: Bearer <key>)

2026-08-13 20:28:32 -07:00

secret-generator.yaml

fix(agent-pod): register agent-pod-models.enc.yaml with ksops generator

2026-08-16 00:27:10 -07:00

vault-secrets.enc.yaml

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

vault-unseal-keys.enc.yaml

feat(vault): add vault-unseal-keys Secret via ksops after operator init — vault was never initialized (empty S3 bucket), unseal keys captured from init; pod postStart auto-unseals on restart

2026-08-12 13:53:09 -07:00