feat(vault): add vault-unseal-keys Secret via ksops after operator init — vault was never initialized (empty S3 bucket), unseal keys captured from init; pod postStart auto-unseals on restart

k8s/argocd/secrets/secret-generator.yaml

@@ -17,3 +17,4 @@ files:
   - loki-secrets.enc.yaml
   - minio-secrets.enc.yaml
   - vault-secrets.enc.yaml
+  - vault-unseal-keys.enc.yaml

k8s/argocd/secrets/vault-unseal-keys.enc.yaml

@@ -0,0 +1,25 @@
+apiVersion: ENC[AES256_GCM,data:Gn8=,iv:DmWiGvlY/rBzp1Yh6yKw9pXjFO7smSB1fKfe7agSJz8=,tag:X6KSIbxlZWYYXKKxOfuThw==,type:str]
+kind: ENC[AES256_GCM,data:lsjz9hz4,iv:vLq5BRMjNRl2ZGDQSrgff7NiZQsBEMSl6OTZ5dAMisk=,tag:ug62YjRZXbN1Y7PoMihsIw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:TkkvNs86o2+hC8MAi8lEeU8=,iv:SaxeZgpWekHMJeoHKaoZYGPEVGw42XUk/sT6SaKGVN0=,tag:mtA9SwNKiXh3NrC5rdasRg==,type:str]
+    namespace: ENC[AES256_GCM,data:wK6m,iv:KtA31Bo8aGE1HU8H9KWbMwt2NfywWfy77G/LaReaI1E=,tag:V9SSlPawRQw0x2utFNN1aw==,type:str]
+type: ENC[AES256_GCM,data:6UPZ1ZTR,iv:FxN1ebrlJ4IO3eDGEYSvktSpMgAebcl0DO1WHh5O0+0=,tag:2bZN4zdbHzx0oR+bTJPPJg==,type:str]
+stringData:
+    key1: ENC[AES256_GCM,data:dV2HOh7W1Pl0QDJaGvtEKpBppybQMiK5kxzyk05zkA352ZmJvE8Ppm5yWKk=,iv:grQ8v2o/LHpJnIZonjtgTHKcLUQIH8xl1FtWtEs4rEs=,tag:lANcccYT6Ouo/0IcoLw4uA==,type:str]
+    key2: ENC[AES256_GCM,data:YSdpYL8h56PfUrvMFhBXhmBG2en0toLKEpYlJqwjAk/vI0jm7gq/TqGn034=,iv:GxthkNLhm3qHxjkZetiYl58Qa/K7G2ib6E+LWK16H8Q=,tag:q79UUoh6uCcMZJ0U18Ireg==,type:str]
+    key3: ENC[AES256_GCM,data:sO7Lao9qkmIOdARL+6FBcLo+e4z8LzMEzNrwcy5hv9uRuxppwAXrP0MO1vw=,iv:wSWe9h1HovRhV5YCZrmvcB2VEfRYQ+gasGO3uh8IpmQ=,tag:Bc5yaROQDTz1AhVnFDm/BA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtekFMUWlnb2tiUVhCODE1
+            TkNCclVTa0dVUFhlc0l2elUrVi9MUytSM3pRCkdtYlRFL1cwTHNPZnFicHZwUnZU
+            eENhS0dIek1JbzZEODFSY2tyem91MUUKLS0tIFIzQzNmcERZM0hBbGI0TndEeGlB
+            MFk1RTBFbHRqempyYlQ2U05YVko2R1EKVvk1Rd9ZU0G1GHX+3mmlHAfQOPzmoPsk
+            7RltNZF2SCxjIv5C2pqf3CgmRBaQGWgMybRRH5gdB87PLBKkPL3+HQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-08-12T20:52:24Z"
+    mac: ENC[AES256_GCM,data:kLjoBWmJ2bZ13EbuzgppahHKmCY/xtCi1R7xCEUbCP4FQfiVaC4qAbVftE4lTNlXa2mqCKsGPYZ/A3HV/4+a+it/pg0a+rj7E7DszhieWbZufHMJs+w4/Le8l8wFFE5aNW0wdvGTJZ0n4HBOdAkE1qN9ReaiaQgr0rk5ggOPG9g=,iv:MiDVUgcoKrP/gj4keqomo6OB12dmz9VoesTiHQTnBFM=,tag:cLK67Pym4BuvXLF1RUA8Gw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2