From e691a91df1c27f753a8319674fbe4564e2745bed Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 11 Aug 2026 16:03:46 -0700
Subject: [PATCH] fix(vault): add vault-minio-creds secret, was created by
 deleted helmfile presync hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Vault's S3 storage backend needs AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY
from vault-minio-creds, previously generated by a helmfile presync hook
that no longer exists post-Terraform/helmfile removal. Sourced from the
same MINIO_ROOT_USER/PASSWORD already in .env. vault-unseal-keys still
missing separately — needs a live 'vault operator init' run, deferred.
---
 k8s/infra/iam/vault-secrets.enc.yaml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 k8s/infra/iam/vault-secrets.enc.yaml

diff --git a/k8s/infra/iam/vault-secrets.enc.yaml b/k8s/infra/iam/vault-secrets.enc.yaml
new file mode 100644
index 0000000..cbe81dd
--- /dev/null
+++ b/k8s/infra/iam/vault-secrets.enc.yaml
@@ -0,0 +1,24 @@
+apiVersion: ENC[AES256_GCM,data:6rk=,iv:KFms9ElUhHn+w9flx5nzLfwvfJsMN0u8+YDMqFgB6V8=,tag:bT1/FnwegVzqMmnYvLgiQg==,type:str]
+kind: ENC[AES256_GCM,data:9nKNMjB+,iv:rzn3Pt2pJcbDj55NYafUamNLTBrtluUPeLKorzpskGA=,tag:RNP8/lD/8yBGLNxsti+OXw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:yNadKj5FHjMNYtpHwwoPolM=,iv:f9pwyirRf/mLqr8LhuNPE53guP5mlZmPftNhtFKSbFA=,tag:ch5+QHuzDqV0b1sJ/yZp7A==,type:str]
+    namespace: ENC[AES256_GCM,data:6Qia,iv:rkU3kw12xPeVkVRn3w8WIZlc0+11jGeg1jZBX3kRfaQ=,tag:S0tx0vf3cYb9rKW0puKClQ==,type:str]
+type: ENC[AES256_GCM,data:482sksR1,iv:7gmqUtqcYzDHp99fYdinL4yYSTvjoyHlTnhHbEynGQY=,tag:zTY3HrpCS/GH8FZiskA+ng==,type:str]
+stringData:
+    access_key: ENC[AES256_GCM,data:j1D85IgXb7IMAA==,iv:QuGF69veC8FWOSAbwzv7vhKYkF0yOp0ty/U0hdmroAA=,tag:oNfKovQ7wY3tSBWMEJ2QiA==,type:str]
+    secret_key: ENC[AES256_GCM,data:ptw+7ykLtHYzzFWWofRCVuo0wlW+NvaJEvbZJUU0VWM5DJ0xC6bnbvKKOvc=,iv:dyKnNC8255FCmOd61xczuk0Ww9MYZmHCDc+JY60AjIQ=,tag:2j8ogpKxElsI3En+NDL2Hw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSQkVqdUUwY1BJbk10b1J0
+            aVBoTjIvelpGNldGRlQrdDJPdHRieXVkSFRjCkhSajhVSDJqSmNBMm90SGM3Z3Nm
+            eDFYVnl5dEtySjZJY01lamFDdHBSUGsKLS0tIDlSZTRJbkRxTXdXb0plWkVVelQ2
+            a1FWbm9Xd05tM0hoNkRQTHRleC9yZGsKWZnhsPX4bWrF5SGRncN566mywyYCL+EW
+            AEiIoIRhaue1bzamEAa1qj3Weg7IR4ORDAyNqW8BKdDyzYf+S8U0qg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-08-11T22:57:06Z"
+    mac: ENC[AES256_GCM,data:M09M9xNROHSkUfmNZgZ5SF08249AnGGEFbLPsQwgYpHSNt49lEXBtUYKoFDeITfh//orACF/qk7NXwNIr3x2i/6NGEipbRGXl9JcOrT8Df5Z64CRT365Y5agomagOZHJcb5cw238ejaaSfErZ9R8ZmAtK5kbnW8PvELPdovaMTU=,iv:TcMdAX2dx4M8jSahkLE7/vxmLM/hzbYOyDv5tyPWllk=,tag:0JnakV3PwwG0jq+hcghgiw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2