Story Crater Bot 5e97c5cf64 feat(vault): add vault-unseal-keys Secret via ksops after operator init — vault was never initialized (empty S3 bucket), unseal keys captured from init; pod postStart auto-unseals on restart

2026-08-12 13:53:09 -07:00

..

apps

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00

argocd

feat(vault): add vault-unseal-keys Secret via ksops after operator init — vault was never initialized (empty S3 bucket), unseal keys captured from init; pod postStart auto-unseals on restart

2026-08-12 13:53:09 -07:00

bootstrap

fix(cert-manager): render issuers via kustomization resources list, restore automated sync — directory.include with bare filenames rendered empty (never matched), so ArgoCD tracked 0 resources and prune wiped the CA ConfigMaps + ClusterIssuers

2026-08-12 13:30:46 -07:00

infra

refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00