From f318719c59cbdda46de83ffe457e0b1bbb9dbe25 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sat, 12 Sep 2026 17:00:43 +0000 Subject: [PATCH] velero(secrets): seal dedicated Hetzner OS S3 credential (DEV-570) Adds SealedSecret velero-s3-credentials in namespace velero, holding the dedicated velero-prod Hetzner Object Storage access/secret key (scoped only to the basicstack-velero bucket). Sealed on cp-1 via /root/seal-velero-s3-credentials.sh with the sealed-secrets-controller public cert; plaintext never left the host. Only the in-cluster controller can decrypt. Co-Authored-By: Paperclip --- apps/velero/velero-s3-credentials-sealed.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 apps/velero/velero-s3-credentials-sealed.yaml diff --git a/apps/velero/velero-s3-credentials-sealed.yaml b/apps/velero/velero-s3-credentials-sealed.yaml new file mode 100644 index 0000000..d3038c1 --- /dev/null +++ b/apps/velero/velero-s3-credentials-sealed.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: velero-s3-credentials + namespace: velero +spec: + encryptedData: + cloud: AgAQ6Z8YgP/K8RYwov4NcHK+z5RXkQsBlq8i/QkpsP88VZtuBCRV8O+GyhcnyzVKt7iO12Qk8MNN3S9rpgcuZfBhtlXq7SspshFIGQ0Iy8omywqr0leVRXa1zyv5pp2WcDLYpGG20Jy9Utg3QPf2/fGpMu5nbmYj0ZpTtvRnbzyq8uFI5ht9l1Fu5lKEzK/cnmnc1zigKNmqBnflwB4NMUc36FA1bQyHgSuMzt+UNSkV8AHV+XVZgT2KTCQdj3kUaDOTir8WUAq+bjH5NUJMRQOGGqQ345rYXzbEWVLnvZW07VADTUluLW2252PtlB3aATJBFh7Ow7igDkt6rEVw7y9YWcYHt2s/ZU2URwBSvVXMfRRONAkTEs+ArHzkl3BoYoWMMX0asvFO6kXMUKlXR6PA+Mx7VEWQG/1YoQFV92+8CO4ZiYZKQ7hLvAaj8oCTpvMIy7NVOsd3/1iUd3kbjKUV6S3hCahKAGLPpsE496x2nqid3cBij/8MW429rWbkz+cEdixHUl7992V91szXOYuCzDADhy+XYrgt02HmTAXE0qdZh2c/0QVnxpLtCRkaf1oA4EUg3dZsPsilcXNPTzhRa9XzoODQ+2xpMLjDSmWbL3WhSiraxoiat0t6EO7OZb2xQYQReoDGAobtf1seOWq4MIdkh4Jl3q5V/kFHp6wFqt41r+oUZYJ78zMhzFVivEA3xOmRkSfnasBTZZUffHLHN5YF8wAFo9H5hKoCibrX02HUJNLe8zRF5GRpJwV2aOCnmFUHRxDLxGf6Wo/d5bQVDwM1JFoSewOTc88Qi7fei54+VBgH4TDP+ccb3VrzhmkcEzEL8d328KVKcbmTDxmm7DlrwQ== + template: + metadata: + annotations: + argocd.argoproj.io/compare-options: IgnoreExtraneous + creationTimestamp: null + name: velero-s3-credentials + namespace: velero + type: Opaque