basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions

velero(secrets): seal dedicated Hetzner OS S3 credential (DEV-570)

Browse source 
Adds SealedSecret velero-s3-credentials in namespace velero, holding
the dedicated velero-prod Hetzner Object Storage access/secret key
(scoped only to the basicstack-velero bucket).

Sealed on cp-1 via /root/seal-velero-s3-credentials.sh with the
sealed-secrets-controller public cert; plaintext never left the host.
Only the in-cluster controller can decrypt.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-09-12 17:00:43 +00:00
parent 0c82ded5f7
commit f318719c59
1 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
apps/velero/velero-s3-credentials-sealed.yaml Normal file
View file

@ -0,0 +1,18 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: velero-s3-credentials
namespace: velero
spec:
encryptedData:
cloud: AgAQ6Z8YgP/K8RYwov4NcHK+z5RXkQsBlq8i/QkpsP88VZtuBCRV8O+GyhcnyzVKt7iO12Qk8MNN3S9rpgcuZfBhtlXq7SspshFIGQ0Iy8omywqr0leVRXa1zyv5pp2WcDLYpGG20Jy9Utg3QPf2/fGpMu5nbmYj0ZpTtvRnbzyq8uFI5ht9l1Fu5lKEzK/cnmnc1zigKNmqBnflwB4NMUc36FA1bQyHgSuMzt+UNSkV8AHV+XVZgT2KTCQdj3kUaDOTir8WUAq+bjH5NUJMRQOGGqQ345rYXzbEWVLnvZW07VADTUluLW2252PtlB3aATJBFh7Ow7igDkt6rEVw7y9YWcYHt2s/ZU2URwBSvVXMfRRONAkTEs+ArHzkl3BoYoWMMX0asvFO6kXMUKlXR6PA+Mx7VEWQG/1YoQFV92+8CO4ZiYZKQ7hLvAaj8oCTpvMIy7NVOsd3/1iUd3kbjKUV6S3hCahKAGLPpsE496x2nqid3cBij/8MW429rWbkz+cEdixHUl7992V91szXOYuCzDADhy+XYrgt02HmTAXE0qdZh2c/0QVnxpLtCRkaf1oA4EUg3dZsPsilcXNPTzhRa9XzoODQ+2xpMLjDSmWbL3WhSiraxoiat0t6EO7OZb2xQYQReoDGAobtf1seOWq4MIdkh4Jl3q5V/kFHp6wFqt41r+oUZYJ78zMhzFVivEA3xOmRkSfnasBTZZUffHLHN5YF8wAFo9H5hKoCibrX02HUJNLe8zRF5GRpJwV2aOCnmFUHRxDLxGf6Wo/d5bQVDwM1JFoSewOTc88Qi7fei54+VBgH4TDP+ccb3VrzhmkcEzEL8d328KVKcbmTDxmm7DlrwQ==
template:
metadata:
annotations:
argocd.argoproj.io/compare-options: IgnoreExtraneous
creationTimestamp: null
name: velero-s3-credentials
namespace: velero
type: Opaque