feat(secrets): warm-up migration — infrastructure secrets to OpenBao/ESO #171

2026-07-13T17:07:15Z

claude-bot commented

2026-07-13 17:07:15 +00:00

Phase 3 warm-up batch per kubernetes/MIGRATION-sops-openbao.md. Values are already in OpenBao KV (verified: bao kv list homelab/infrastructure shows all 5). This PR swaps the manifests:

sops file (deleted)	ExternalSecret target (unchanged name)	KV key
external-dns-unifi/secret.sops.yaml	`external-dns-unifi-secret` (apps)	infrastructure/external-dns-unifi
netbird-ingress/secret.sops.yaml	`netbird-ingress-setup-key` (ingress)	infrastructure/netbird-ingress
velero/secret.sops.yaml	`cloud-credentials` (velero)	infrastructure/velero
velero/hetzner-creds.sops.yaml	`cloud-credentials-hetzner` (velero)	infrastructure/velero-hetzner
post-crds/cloudflare-secret.sops.yaml	`cloudflare-api-token` (cert-manager)	infrastructure/cloudflare

Also drops the now-dead decryption blocks from the infrastructure and infrastructure-crds Kustomizations (both paths sops-free) and ticks the doc checklist.

On merge Flux prunes the old Secrets and ESO recreates them within seconds from OpenBao — same names, consumers unaffected. Rollback for any single file is a plain git revert while the age key lives. I'll verify all 5 ExternalSecrets go SecretSynced and spot-check velero backups + cert-manager after merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

Phase 3 warm-up batch per kubernetes/MIGRATION-sops-openbao.md. Values are **already in OpenBao KV** (verified: `bao kv list homelab/infrastructure` shows all 5). This PR swaps the manifests: | sops file (deleted) | ExternalSecret target (unchanged name) | KV key | |---|---|---| | external-dns-unifi/secret.sops.yaml | `external-dns-unifi-secret` (apps) | infrastructure/external-dns-unifi | | netbird-ingress/secret.sops.yaml | `netbird-ingress-setup-key` (ingress) | infrastructure/netbird-ingress | | velero/secret.sops.yaml | `cloud-credentials` (velero) | infrastructure/velero | | velero/hetzner-creds.sops.yaml | `cloud-credentials-hetzner` (velero) | infrastructure/velero-hetzner | | post-crds/cloudflare-secret.sops.yaml | `cloudflare-api-token` (cert-manager) | infrastructure/cloudflare | Also drops the now-dead `decryption` blocks from the `infrastructure` and `infrastructure-crds` Kustomizations (both paths sops-free) and ticks the doc checklist. On merge Flux prunes the old Secrets and ESO recreates them within seconds from OpenBao — same names, consumers unaffected. Rollback for any single file is a plain git revert while the age key lives. I'll verify all 5 ExternalSecrets go SecretSynced and spot-check velero backups + cert-manager after merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

claude-bot added 1 commit 2026-07-13 17:07:16 +00:00

feat(secrets): migrate infrastructure secrets to OpenBao (warm-up batch) 85cb236270

external-dns-unifi, netbird-ingress, velero (both), cloudflare-api-token:
values live in OpenBao KV (homelab/infrastructure/*, loaded 2026-07-13),
manifests become ExternalSecrets targeting the same Secret names so
consumers see no change. Both infra KS paths are now sops-free, so their
decryption blocks go too. Rollback per file = git revert (age key still
active until phase 4).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6

k.renner merged commit 871cbfd96d into master

2026-07-13 17:10:50 +00:00

k.renner referenced this issue from a commit

2026-07-13 17:10:50 +00:00

Merge pull request 'feat(secrets): warm-up migration — infrastructure secrets to OpenBao/ESO' (#171) from openbao-warmup into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#171