Pins a single sealing key (--key-renew-period=0). Upstream rotates every 30d and
kubeseal seals with the newest key, which would silently invalidate the off-cluster
key backup for secrets sealed after a rotation. Includes DR runbook.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Converts cloudflare-api-token, argocd repo creds, nightscout, and the three
solitaire secrets to SealedSecrets (adopted in place; values verified unchanged
by before/after data hash). Controller-generated secrets (cert-manager webhook CA,
LE account key, argocd internals) intentionally left alone.
Verified post-seal: argocd repository label and dockerconfigjson type preserved,
letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Secrets are now committed encrypted (sealed-secrets v0.38.4) instead of
hand-applied out-of-band, closing the config-DR gap the backups intentionally
don't cover. Existing Secret adopted via the managed annotation (values verified
unchanged). Controller private key backed up GPG-encrypted off-cluster.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Alex