Alex
fb110d1c5b
Pins a single sealing key (--key-renew-period=0). Upstream rotates every 30d and kubeseal seals with the newest key, which would silently invalidate the off-cluster key backup for secrets sealed after a rotation. Includes DR runbook. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
sealed-secrets
Controller v0.38.4, applied directly (not via ArgoCD — matches how cert-manager is handled; ArgoCD apps here are workloads, not cluster infra):
kubectl apply -f apps/sealed-secrets/controller.yaml
controller.yaml is the upstream release manifest plus ONE local change:
--key-renew-period=0. Upstream defaults to rotating the sealing key every 30 days;
kubeseal always seals with the newest key, so a rotation would silently invalidate the
off-cluster key backup for anything sealed afterwards. Pinning to one key keeps the
backup permanently valid. Rotation buys little here — it never re-seals existing secrets.
Disaster recovery (order matters)
# 1. install controller
kubectl apply -f apps/sealed-secrets/controller.yaml
# 2. restore the private key BEFORE applying any SealedSecret,
# or a fresh key is generated and nothing decrypts
gpg -d /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg | kubectl apply -f -
kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
# 3. apply the SealedSecrets
kubectl apply -f apps/cluster-secrets/ # cert-manager, argocd, solitaire
# (apps/notesnook + apps/nightscout SealedSecrets come via ArgoCD)
Passphrase for the .gpg is in the password manager, and nowhere else.