From 7206022a2b99a15840f9ca22838e0f01d90e2f26 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Mon, 17 Aug 2026 21:12:37 -0500 Subject: [PATCH] Pin VPS MinIO root credentials to a real Secret, fix regeneration bug rootUser/rootPassword were left unset, relying on the chart's auto-generation - but ArgoCD renders Helm via 'helm template', which doesn't support the lookup() function charts use to preserve an existing generated secret across upgrades. With selfHeal: true, every single sync generated a BRAND NEW random root password, immediately invalidating whatever credentials were stored in the home cluster's Vault for the backup/CronJob consumers (vault-raft-snapshot, 3x CNPG barmanObjectStore, nextcloud-pvc-sync) - confirmed live: all of them failing with 'Access Key Id does not exist' right after being fixed, because the password had already rotated out from under them again. Fixed by pointing at a pre-existing Secret created directly on the VPS cluster (kubectl, not git - this cluster has no Vault/ESO of its own). Co-Authored-By: Claude Sonnet 5 --- infrastructure/vps-standby/minio/values.yaml | 26 +++++++++++++++----- 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/infrastructure/vps-standby/minio/values.yaml b/infrastructure/vps-standby/minio/values.yaml index d080769..159e06d 100644 --- a/infrastructure/vps-standby/minio/values.yaml +++ b/infrastructure/vps-standby/minio/values.yaml @@ -2,14 +2,28 @@ # Standalone mode: single node, single VPS disk, no erasure coding needed here - # this is a backup *copy*, not itself something requiring HA. # -# rootUser/rootPassword are intentionally left unset: the chart auto-generates -# a random root password and stores it in a Secret (minio/minio chart default -# behavior) rather than committing credentials to git. Retrieve after first -# deploy with: -# kubectl --context vps-standby -n minio get secret minio -o jsonpath='{.data.rootPassword}' | base64 -d - +# Root credentials come from a pre-existing Secret created manually on the +# VPS cluster (kubectl, not git - matches how other VPS bootstrap secrets +# are handled, since this cluster has no Vault/ESO of its own to source an +# ExternalSecret from): +# kubectl -n minio create secret generic vps-minio-root-secret \ +# --from-literal=rootUser= --from-literal=rootPassword= +# +# Originally left rootUser/rootPassword unset entirely, relying on the +# chart's auto-generation - broke in a way that took a while to trace: +# ArgoCD renders Helm charts via `helm template`, which does NOT support +# the `lookup` function charts normally use to preserve an existing +# auto-generated secret across upgrades (that only works with real `helm +# upgrade`). Every ArgoCD sync (selfHeal: true, so this means constantly) +# re-rendered a BRAND NEW random root password, immediately invalidating +# whatever credentials were stored in the home cluster's Vault for the +# backup/CronJob consumers (vault-raft-snapshot, CNPG barmanObjectStore +# x3, nextcloud-pvc-sync) - confirmed live 2026-08-18, all of them failing +# with "Access Key Id does not exist" despite having just been fixed. mode: standalone +existingSecret: vps-minio-root-secret + persistence: enabled: true storageClass: local-path