gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-20 23:16:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Pin VPS MinIO root credentials to a real Secret, fix regeneration bug

Browse Source 
rootUser/rootPassword were left unset, relying on the chart's
auto-generation - but ArgoCD renders Helm via 'helm template', which
doesn't support the lookup() function charts use to preserve an existing
generated secret across upgrades. With selfHeal: true, every single sync
generated a BRAND NEW random root password, immediately invalidating
whatever credentials were stored in the home cluster's Vault for the
backup/CronJob consumers (vault-raft-snapshot, 3x CNPG barmanObjectStore,
nextcloud-pvc-sync) - confirmed live: all of them failing with 'Access
Key Id does not exist' right after being fixed, because the password had
already rotated out from under them again.

Fixed by pointing at a pre-existing Secret created directly on the VPS
cluster (kubectl, not git - this cluster has no Vault/ESO of its own).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-17 21:12:37 -05:00
co-authored by Claude Sonnet 5
parent 7d73542645
commit 7206022a2b
1 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/vps-standby/minio/values.yaml
+20 -6
View File
@@ -2,14 +2,28 @@
# Standalone mode: single node, single VPS disk, no erasure coding needed here -
# this is a backup *copy*, not itself something requiring HA.
#
# rootUser/rootPassword are intentionally left unset: the chart auto-generates
# a random root password and stores it in a Secret (minio/minio chart default
# behavior) rather than committing credentials to git. Retrieve after first
# deploy with:
# kubectl --context vps-standby -n minio get secret minio -o jsonpath='{.data.rootPassword}' | base64 -d
# Root credentials come from a pre-existing Secret created manually on the
# VPS cluster (kubectl, not git - matches how other VPS bootstrap secrets
# are handled, since this cluster has no Vault/ESO of its own to source an
# ExternalSecret from):
# kubectl -n minio create secret generic vps-minio-root-secret \
# --from-literal=rootUser=<user> --from-literal=rootPassword=<password>
#
# Originally left rootUser/rootPassword unset entirely, relying on the
# chart's auto-generation - broke in a way that took a while to trace:
# ArgoCD renders Helm charts via `helm template`, which does NOT support
# the `lookup` function charts normally use to preserve an existing
# auto-generated secret across upgrades (that only works with real `helm
# upgrade`). Every ArgoCD sync (selfHeal: true, so this means constantly)
# re-rendered a BRAND NEW random root password, immediately invalidating
# whatever credentials were stored in the home cluster's Vault for the
# backup/CronJob consumers (vault-raft-snapshot, CNPG barmanObjectStore
# x3, nextcloud-pvc-sync) - confirmed live 2026-08-18, all of them failing
# with "Access Key Id does not exist" despite having just been fixed.
mode: standalone
existingSecret: vps-minio-root-secret
persistence:
enabled: true
storageClass: local-path