viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

eso: Phase 2 — migrate all 104 ExternalSecrets + 2 ClusterSecretStores to v1
Some checks failed
ci/woodpecker/push/default Pipeline failed
Details

Browse source 
The API rewrite half of the ESO 0.12->2.6 migration (last k8s-1.35 compat-gate
blocker). Done on chart 0.16.2, which serves BOTH external-secrets.io/v1beta1
and v1, so this is the safe window — MUST land before 0.17 removes v1beta1
(there is no conversion webhook). Pure apiVersion bump, schema is byte-identical:
106 occurrences (104 ExternalSecrets + 2 ClusterSecretStores vault-kv/vault-database)
across 73 .tf files, v1beta1 -> v1, no other field changes.

Validated live first on tandoor (single, non-coupled, synced ES): the
kubernetes_manifest apiVersion bump forces a REPLACE; the target Secret is
cascade-GC'd for ONE ~0.3s poll then ESO recreates it (identical value re-synced
from Vault, new UID) and the ES returns SecretSynced=True on v1. Running pods
keep their mounted copy through the sub-second blip. All 110 target Secrets were
snapshotted to /tmp first as a backstop.

CI applies the changed stacks serially (staged rollout); watching aggregate ES
sync back to 108 synced (2 pre-existing dead: instagram-poster, payslip-ingest).
Next: Phase 3 climb 0.16.2 -> 2.6.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-06-22 19:13:04 +00:00
parent 98cd535b97
commit c670cb7118
73 changed files with 106 additions and 106 deletions
Download patch file Download diff file Expand all files Collapse all files

10
stacks/fire-planner/main.tf
View file

@ -54,7 +54,7 @@ resource "kubernetes_namespace" "fire_planner" {
# secret/fire-planner -> property `recompute_bearer_token`
resource "kubernetes_manifest" "external_secret" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
apiVersion = "external-secrets.io/v1"
kind = "ExternalSecret"
metadata = {
name = "fire-planner-secrets"
@ -116,7 +116,7 @@ resource "kubernetes_manifest" "external_secret" {
# as DB_CONNECTION_STRING.
resource "kubernetes_manifest" "db_external_secret" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
apiVersion = "external-secrets.io/v1"
kind = "ExternalSecret"
metadata = {
name = "fire-planner-db-creds"
@ -160,7 +160,7 @@ resource "kubernetes_manifest" "db_external_secret" {
# fire-planner ingest reads those tables via this role.
resource "kubernetes_manifest" "wealthfolio_sync_db_external_secret" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
apiVersion = "external-secrets.io/v1"
kind = "ExternalSecret"
metadata = {
name = "wealthfolio-sync-db-creds"
@ -662,7 +662,7 @@ variable "run_examples_bulk_ingest" {
# Reddit OAuth creds pulled from Vault secret/viktor.
resource "kubernetes_manifest" "external_secret_examples_reddit" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
apiVersion = "external-secrets.io/v1"
kind = "ExternalSecret"
metadata = {
name = "fire-planner-examples-reddit"
@ -702,7 +702,7 @@ resource "kubernetes_manifest" "external_secret_examples_reddit" {
# is decoupled from the Reddit creds.
resource "kubernetes_manifest" "external_secret_examples_claude" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
apiVersion = "external-secrets.io/v1"
kind = "ExternalSecret"
metadata = {
name = "fire-planner-examples-claude"