feat(obsbucket): retire the dormant handoff; its Application was not dormant #103
Loading…
Reference in a new issue
No description provided.
Delete branch "sean/retire-obsbucket"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
ArgoCD Application/obsbucket was live and Synced to this repository, owning five objects in namespace minio with prune and selfHeal on, and went Degraded when the MinIO tenant was deleted. It had no git owner. It was retired with the ArgoCD resources-finalizer so the deletion cascaded, including a MinioPolicy whose finalizer the resource-operator cleared; nothing consumed any of the five, checked first. This removes the slice, the contract nothing applied, the handoff doc, the guard and its check.sh line, and the two README sentences it pinned. A Synced Application targeting ns minio would block that namespace's deletion, which is the next migration step. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76
`handoff/obsbucket` was a byte-identical copy of the Pipelines `obsbucket` source, kept for a handoff that never happened, and the README said the live app-of-apps did not read it "so this preparation cannot create a second live owner". That was not true. ArgoCD `Application/obsbucket` was live and **Synced to this repository's `main`**, path `handoff/obsbucket`, destination namespace `minio`, with `automated: {prune: true, selfHeal: true}`. It owned five objects in that namespace: a ClusterSecretStore, two ExternalSecrets, a Password generator, and a `MinioPolicy` CR. The Application had no ownerReferences, no Flux label, and only the argocd controllers in managedFields -- an imperative leftover, almost certainly from the app-of-apps that the Pipelines retirement removed, still pointing here. It surfaced when the MinIO tenant was deleted on 2026-09-10 and the Application went Degraded: its ExternalSecrets read a SecretStore that was pruned with the tenant. A Synced Application targeting namespace `minio` also blocks that namespace's deletion, which is the next step of the migration -- ArgoCD wins a fight with a `kubectl delete ns`. The Application was retired first, with the ArgoCD resources-finalizer so the deletion cascaded: all five objects went, including the `MinioPolicy`, whose `minio.sean.farm/finalizer` the resource-operator cleared while it is still healthy. Nothing consumed any of them -- zero ExternalSecrets referenced the store, no pod mounted either Secret, both were checked before the delete. Deleting it imperatively is symmetric: nothing in any repository applied it, so nothing brings it back, and this commit removes the only description of it that remained. Going with it: the seven-file slice, the Application contract nothing applied, the handoff document, the contract guard and its line in tests/check.sh, and the two README sentences that guard pinned -- including the warning about keeping `minio-olly-platform-secret-key`'s object identity, which protected a key for a MinIO user that no longer exists. Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA761430fcb2714ca6b4e16b