Repository navigation
Remove Crossview's Vault seed chain after its retirement #5391
Description
Objective
Remove Crossview's Vault seed chain and its stored credentials once the explicit retirement of the Crossview leftovers has run.
Details
#5384 removes Crossview from the platform but keeps its Vault seed chain declared on purpose. That chain is the password generators, the generated ExternalSecrets and the PushSecrets for apps/crossview/{db,app,admin}, plus the vault-config grants for that path. If an evicted merge-group deploy heals back to main while Crossview's database volume still exists, regenerating those credentials would lock the restored app out of its own database. Removing them is therefore safe only after the Retire Unused App Leftovers workflow has deleted the crossview namespace and its storage.
Checklist
- Confirm the
Retire Unused App Leftoversrun passed and thecrossviewnamespace and its volume are gone. - Remove the nine Crossview seed manifests and their
kustomization.yamlentries ink8s/bases/infrastructure/vault-seed/. - In
vault-config, drop the Crossview read policy and its seed-write grants, delete the retired policy, and destroy the three Crossview KV entries with an idempotent step. - Remove the seed-chain exemption from
scripts/retire-unused-apps.shand its test, or retire that script and workflow if nothing else is left. - Rename the
crossview/infrastructure-as-code-groupHomepage policy fixture (tests/restrict-homepage-service-groups), deferred from fix(platform): retire the unused Crossview, Headlamp and Backstage remains #5384 to avoid a merge-queue conflict with feat(homepage): reorganise the dashboard groups #5383. - After deployment, confirm the
vault-configJob succeeded and the policy and KV entries are gone, without printing any secret value.
Part of #2496
🤖 Generated with Claude Code
Activity
fix(retirement): keep Crossview's Vault seed chain until after retire…
test(homepage): leave the declared-group fixture to #5383
fix(vault): fail the Job when a retired Crossview credential cannot b…
devantler commentedon Oct 28, 2026
Verified in production after #5423 merged (
6206299), read-only:sha256:d218aa17…. All six Flux layers areReady=True(ReconciliationSucceeded) at that artifact.ExternalSecret,PushSecretorPasswordgenerator named after Crossview remains. Each list was non-empty (47, 25 and 16 objects), so the zero is a real read rather than an empty answer.openbao/vault-configJob ran from 00:14:57Z to 00:16:03Z and completed. It runs underset -e, sobao policy delete app-crossview-readonlyand the threebao kv metadata deletecalls forapps/crossview/{db,app,admin}all succeeded. A failure would have failed the Job, failed theinfrastructurehealth check (wait: true) and healed back to main.ttlSecondsAfterFinished: 600had already removed the Job and its log, so this proof rests on the completed status and the events, not on log lines.🤖 Generated with Claude Code