From 070e6d8099fb072528d1c64e085fbe72f2a5dcf3 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sun, 12 Apr 2026 15:05:47 -0500 Subject: [PATCH] Drop secret.yaml from kustomization to unblock Flux reconciliation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After the BFG scrub, k8s/secret.yaml is git-ignored (contains plaintext credentials) but kustomization.yaml still listed it as a resource. Flux has been failing to kustomize-build the prop-app for six days, so no deployment since main-1776019122-8d1d7e4 has actually reached prod — the beacons crash fix, UTC clock fix, ASOS nudging, MRMS, contact detail async hydration, and email config change were all stuck. The `prop-secrets` Secret is applied out-of-band with kubectl and lives independently in the cluster; Flux no longer needs to track it. --- k8s/kustomization.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml index 19b3c375..c98327c6 100644 --- a/k8s/kustomization.yaml +++ b/k8s/kustomization.yaml @@ -1,8 +1,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +# secret.yaml is applied out-of-band and is git-ignored (contains plaintext +# credentials). Flux reconciles deployment.yaml etc. but does NOT manage the +# secret. Rotate secrets by applying secret.yaml with kubectl directly. resources: - namespace.yaml - - secret.yaml - rbac.yaml - deployment.yaml - service.yaml