From 8c7a905d39762140c6424c02eb2abb08a26e3fc2 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Tue, 6 Oct 2026 06:20:10 +0200 Subject: [PATCH] saggar(kube): weekly full syncs on the embedded garages Garage's hourly full-sync cycles were the InvalidAccessKeyId source: while a key-table sync runs, auth lookups transiently fail, and the edge job's prune step kept landing inside the window (one sync ran 87 minutes). Both embedded stores get a weekly interval. --- kubernetes/production/get-saggar/values.yaml | 40 +++++++++------- kubernetes/production/saggar/values.yaml | 48 +++++++++++--------- 2 files changed, 50 insertions(+), 38 deletions(-) diff --git a/kubernetes/production/get-saggar/values.yaml b/kubernetes/production/get-saggar/values.yaml index 3f4c91b..79060e1 100644 --- a/kubernetes/production/get-saggar/values.yaml +++ b/kubernetes/production/get-saggar/values.yaml @@ -6,6 +6,12 @@ # domain> — Garage resolves the bucket from the Host's first label — # so bucket `get` on get.saggar.dev. bucket: get +garage: + # Single-node store: skip the hourly self-sync cycles — while a + # full sync runs, S3 auth lookups transiently answer + # InvalidAccessKeyId, which is what kept failing the edge job's + # prune step. Weekly. + fullSyncInterval: 604800 web: ingress: className: traefik @@ -16,27 +22,27 @@ web: tls: enabled: false sops: - lastmodified: "2026-10-04T21:14:10Z" - mac: ENC[AES256_GCM,data:eiYi01TPIHeaCxGblY8k5RuBXacex96leJdmI0Ii3PI6GElJnmZ4elE8PYCBs+XsjwlixLQEEIEN7kTzf2mm2rmoa/2HXhgZW1xPGOW1k6Oh3T6b9fhIwHYVpFTcKikTJo5mcZHlIF8wjNf3AxysWLa94O5G11XVoZnquzoP2to=,iv:nn8jSbwgf75AuOQci2pB56dxB3QFUVdDrMLMqMUXD7U=,tag:jwAS38pKBYrD92KSFei4ew==,type:str] + lastmodified: "2026-10-06T04:20:10Z" + mac: ENC[AES256_GCM,data:ncXYOdUYTaYikkKWVUzWinakZVV7tjja31QIo/xhibZ8Jc9L/dl9U8//xJ95Hlb9uuMJvUHvk78KmH2mYVQhfhyNwkNZXvK3o3azx+WWQYaZebEudRbXdHO6gyywcoywlEFuaVWjVsTpggz2VtlNwP/tqLCf41uTUJB4NZi12uU=,iv:uj13/y/iGeoyqgnx74wh1Pzb01NupeLW55qBhCBNleM=,tag:PGmmMZCw49wt8RmpJH1CzQ==,type:str] pgp: - - created_at: "2026-10-04T21:14:10Z" + - created_at: "2026-10-06T04:20:10Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ//aSdSsLiq0QPPhi7RxG87wsS4Q6yTW4htlkCBfAIJR+ky - rNXO5ADj3Hhl3n9R90Cci0Txc2XJE7w3hWs/P70Q4Fu8LLDHEN/jvCUIn7ARywhQ - NZUezluFFTeZVitwpiK+lSws7Nzy4eduPd3VDx02W9Ej2IXa9e41vWb7JMODBzSz - p5wntTjPZJfcrscijPM5Q1rvv6SWtp4b5DZJzDTZWAYVuPhgW/JF0HZhh+EXcKSv - Ea0UDXCXE+Qy3NUlFGNVKk+vXhzAUp+qrRi0Eno0uTfZ+9xNRdqARusdwLCO/uqm - wwEZn+TiRt/Uc+qcXSjWUcgOHckLk1sXCLTh0TA3DrCWdEfMp+eMDXaA1eN6V2XU - tSCK6Tx3eDvWKmm23CHPRgQB4cookcHbiPScjZicjp3w2iTQ6GZ7LsgDNE0IsdHg - Ha1Cl2QNfxhHWPNPFFRedcLbAjj94CNLMRfBctf+sB7PZydeTUFGYKwTScFBsL0k - 8ll5qhEl/6qFWGOVrynF2dccYBXYSK6fs2A8pwBVqNvh7mtejd7D2/S2Mpc/lLCq - VNdUlkAKpsCMyzIVqlgJ0TB1SdwR02jKBgOr9XOvA8tCb835On/tHlelz9uOq040 - OrQlLmiJwom2J7lP6WzJE28t3uVALZo4tIiiNivOFpdh91LLC3GAUVGaH3uT3ufS - XgFFkDQToe1sS4pv/RdbjHEB1tSHqIgsKuTTnlsxwYF7ZzxwfxETwVlU1yMaEIIH - enA5z0XVyRwoLqT36U54SZo0Rq0SHs6W0w6qr+sIDmoMP9Cxw0a5jJ1P0zb2PbM= - =uIr+ + hQIMA7uy4qQr71wiAQ/+MH/izXRcAzwF1Dp5mgQBthTFYX01sUpjU9y5Z9jeRnny + UgtCuURwaI41nG+ZOrv3yy2dSsgABMgr8nZZEju/Tb+jZ/qzkPR8JWTpiieXefH4 + Q5lEy6l1rLVOJudsgx7BG07h6gqr0Mu89gcpFThkXiCo5eAV/hlY9Y6eG6ZybWZ/ + K2bUv8JB09S8ZsuFsTqp87lZMogWFcIjO8JMirjWRxgd+1NZFoGmSIb+6KkLTD2+ + eMjbLnGZ3HyWLSzJBRkF5bGgODNGA8qaHmKKMTT8/H9zD1Z++nKCrx7SQpoStQxw + xluXAyefTiwCqhEVT42C68Lhz5pH6AyHgJGmls/NWv6bvj/3AQwXlkO87Xkd8x3L + aEDHIc5rEso18IZuNzlI193AEhipT8mcMi8IFA4YbnVnkK86PSXQ7qWrbbc4BmkN + cU/vUlpBM1HeiYdTFZf8Dvfw55bNn/pMhPhoLWpHjAnAEDJdrVh33OTurdmtYTRW + nRK3q2WVHa+UGlkKfdpKr1ivZ9O4ulSfyIYKVsLI5sYAbkJ4o6ytlcQlK6E/7AEK + Ux/KAnTb5nXOLN8Vbq0xGlyjYei0GY+IZWkkWL80k59NFfrDLXtG/zCxE74ANplm + qx+dCbggjT2lNsM+homldhYU0VhDnvrWM1/9bRI3DUVUxfGUCKMTqUj2b97vLGDS + XgHGOTHKKTQjpEg7DnnSS/romTxglHrAEa/3Cu4S4uUVIK7aL8JIoHXYaHho6Jp1 + 9RpCscjyeMfE/wnyTbeR1OZ6wnIMuLXzVzma0fy0fbYqGhJllULpMgsZGe6bhpI= + =MIya -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ diff --git a/kubernetes/production/saggar/values.yaml b/kubernetes/production/saggar/values.yaml index a0be9de..7cd898e 100644 --- a/kubernetes/production/saggar/values.yaml +++ b/kubernetes/production/saggar/values.yaml @@ -13,8 +13,8 @@ image: imageCredentials: create: true registry: git.vhaudiquet.fr - username: ENC[AES256_GCM,data:QijNVgCz8hF0Kg==,iv:eredumkfDLZ6AKM8nCcZwl14EyRRnBvXLL52Yaau0d0=,tag:P/miR7dyjGaMxqM/g7r0ow==,type:str] - password: ENC[AES256_GCM,data:SY3i9j6rBFh5RfehxBQX+ljVe11cGL1cRNkiFqcNbBlNkF9uqMC9hQ==,iv:qpHKDwzQDr8uTJN9e7OgUr/JN2O+EGJylbH/R+EU9tc=,tag:2DbOvUUTsrNfhIzhjirz/Q==,type:str] + username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str] + password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str] # Login via the home Gitea: the engine is the confidential client of # the provider and runs every code exchange, so its discovery drives # the endpoints (issuer verified live). Credentials live in @@ -29,9 +29,15 @@ auth: providers: - name: gitea issuer: https://git.vhaudiquet.fr - existingSecret: ENC[AES256_GCM,data:lvGugwt7hGbPGF9JSn88B1c=,iv:1Zqze/jXv8kuVNdGdJB9PwvMFHWBihIsEX9jJo7DQvg=,tag:gSgFdyI7HfAj8dwoGd2kbg==,type:str] + existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str] clientIdKey: client-id - clientSecretKey: ENC[AES256_GCM,data:6vvWWtiomj1TpNJ41g==,iv:xb9HfW2MQNs9vLmPxujUV8us8Tce08L3si1Qd/CCwWk=,tag:LQdV0f79n9NqKBOrh6DDTg==,type:str] + clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str] +storage: + garage: + # Single-node store: skip the hourly self-sync cycles — while a + # full sync runs, S3 auth lookups transiently answer + # InvalidAccessKeyId. Weekly. + fullSyncInterval: 604800 ingress: enabled: true className: traefik @@ -71,27 +77,27 @@ docs: tls: enabled: false sops: - lastmodified: "2026-10-01T17:39:26Z" - mac: ENC[AES256_GCM,data:1pn1rHaCx8eYYR6NPt6hgUEwDxRYQQtgkklSu6FroH92gUq2jhX3420lzboTMvvpuBF/vqjbuw1sIR60YfZZ8R5ahw7CCcv8L5sfz9DhUU/vMBYF6r3HDY70AnXkPK3+rPw6ZofB8h+Y/DQEBpPe/LeDEPCOGQjIml349yAvMIk=,iv:A6/PeL8JuFtzS0hMAiP2/dvbXq7Ob3o9VaA0pE2IWEU=,tag:GV2pspKqmaQjafkp4HUwSw==,type:str] + lastmodified: "2026-10-06T04:20:10Z" + mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str] pgp: - - created_at: "2026-10-01T17:39:26Z" + - created_at: "2026-10-06T04:20:10Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ/+PFcuCPKb5Mpej7uym38cwwVgjaJoaeLrKpfWBw4CEy3v - PbJgTS7kNKyjHqoeHQcLZZwmms1//b7XQfX2kPnNJIo/06cAgYv5AJ4etMNJ3hys - ShuiTMmMayKg2U8TdMhzwKFgymhQ5PUzGU1Xg2D9J1hUgW/rRVOb5wHKsBgYkOIx - ufuQpPhNm9j1xOqWtnf6xCRbZ1HRlE6mAX+4TvRJk/x3U1YW1gI2neyEtFiuCsCj - PSO9W+5WovDLQlCmGRmCweUwODShpdVqBEoXSS3wjGihz9xKH3lS+NnPZVMoeurE - kzHjTxQgv4ZLDo9OuXcZz5mlXju9tmvkpLpqP1oHnN+es6Ks0jIpZcvXaZvvF4W5 - CLsC9dDplvAA3IpiF6+vpdDL0/QHpxo61V4jLLqO6o84x2jD1odR+zSkmxUxaQ94 - hxlPY+DGTrvHV0qOWlWLLZO6ddwOqeUC6ntBiZu3FG3UwTwPv9YXvi+ApP4Lylov - BNKaCxKLalD37BKcPrpaJBwucME56Ny9p0WbHUaBNv74UGIKqPl6BI+9z7oObsrT - YfmcB0Wlpz8N6SHntYJDhLJktJ27csy6BTPjQsFEK/dHbGyR5X4CiBSehqGd400s - bomyLdR7m3g4fFG7Qq9Wzh8MA2WC6Fx+ExUXz91xrsejEJhckUl9N0sQDdCO3trS - UQFWjDQEh9LAJ3U/nQ0SWjaNnJ25U0qJ9qMZYyDDR2aiMqRAwcOZc315S+S/FrGE - lMkMngLiKqznm9GSsgcBgRIcqovbJr1gCJS/b2+4abjQtw== - =gAn1 + hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK + 3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer + z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn + 9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF + 9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH + h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0 + 4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg + HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf + Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR + NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD + ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS + XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns + MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk= + =3vCq -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$