DevFW-CICD/stacks
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(secrets-backup): 🔥 remove client-side openssl encryption
Some checks failed
Build secrets-backup image / build-and-push (push) Failing after 3s
Details

Browse source 
OBS bucket has server-side KMS encryption. Client-side openssl was
redundant and caused failures (Alpine CDN unreachable at 03:30 UTC).

Changes:
- Dockerfile: remove openssl apk install (no longer needed)
- CronJob: remove openssl enc step, upload .tar.gz directly
- CronJob: remove secrets-backup-config Secret (encryption passphrase)
- CronJob: remove ENCRYPTION_PASSPHRASE env var
- Bump image tag to 1.0.1, update workflow and manifest reference

Flow: kubectl export → tar.gz → upload to OBS (SSE-KMS handles rest)

Ref: IPCEICIS-9317
This commit is contained in:
Daniel Sy 2026-06-12 13:01:24 +02:00
parent 6b29aa3916
commit 81b721bb5a
Signed by untrusted user: danielsy
GPG key ID: 1F39A8BBCD2EE3D3
3 changed files with 43 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

3
build/secrets-backup/Dockerfile Normal file
View file

@ -0,0 +1,3 @@
FROM alpine/k8s:1.32.0
# No extra packages needed — kubectl and aws CLI are bundled in alpine/k8s
# OBS SSE-KMS handles encryption at rest; no openssl required