coilyco-flight-deck/infrastructure

Watch

reconcile: retire or replace stale /github/pat ExternalSecrets #589

New issue

Closed

opened 2026-07-23 04:35:46 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-23 04:35:46 +00:00

Owner

Problem

The SSM parameter /github/pat does not exist, but three ExternalSecrets still reference it:

external-secrets/github-pat
default/docker-registry
coilysiren-eco-mcp-app/docker-registry

All three remain Ready=False with SecretSyncedError. The cluster first recorded this drift in #308, but that issue combines several unrelated node faults.

Scope

Identify whether each consumer is still live.
Delete stale ExternalSecrets for retired consumers.
Point live consumers at the current supported registry or GitHub credential source.
Do not recreate a broad personal access token unless a current workload proves it needs one.

Acceptance

Each of the three ExternalSecrets is either removed as retired or reports Ready=True.
No live workload depends on a missing /github/pat parameter.
The supported credential source and rotation owner are documented.

## Problem The SSM parameter `/github/pat` does not exist, but three ExternalSecrets still reference it: * `external-secrets/github-pat` * `default/docker-registry` * `coilysiren-eco-mcp-app/docker-registry` All three remain `Ready=False` with `SecretSyncedError`. The cluster first recorded this drift in #308, but that issue combines several unrelated node faults. ## Scope * Identify whether each consumer is still live. * Delete stale ExternalSecrets for retired consumers. * Point live consumers at the current supported registry or GitHub credential source. * Do not recreate a broad personal access token unless a current workload proves it needs one. ## Acceptance * Each of the three ExternalSecrets is either removed as retired or reports `Ready=True`. * No live workload depends on a missing `/github/pat` parameter. * The supported credential source and rotation owner are documented.

coilyco-ops referenced this issue

2026-07-23 04:36:22 +00:00

kai-server unhealthy: forgejo bounce, runner crashloop, missing /github/pat, signoz/metrics 500s #308

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:46:27 +00:00

coilyco-ops referenced this issue

2026-08-25 06:15:51 +00:00

Nine ExternalSecrets are permanently failing against deleted SSM keys #766

coilyco-ops referenced this issue

2026-08-25 06:15:57 +00:00

Untracked ExternalSecrets in the default namespace retry a missing SSM key every hour, forever #809

coilyco-ops commented

2026-08-25 06:16:01 +00:00

Author

Owner

Resolved. All three consumers are gone, and so is the parameter they referenced.

external-secrets/github-pat                NotFound
default/docker-registry                    NotFound
coilysiren-eco-mcp-app/docker-registry     namespace NotFound
/github/pat in SSM                         does not exist

Cluster-wide, all 100 ExternalSecrets report SecretSynced True, so nothing is left retrying against a missing key. Related and closed alongside: #766, #809. Closing.

Resolved. All three consumers are gone, and so is the parameter they referenced. ``` external-secrets/github-pat NotFound default/docker-registry NotFound coilysiren-eco-mcp-app/docker-registry namespace NotFound /github/pat in SSM does not exist ``` Cluster-wide, all 100 ExternalSecrets report `SecretSynced True`, so nothing is left retrying against a missing key. Related and closed alongside: #766, #809. Closing.

coilyco-ops closed this issue

2026-08-25 06:16:02 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#589

No description provided.

Rows
Columns