fix(vault-seed): cache generated secrets in K8s Secrets and push from the cache

[devantler]

🤖 Generated by the Daily AI Assistant

Root cause

The generated secrets (dex / flux-web client secrets, oauth2-proxy cookie secret, fleetdm bootstrap passwords, umami app/admin/tenant passwords) were pushed straight from ESO Password generators. A generatorRef-selector PushSecret produces a new random value on every sync, so they had to be push-once (refreshInterval: "0") — which made OpenBao the only place the values existed. When the 2026-06-10 incident re-initialized the vault with an empty KV store (context in #1979/#1980), they were unrecoverable, and every consumer ExternalSecret (vault-config-oidc, headlamp-oidc, actual-budget-oidc, umami-admin, …) wedged in SecretSyncedError with no self-healing path.

Fix

Each generated secret becomes two steps (the proven push-umami-db-superuser pattern):

1. a generated-* ExternalSecret runs the Password generator exactly once (refreshInterval: "0") and persists the value in a durable cache Secret in the openbao namespace
2. the existing PushSecret mirrors that cache Secret into OpenBao hourly (refreshInterval: 1h, selector switched from generatorRef to the cache Secret)

Healthy vault → hourly push is a no-op; values never rotate. Wiped vault → KV re-seeds within the hour from the cache.

⚠️ One-time effect on the current incident

Because the old generated values died with the wiped vault, the caches will generate fresh values on first reconcile. All consumers converge automatically via their ExternalSecrets (SSO clients, cookie secret → existing sessions reset; fleetdm has no pods yet, harmless), except:

• umami admin password: umami stores the hash in its DB, and the provision job can only rotate from the default umami password. After this merges, the admin password must be updated once in the umami UI (log in with the old value from the current umami/umami-admin Secret, set it to the new value from openbao/generated-umami-admin-password). The provision-tenants CronJob then goes green again.

Validation

• kubectl kustomize local + prod ✅
• ksail workload validate → 314 files validated ✅
• kubectl apply --dry-run=client on the changed file against live CRDs ✅

🤖 Generated with Claude Code

[devantler]

🤖 Generated by the Daily AI Assistant

ℹ️ The 🧪 System Test failure here is pre-existing on main, not caused by this PR: every CI run since ~18:30 UTC today fails identically (including the unrelated Renovate PRs #1971/#1972/#1974). The test cluster's openbao-active Service ends up with zero endpoints, so the whole vault seeding chain times out (connect: no route to host). Diagnostics to pin the root cause are being gathered in #1986.

[botantler]

🎉 This PR is included in version 1.47.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀