longhorn default backup target

clusters/base/infra/longhorn/longhorn-system/backuptarget.yaml

@@ -0,0 +1,13 @@
+apiVersion: longhorn.io/v1beta2
+kind: BackupTarget
+metadata:
+  name: default
+  namespace: longhorn-system
+spec:
+  # this CR (not defaultSettings.backupTarget in helmrelease.yaml) is what
+  # Longhorn actually reads - it pre-existed this repo's management,
+  # pointing at a long-dead minio host. defaultSettings only seeds it on
+  # a truly fresh install, so it never overwrote the stale live object.
+  backupTargetURL: "s3://longhorn-backups@us-east-1/"
+  credentialSecret: longhorn-backup-target-secret
+  pollInterval: 5m0s

clusters/base/infra/longhorn/longhorn-system/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - secret.enc.yaml
   - helmrelease.yaml
   - ingress.yaml
+  - backuptarget.yaml

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: longhorn-backup-target-secret
     namespace: longhorn-system
 stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:vli6H1YZQviV4ygwEKOhUltZ+5o=,iv:P6xcqbIVME4xMEOiWtXGm1z6S8ceF+uoTHDI6sqG1y8=,tag:IAnsJBEndhf6AVhXN6E1Vg==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:8UXxo+WALaBj1TCC8YfAyq/sJhShIKkfEtI0wHGTuyt1aMdMdqXQRw==,iv:9Gqy3LnX988o+eMwhMxvWw+u9yZ1QDh7pPMX0qs6yL4=,tag:VTWbe2A5vRu5bLeQt2KE6Q==,type:str]
-    AWS_ENDPOINTS: ENC[AES256_GCM,data:Co4mTd6AY+woOmd71Uo/6wmniWIG6Wa6q54UL6XLIsto/6Z79N+gKvV5AaaQ5mXdWi78zaJYJT7lbi2AOg==,iv:DaDMi/CUBcRyoBiau03PXBzdoO4UVV05puhKvHibDFg=,tag:WSMC+QDIn2rFj9lcVc5uLQ==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:yDQ9Q3jZ6HaB0azDQUE+kZR7Few=,iv:SgVc9x1GBKQKUdIcjvS6kpu2Q7ixLLoDuFw0EofqJe0=,tag:RKRMen5I2Mi0DwvRszek0g==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:WZb0BjR4oAZ9YYUpYDb46eBOvw9bW7bJpTxJWuipqOYKFSR/oQKAdA==,iv:nFmLxVMkGYA/dyCbIBoNISFaCJj2HPlqU2pghRmJHW0=,tag:hamnF4hkAl189/RkSzhFPw==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:c6p9p5map9jKxt8oxKipt1akQH+82gMA2AkD5QDUB5X5kJV6uixBoxxRPTR1dXvrxhP4CgPCoQEycnlyoA==,iv:iVmXDW9V9rPihY0skBPOs2xtsxDk946cyNeaNkoncIg=,tag:Qink/DPtOrfMDT0XscYmVQ==,type:str]
 sops:
     age:
         - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbW1GRUJad1B1cUJtZXp1
-            TGxsaytYMW9hcE1hR1BlcnVoTjIrdWQ2YmdNCkhuemIwd3hsL1UrWGxRaFo1NHRQ
-            ZVBzR2pFeUlYQ0dTN3E3RG5taitXWGsKLS0tIFNIRDJhZUpwYjV6UXpDcmZUS09n
-            VzhUZkQ1KzdTUnlLRlp6TzJWb2lGdjQK34QBtclIRUTO4dyNHFmPJ0EO9a4fLuXm
-            jQ7DOac/g5S3wByq3xmV65PwalJum1Mty4i+HqphvDsGupyNY6xX+Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4dExVem9aaWQxS0NCL1dp
+            M3FETmIzUkRCWmlNblpRdmdBVDZiU3RnajNvCk1SK3V2ai9BLzJaTVk3Q0RURkZQ
+            dlZqUEVxWGRNbkkvSW9PRnFnTlRSWHcKLS0tIGtZWHpROHgvR24va0s1NjNlcjQ0
+            SkZxQldIZDRycGpQRHIreEN3VW1FTE0KlB8vKXkR/LJ8Y9qG39+QgfRyMNXRTRa0
+            mwRY8VHXA7CE1dNXg0hWc2r2iX7TJT+fgRNnHh/rZa8EeyanIjnIUw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:50Z"
-    mac: ENC[AES256_GCM,data:6Kn5AD4MuU6+JhtYyOXsEKzmFKRxfMAA83LChO0MeZbhGwI/J7EBeSYMYtZMetua9pmjvZakBQoPlE6Hdjq5cwBG8K3v7K54ZDKb/NK6dfEZMY2hZ5GMe+4NWNDLWPRphu6V7wLNwvhZNrh/J9+LDpnIVdMls2WPzhncmI/pENg=,iv:OLYZWQ0Dl28tUCHkt9XInP67OajX3IaqsGpmE5XNpGQ=,tag:XQzBoYNKZC7yRdhOUUoIqA==,type:str]
+    lastmodified: "2026-08-26T10:24:59Z"
+    mac: ENC[AES256_GCM,data:1A4nTc0wsplfhgeMPzrExp7sX0Z9jc9z1yBJgUiOpxlGKm3Pc7+wMjNcm444pNj0xhVDqoHFg1KJ/gkDANIODT9Sl45amdNJqIs5LT9OkSFefMmmteWfqjTrmAim36W3l3/NkDwvpiDtFG4AcYNsKegRExhU9cJImq//Lujv5as=,iv:D039dx9pmBZvRwzIQV9+KxehTT6jkaSAp0DS2QF2kF8=,tag:a2tS1+/SYb/QUKxoQGAZqw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -4,24 +4,24 @@ metadata:
     name: s3-backup-proxy-secrets
     namespace: longhorn-system
 stringData:
-    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:g09zyM0cods6snZEw89RPFo5nHU=,iv:Ay6LYQEMbh0L80W3nMUyrlrow4HEfz2V0pjLZmO61Xk=,tag:5S7V9nT/Os+yKqmRqdd8RQ==,type:str]
-    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:hRla0zAYSET9pnVFFMCixIjzPx9V+SSaFmjbRgR0+XgrJZ2/syFO+w==,iv:3EAloXiOzqAkttdrctRQu6GP8mtJK9+CwbrWnoew+Ms=,tag:xBnbE+e3W/Bg5Cq7eAytbg==,type:str]
-    CRYPT_PASSWORD: ENC[AES256_GCM,data:rcGyfY/Sc0stKopzjmt/jyj1lrc0u9A7eULMgd6100ZGp0RxizHLx07lew==,iv:Pyhof8NB42fVZKfp4E5X5s1lV9VN4dxWAk7/YQn8zus=,tag:koAdJNPr9Cdqd7+oPfz2Mw==,type:str]
-    CRYPT_PASSWORD2: ENC[AES256_GCM,data:8zGR2BE4S0iZcecdnLfNFZWRFFV8QITEJX3zmNDWmxwM58nsLft8AOWaZQ==,iv:9ceK5agzww4oLflAjrdrX6bdP+om4n2BSjZb4cyEVyo=,tag:qg4PIzK1/xLLSjrdJRMgGQ==,type:str]
-    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:7jn/yVlcSyr4Yg9G60ufzNI4e5Y=,iv:xvlOl6iG06qWL8YYbgqZ7GeY67MfCVGxBw9YFvmPGrg=,tag:qMJpRalU7nm1c5kKK32aUw==,type:str]
-    PROXY_SECRET_KEY: ENC[AES256_GCM,data:vpyIpvVUJAxmp2NNih9+fNLzybs+O1IJpQ2sxsh3tWRdDRQ0gAoF0A==,iv:/aRx91r1sAg2EavKUW/xlSMLe2RTRlPqpZcow2ZdFyk=,tag:afX7oB6jtOSZopobXXlNgQ==,type:str]
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:dJXspq3MBXkAxeT0DK4Vauc4rnY=,iv:xD+sLIIU6Pap5L6qqF5cKmy7qyz/8kt0ti5EeYEDSRg=,tag:VHJvwaEnZ46Atsm1AA2ljA==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:RysGKo8arL+dFLmCrVv8i+F/D+TRLYh+Zd7WdxsnFed0WND/dEADEQ==,iv:R7vcI949dzLveMiTNgZtBLMq65k0NFpjjnXGFeAhvxs=,tag:OkPDGIe0f4byKVX7+5XQyA==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:8VtJAYkMomOqnfT7U3I7IStQl7HeJN8xyd++6sd+Vn6htBFQACNx0fdgPw==,iv:Z/U8+lZl38Z1dMz6DfvvU1J/z7A1GS0P3VfWqGxEqNo=,tag:bxe7Sjtxlc5JsdDjHaCQ9A==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:2kDAw+aecLfuk3bUKvEiBNPS192F5YUwW9bu4PDMd+mITcJaI5KfCWHbjg==,iv:asC6pLZRfGI+MinA4u9HJVYN/nb3tpRqo1Ht3dESYtg=,tag:3WbSUFZy/sSvvtV577R0TQ==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:96w6AzDLiVzdE1YBS2p6pXvkcMY=,iv:+hdZtlRjDeaAm/CRTAAKqjYFe7eWDEIAEWQ7RUsY+sU=,tag:+ZtkMP0OeNlW+5RjEKW0tw==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:WXEgDBxWjHb8M1NTEvTxkNjxCrXAoJxoDhZLjZhtPUgFkNJqt+4pEA==,iv:9mEqNSQu3kIjF3wHzNbFKcaZxp/DqtlJTQD7U/95HnA=,tag:7d6H9iHU6bvT2OlthMRfPg==,type:str]
 sops:
     age:
         - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByRDhINUFWQmpqU3FZYjI4
-            aGt6RHgwZGhBczVnSDd4WUlKYUFZYWwzdGhZClhSeGZzN3FacUZLNytYMmlZbzZQ
-            NlJHRlFLYzhGeXVQSHhnd1JMVzM3Z2sKLS0tIGFWdGluVllpMDhQWVBNVGpCeTZu
-            OXZFeUI0S1RwQ1pOWkNwRkVjTkJBTk0KkJRTInD67EBbUIpeJqknygJJ5wI+uq59
-            EX64TjZ3rlCbwqwb9fhXMP2urPAfL4FZn5urGjA+E1cxsITezQoZAw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwamZmTEYvRnlsR3VrR1Q2
+            bnk1VlpHZDVSSGU3ZGNsVUV1QTEwS1czSXlRClJzZnBrcTEwRGdsWCtRYUZkRXBx
+            VFUwYzh4NFQxVXllNkZOZldxNXVHeUEKLS0tIHlHZ2VubkNQUDhDdU8rdnZ3c2VD
+            VHlVRlpQcGQ1OForQmVRczkyYjRXMHcKxFi4zoGxbb8goV9LWHdTZFc+5xRXjRhH
+            ijmpLkrZRmfC3o4V2gva14mCpxXjG0s+ftRtv1tj8fs4TR9aUJT/7w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:51Z"
-    mac: ENC[AES256_GCM,data:d3edCfrD+Tz6WtlqA6VSSlI2IPbmmptvgokm8V4uoCzLJ6BKiFURcNX876rnCvxe30TT04hsh38C4jlfX1ordMv5yhN/7k/wvA5AAvAs08cilXYxwsJ4tbkd3YF5fY8jkYa8AfsH9b2b0Dj8rjKv4AyJ/s5KI8qNVw0WpyWDpnA=,iv:wP7IMRE/MHKf2pdo3Gqb0OR530fsPw6K2uJUNgmCJos=,tag:YvxS6xlRgjSoUTL/d3zCFg==,type:str]
+    lastmodified: "2026-08-26T10:25:00Z"
+    mac: ENC[AES256_GCM,data:HgDTiZyTJbI+U9nm05BJoNxDFpJQ3Ua4gafvjZZpckJTMuysEiMyyj38Rh/dCmvw1bIIZ0svJSl0XrY6jwkXQZEuHY45SW23ImzwsUpw7BEX2mq/9ejwzvU1Byju2fzuskqUD7zUzFYwJBTXLGxfZFjQS0WT4R3Qbwu5O2C0gIA=,iv:aV1XKtAAYaoF9eE6oyek404XuinMEHSuxzzxWaO5eeU=,tag:vSYWGULp998eI77IuU1/Ag==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0