From e10ca337f1f2987b0dc71632ff3b312ef0949d9f Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 25 Oct 2026 16:28:43 +0100
Subject: [PATCH] velero: a key for Garage, from Vault

---
 velero/external-secret.yaml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 velero/external-secret.yaml

diff --git a/velero/external-secret.yaml b/velero/external-secret.yaml
new file mode 100644
index 0000000..7356295
--- /dev/null
+++ b/velero/external-secret.yaml
@@ -0,0 +1,30 @@
+# Velero's key for its bucket in Garage on the NAS (nas/garage), in the
+# AWS credentials file format the aws plugin and kopia read.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: velero-s3-credentials
+spec:
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  refreshInterval: 15m
+  target:
+    name: velero-s3-credentials
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        cloud: |
+          [default]
+          aws_access_key_id={{ .access_key_id }}
+          aws_secret_access_key={{ .secret_access_key }}
+  data:
+    - secretKey: access_key_id
+      remoteRef:
+        key: kv/velero-s3
+        property: access_key_id
+    - secretKey: secret_access_key
+      remoteRef:
+        key: kv/velero-s3
+        property: secret_access_key