Preserve Cassandra legacy BYOK during cutover

services/cassandra/backend-deployment.yaml

@@ -44,6 +44,9 @@ spec:
           {{- with secret "kv/data/atlas/cassandra/app-secrets" }}
           export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
           export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
+          {{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
+          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
+          {{- end }}
           {{- end }}
     spec:
       serviceAccountName: cassandra-backend

services/cassandra/bootstrap-jobs/cassandra-secrets-ensure-job.yaml

@@ -103,14 +103,25 @@ spec:
               if [ "${status}" = "200" ]; then
                 session_secret="$(jq -r '.data.data.CASSANDRA_SESSION_SECRET // empty' /tmp/app-secrets.json)"
                 byok_key="$(jq -r '.data.data.CASSANDRA_BYOK_ENCRYPTION_KEY // empty' /tmp/app-secrets.json)"
+                legacy_byok_key="$(jq -r '.data.data.VELES_BYOK_ENCRYPTION_KEY // empty' /tmp/app-secrets.json)"
               elif [ "${status}" = "404" ]; then
                 session_secret=""
                 byok_key=""
+                legacy_byok_key=""
               else
                 echo "Vault read failed for app-secrets (status ${status})" >&2
                 cat /tmp/app-secrets.json >&2 || true
                 exit 1
               fi
+              if [ -z "${legacy_byok_key}" ]; then
+                legacy_status="$(read_secret veles/app-secrets /tmp/veles-app-secrets.json)"
+                if [ "${legacy_status}" = "200" ]; then
+                  legacy_byok_key="$(jq -r '.data.data.VELES_BYOK_ENCRYPTION_KEY // empty' /tmp/veles-app-secrets.json)"
+                elif [ "${legacy_status}" != "404" ]; then
+                  echo "Vault read failed for veles/app-secrets (status ${legacy_status})" >&2
+                  exit 1
+                fi
+              fi
               if [ -z "${session_secret}" ]; then
                 session_secret="$(rand_b64 48)"
               fi
@@ -120,7 +131,9 @@ spec:
               app_payload="$(jq -nc \
                 --arg session_secret "${session_secret}" \
                 --arg byok_key "${byok_key}" \
-                '{data:{CASSANDRA_SESSION_SECRET:$session_secret,CASSANDRA_BYOK_ENCRYPTION_KEY:$byok_key}}')"
+                --arg legacy_byok_key "${legacy_byok_key}" \
+                '{data:({CASSANDRA_SESSION_SECRET:$session_secret,CASSANDRA_BYOK_ENCRYPTION_KEY:$byok_key}
+                  + (if $legacy_byok_key != "" then {VELES_BYOK_ENCRYPTION_KEY:$legacy_byok_key} else {} end))}')"
               write_secret cassandra/app-secrets "${app_payload}"
 
               postmark_status="$(read_secret shared/postmark-relay /tmp/postmark.json)"

services/cassandra/generator-deployment.yaml

@@ -36,6 +36,9 @@ spec:
           {{- with secret "kv/data/atlas/cassandra/app-secrets" }}
           export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
           export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
+          {{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
+          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
+          {{- end }}
           {{- end }}
     spec:
       serviceAccountName: cassandra-generator

services/cassandra/secretproviderclass.yaml

@@ -31,6 +31,9 @@ spec:
       - objectName: "cassandra-app__byok-encryption-key"
         secretPath: "kv/data/atlas/cassandra/app-secrets"
         secretKey: "CASSANDRA_BYOK_ENCRYPTION_KEY"
+      - objectName: "cassandra-app__legacy-byok-encryption-key"
+        secretPath: "kv/data/atlas/cassandra/app-secrets"
+        secretKey: "VELES_BYOK_ENCRYPTION_KEY"
   secretObjects:
     - secretName: harbor-regcred
       type: kubernetes.io/dockerconfigjson
@@ -52,6 +55,8 @@ spec:
           key: CASSANDRA_SESSION_SECRET
         - objectName: cassandra-app__byok-encryption-key
           key: CASSANDRA_BYOK_ENCRYPTION_KEY
+        - objectName: cassandra-app__legacy-byok-encryption-key
+          key: VELES_BYOK_ENCRYPTION_KEY
 ---
 apiVersion: secrets-store.csi.x-k8s.io/v1
 kind: SecretProviderClass

services/vault/scripts/vault_k8s_auth_configure.sh

@@ -265,7 +265,7 @@ write_policy_and_role "cassandra" "cassandra" "cassandra-backend,cassandra-gener
 write_policy_and_role "cassandra-sim" "cassandra" "cassandra-sim" \
   "cassandra/codex-cli" ""
 write_policy_and_role "cassandra-secrets" "cassandra" "cassandra-secrets-ensure" \
-  "shared/postmark-relay" \
+  "shared/postmark-relay veles/app-secrets" \
   "cassandra/*"
 write_policy_and_role "cassandra-migration" "cassandra" "cassandra-db-migration" \
   "veles/veles-db cassandra/cassandra-db" ""