From 25a194bf844b13a38e4f613c2197b15f1777246a Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 25 Jul 2026 08:16:35 -0300
Subject: [PATCH] Preserve Cassandra legacy BYOK during cutover

---
 services/cassandra/backend-deployment.yaml        |  3 +++
 .../cassandra-secrets-ensure-job.yaml             | 15 ++++++++++++++-
 services/cassandra/generator-deployment.yaml      |  3 +++
 services/cassandra/secretproviderclass.yaml       |  5 +++++
 .../vault/scripts/vault_k8s_auth_configure.sh     |  2 +-
 5 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/services/cassandra/backend-deployment.yaml b/services/cassandra/backend-deployment.yaml
index 6d2a496fb..2263b409b 100644
--- a/services/cassandra/backend-deployment.yaml
+++ b/services/cassandra/backend-deployment.yaml
@@ -44,6 +44,9 @@ spec:
           {{- with secret "kv/data/atlas/cassandra/app-secrets" }}
           export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
           export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
+          {{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
+          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
+          {{- end }}
           {{- end }}
     spec:
       serviceAccountName: cassandra-backend
diff --git a/services/cassandra/bootstrap-jobs/cassandra-secrets-ensure-job.yaml b/services/cassandra/bootstrap-jobs/cassandra-secrets-ensure-job.yaml
index 60b1e5dff..29f52a73e 100644
--- a/services/cassandra/bootstrap-jobs/cassandra-secrets-ensure-job.yaml
+++ b/services/cassandra/bootstrap-jobs/cassandra-secrets-ensure-job.yaml
@@ -103,14 +103,25 @@ spec:
               if [ "${status}" = "200" ]; then
                 session_secret="$(jq -r '.data.data.CASSANDRA_SESSION_SECRET // empty' /tmp/app-secrets.json)"
                 byok_key="$(jq -r '.data.data.CASSANDRA_BYOK_ENCRYPTION_KEY // empty' /tmp/app-secrets.json)"
+                legacy_byok_key="$(jq -r '.data.data.VELES_BYOK_ENCRYPTION_KEY // empty' /tmp/app-secrets.json)"
               elif [ "${status}" = "404" ]; then
                 session_secret=""
                 byok_key=""
+                legacy_byok_key=""
               else
                 echo "Vault read failed for app-secrets (status ${status})" >&2
                 cat /tmp/app-secrets.json >&2 || true
                 exit 1
               fi
+              if [ -z "${legacy_byok_key}" ]; then
+                legacy_status="$(read_secret veles/app-secrets /tmp/veles-app-secrets.json)"
+                if [ "${legacy_status}" = "200" ]; then
+                  legacy_byok_key="$(jq -r '.data.data.VELES_BYOK_ENCRYPTION_KEY // empty' /tmp/veles-app-secrets.json)"
+                elif [ "${legacy_status}" != "404" ]; then
+                  echo "Vault read failed for veles/app-secrets (status ${legacy_status})" >&2
+                  exit 1
+                fi
+              fi
               if [ -z "${session_secret}" ]; then
                 session_secret="$(rand_b64 48)"
               fi
@@ -120,7 +131,9 @@ spec:
               app_payload="$(jq -nc \
                 --arg session_secret "${session_secret}" \
                 --arg byok_key "${byok_key}" \
-                '{data:{CASSANDRA_SESSION_SECRET:$session_secret,CASSANDRA_BYOK_ENCRYPTION_KEY:$byok_key}}')"
+                --arg legacy_byok_key "${legacy_byok_key}" \
+                '{data:({CASSANDRA_SESSION_SECRET:$session_secret,CASSANDRA_BYOK_ENCRYPTION_KEY:$byok_key}
+                  + (if $legacy_byok_key != "" then {VELES_BYOK_ENCRYPTION_KEY:$legacy_byok_key} else {} end))}')"
               write_secret cassandra/app-secrets "${app_payload}"
 
               postmark_status="$(read_secret shared/postmark-relay /tmp/postmark.json)"
diff --git a/services/cassandra/generator-deployment.yaml b/services/cassandra/generator-deployment.yaml
index e5e1b73c3..35632354d 100644
--- a/services/cassandra/generator-deployment.yaml
+++ b/services/cassandra/generator-deployment.yaml
@@ -36,6 +36,9 @@ spec:
           {{- with secret "kv/data/atlas/cassandra/app-secrets" }}
           export CASSANDRA_SESSION_SECRET="{{ .Data.data.CASSANDRA_SESSION_SECRET }}"
           export CASSANDRA_BYOK_ENCRYPTION_KEY="{{ .Data.data.CASSANDRA_BYOK_ENCRYPTION_KEY }}"
+          {{- if .Data.data.VELES_BYOK_ENCRYPTION_KEY }}
+          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
+          {{- end }}
           {{- end }}
     spec:
       serviceAccountName: cassandra-generator
diff --git a/services/cassandra/secretproviderclass.yaml b/services/cassandra/secretproviderclass.yaml
index b3a2db7b8..a1a0f483b 100644
--- a/services/cassandra/secretproviderclass.yaml
+++ b/services/cassandra/secretproviderclass.yaml
@@ -31,6 +31,9 @@ spec:
       - objectName: "cassandra-app__byok-encryption-key"
         secretPath: "kv/data/atlas/cassandra/app-secrets"
         secretKey: "CASSANDRA_BYOK_ENCRYPTION_KEY"
+      - objectName: "cassandra-app__legacy-byok-encryption-key"
+        secretPath: "kv/data/atlas/cassandra/app-secrets"
+        secretKey: "VELES_BYOK_ENCRYPTION_KEY"
   secretObjects:
     - secretName: harbor-regcred
       type: kubernetes.io/dockerconfigjson
@@ -52,6 +55,8 @@ spec:
           key: CASSANDRA_SESSION_SECRET
         - objectName: cassandra-app__byok-encryption-key
           key: CASSANDRA_BYOK_ENCRYPTION_KEY
+        - objectName: cassandra-app__legacy-byok-encryption-key
+          key: VELES_BYOK_ENCRYPTION_KEY
 ---
 apiVersion: secrets-store.csi.x-k8s.io/v1
 kind: SecretProviderClass
diff --git a/services/vault/scripts/vault_k8s_auth_configure.sh b/services/vault/scripts/vault_k8s_auth_configure.sh
index 770b628d5..d0876b6ed 100644
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@@ -265,7 +265,7 @@ write_policy_and_role "cassandra" "cassandra" "cassandra-backend,cassandra-gener
 write_policy_and_role "cassandra-sim" "cassandra" "cassandra-sim" \
   "cassandra/codex-cli" ""
 write_policy_and_role "cassandra-secrets" "cassandra" "cassandra-secrets-ensure" \
-  "shared/postmark-relay" \
+  "shared/postmark-relay veles/app-secrets" \
   "cassandra/*"
 write_policy_and_role "cassandra-migration" "cassandra" "cassandra-db-migration" \
   "veles/veles-db cassandra/cassandra-db" ""