fix(velero): isolate kopia repository password

k8s/bases/infrastructure/vault-config/job.yaml

@@ -614,6 +614,37 @@ spec:
                 echo "AWS bootstrap credentials already present at secret/infrastructure/aws/bootstrap (leaving as-is)."
               fi
 
+              # --- 1f. Retire the pre-isolation Velero repository password copy ---
+              # The Velero kopia repository password used to be mirrored to
+              # secret/infrastructure/backup/velero-repo, which the broad
+              # infra-backup-readonly policy grants read on. It now lands at
+              # secret/infrastructure/velero/repo instead (see the PushSecret in
+              # vault-seed/), but a PushSecret only writes the new path -- it never
+              # migrates or removes the old one. Left in place, the old entry stays
+              # readable by every infra-backup-readonly holder, so the isolation
+              # would not actually have happened.
+              #
+              # Destroy the old entry, but ONLY once the new path is confirmed to
+              # hold the password, so a run that happens before ESO has synced can
+              # never leave the platform with neither copy. `kv metadata delete`
+              # removes every version plus the metadata (a plain `kv delete` only
+              # soft-deletes the latest version and is trivially undeleted, which
+              # would not remove the exposure). Both branches are idempotent, so a
+              # later Job re-run is a no-op once the migration has completed.
+              if bao kv get -mount=secret -field=repository-password \
+                   infrastructure/velero/repo >/dev/null 2>&1; then
+                if bao kv metadata get -mount=secret \
+                     infrastructure/backup/velero-repo >/dev/null 2>&1; then
+                  echo "Retiring pre-isolation copy at secret/infrastructure/backup/velero-repo..."
+                  bao kv metadata delete -mount=secret infrastructure/backup/velero-repo
+                  echo "Retired: the Velero repository password now lives only at secret/infrastructure/velero/repo."
+                else
+                  echo "No pre-isolation Velero repository password copy present (already retired)."
+                fi
+              else
+                echo "WARNING: secret/infrastructure/velero/repo is not populated yet -- leaving the old copy at secret/infrastructure/backup/velero-repo in place until the PushSecret has synced."
+              fi
+
               # --- 2. Enable Kubernetes auth ---
               if ! bao auth list -format=json | grep -q '"kubernetes/"'; then
                 echo "Enabling Kubernetes auth method..."
@@ -877,6 +908,9 @@ spec:
               path "secret/data/infrastructure/ghcr/*" {
                 capabilities = ["create", "update", "read"]
               }
+              path "secret/data/infrastructure/velero/*" {
+                capabilities = ["create", "update", "read"]
+              }
               path "secret/data/apps/fleetdm/*" {
                 capabilities = ["create", "update", "read"]
               }
@@ -922,6 +956,9 @@ spec:
               path "secret/metadata/infrastructure/ghcr/*" {
                 capabilities = ["create", "update", "read"]
               }
+              path "secret/metadata/infrastructure/velero/*" {
+                capabilities = ["create", "update", "read"]
+              }
               path "secret/metadata/apps/fleetdm/*" {
                 capabilities = ["create", "update", "read"]
               }

k8s/bases/infrastructure/vault-seed/push-secret-seed-velero-repo-credentials.yaml

@@ -7,7 +7,8 @@
 # unrecoverable -- even if the R2 bucket is intact.
 #
 # This PushSecret one-way mirrors the password to OpenBao at
-# infrastructure/backup/velero-repo so it survives a cluster rebuild.
+# infrastructure/velero/repo so it survives a cluster rebuild without
+# sharing the broadly readable backup-object credential prefix.
 # OpenBao durability today comes from Velero snapshotting the openbao
 # namespace (including its PVC) to R2 on the daily schedule -- the
 # password lands in the off-cluster backup alongside every other
@@ -35,5 +36,5 @@ spec:
     - match:
         secretKey: repository-password  # checkov:skip=CKV_SECRET_6:names the key in the source Secret; the value is mirrored to OpenBao
         remoteRef:
-          remoteKey: infrastructure/backup/velero-repo
+          remoteKey: infrastructure/velero/repo
           property: repository-password