fix(vault): retire Crossview's credentials and the one-off retirement

.github/workflows/ci.yaml

@@ -1004,16 +1004,6 @@ jobs:
           shellcheck scripts/verify-wedding-shared-backup-coverage.sh scripts/verify-wedding-shared-backup-coverage-pod.sh scripts/remove-wedding-shared-backup-pod.sh scripts/verify-shared-backup-consumers.sh scripts/tests/test-verify-wedding-shared-backup-coverage.sh
           bash scripts/tests/test-verify-wedding-shared-backup-coverage.sh
 
-      # The Crossview, Headlamp and Backstage leftovers, including retained
-      # database volumes, are deleted on this script's word, and deleted data
-      # cannot be restored. These cases keep an undeployed removal, a foreign
-      # object, attached or unrelated storage, a failed read or a survivor from
-      # passing.
-      - name: 🧹 Validate the unused-app retirement
-        run: |
-          shellcheck scripts/retire-unused-apps.sh scripts/tests/test-retire-unused-apps.sh
-          bash scripts/tests/test-retire-unused-apps.sh
-
       - name: Validate generated autoscaler cleanup
         run: |
           shellcheck scripts/cleanup-orphan-generated-vpas.sh scripts/tests/test-cleanup-orphan-generated-vpas.sh

AGENTS.md

@@ -650,11 +650,11 @@ never owns the claims a controller creates, such as CloudNativePG instance
 claims, so removing a manifest leaves them in place, and a `Retain` volume and
 its storage-backend volume outlive the claim. Retiring that data is an explicit,
 reviewed deletion of the owning resource, its claims, their volumes and the
-backend volumes. The one-off `Retire Unused App Leftovers` workflow does this
-for the retired Backstage database on the maintainer's decision of 26 October
-2026 (#4266), together with the Crossview and Headlamp leftovers (#2496). No
-required opt-out is removed from a managed manifest or an existing protected
-object.
+backend volumes. A one-off `Retire Unused App Leftovers` workflow did this for
+the retired Backstage database on the maintainer's decision of 26 October 2026
+(#4266), together with the Crossview and Headlamp leftovers (#2496), and was
+removed once its run proved nothing remained (#5391). No required opt-out is
+removed from a managed manifest or an existing protected object.
 
 This is the rule in force today, and it is being replaced.
 [`docs/adr/storage-retention.md`](docs/adr/storage-retention.md) records the decision

docs/developer-platform.md

@@ -35,7 +35,8 @@ how it worked.
 The portal's retained database was no longer needed. On 26 October 2026 the
 maintainer decided to delete it rather than keep a recovery copy, which closes
 the open retention question
-([#5122](https://github.com/devantler-tech/platform/issues/5122)). The one-off
-**Retire Unused App Leftovers** workflow deletes the database, its claims, their
+([#5122](https://github.com/devantler-tech/platform/issues/5122)). A one-off
+**Retire Unused App Leftovers** workflow deleted the database, its claims, their
 retained volumes and the `backstage` namespace
-([#4266](https://github.com/devantler-tech/platform/issues/4266)).
+([#4266](https://github.com/devantler-tech/platform/issues/4266)) and was then
+removed ([#5391](https://github.com/devantler-tech/platform/issues/5391)).

k8s/bases/infrastructure/vault-config/job.yaml

@@ -692,6 +692,19 @@ spec:
                 echo "WARNING: secret/infrastructure/velero/repo is not populated yet -- leaving the old copy at secret/infrastructure/backup/velero-repo in place until the PushSecret has synced."
               fi
 
+              # --- 1g. Retire Crossview's generated credentials ---
+              # Crossview, its retained database and their storage were deleted
+              # by the explicit retirement (#2496), so nothing can need these
+              # credentials any more. Their PushSecrets never delete the remote
+              # copies, so destroy every version plus the metadata here.
+              # Deleting absent metadata succeeds, so a later run is a no-op;
+              # any other error fails the Job (set -e) instead of reading as
+              # "already retired".
+              for retired in apps/crossview/db apps/crossview/app apps/crossview/admin; do
+                echo "Retiring secret/$retired..."
+                bao kv metadata delete -mount=secret "$retired"
+              done
+
               # --- 2. Enable Kubernetes auth ---
               if ! bao auth list -format=json | grep -q '"kubernetes/"'; then
                 echo "Enabling Kubernetes auth method..."
@@ -894,18 +907,9 @@ spec:
               }
               POLICY
 
-              # crossview reads its bundled-Postgres password, app session secret,
-              # and break-glass admin password from OpenBao via the shared
-              # `external-secrets` ClusterSecretStore role (apps/crossview/{db,app,
-              # admin}); the values are generated and seeded by
-              # infrastructure/vault-seed. (Its OIDC client secret is read from the
-              # shared infrastructure/oidc/dex path via infra-oidc-readonly, also on
-              # that role — no crossview-specific grant needed.)
-              bao policy write app-crossview-readonly - <<'POLICY'
-              path "secret/data/apps/crossview/*" {
-                capabilities = ["read"]
-              }
-              POLICY
+              # Crossview was removed from the platform; drop its retired read
+              # policy. Deleting an absent policy succeeds, so re-runs are no-ops.
+              bao policy delete app-crossview-readonly
 
               # actual-budget reads its Enable Banking bank-sync credentials from
               # OpenBao via the shared `external-secrets` ClusterSecretStore role
@@ -1033,9 +1037,6 @@ spec:
               path "secret/data/apps/actual-budget/*" {
                 capabilities = ["create", "update", "read"]
               }
-              path "secret/data/apps/crossview/*" {
-                capabilities = ["create", "update", "read"]
-              }
               # Company Email preparation preserves three durable credentials.
               # Exact-key read/seed only; no mailbox data or wildcard grant.
               path "secret/data/apps/private-mail/admin" {
@@ -1092,9 +1093,6 @@ spec:
               path "secret/metadata/apps/actual-budget/*" {
                 capabilities = ["create", "update", "read"]
               }
-              path "secret/metadata/apps/crossview/*" {
-                capabilities = ["create", "update", "read"]
-              }
               path "secret/metadata/apps/private-mail/admin" {
                 capabilities = ["create", "update", "read"]
               }
@@ -1124,7 +1122,7 @@ spec:
               bao write auth/kubernetes/role/external-secrets \
                 bound_service_account_names=external-secrets \
                 bound_service_account_namespaces=external-secrets \
-                policies=infra-backup-readonly,infra-dns-readonly,infra-monitoring-readonly,infra-hcloud-readonly,infra-tls-readonly,infra-ghcr-readonly,app-fleetdm-readonly,app-wedding-readonly,app-umami-readonly,app-actual-budget-readonly,app-crossview-readonly,app-ascoachingogvaner-readonly,infra-oidc-readonly,vault-seed-write \
+                policies=infra-backup-readonly,infra-dns-readonly,infra-monitoring-readonly,infra-hcloud-readonly,infra-tls-readonly,infra-ghcr-readonly,app-fleetdm-readonly,app-wedding-readonly,app-umami-readonly,app-actual-budget-readonly,app-ascoachingogvaner-readonly,infra-oidc-readonly,vault-seed-write \
                 ttl=1h
 
               # Dedicated role for the fleetdm VaultDynamicSecret generator.

k8s/bases/infrastructure/vault-seed/kustomization.yaml

@@ -10,9 +10,6 @@ resources:
   - password-umami-app-secret.yaml
   - password-umami-admin-password.yaml
   - password-umami-ascoachingogvaner-password.yaml
-  - password-crossview-db-password.yaml
-  - password-crossview-session-secret.yaml
-  - password-crossview-admin-password.yaml
   - external-secret-generated-fleetdm-mysql-root-password.yaml
   - push-secret-push-fleetdm-mysql-passwords.yaml
   - external-secret-generated-fleetdm-mysql-replication-password.yaml
@@ -29,12 +26,6 @@ resources:
   - push-secret-push-umami-admin-password.yaml
   - external-secret-generated-umami-ascoachingogvaner-password.yaml
   - push-secret-push-umami-ascoachingogvaner-password.yaml
-  - external-secret-generated-crossview-db-password.yaml
-  - push-secret-push-crossview-db-password.yaml
-  - external-secret-generated-crossview-session-secret.yaml
-  - push-secret-push-crossview-session-secret.yaml
-  - external-secret-generated-crossview-admin-password.yaml
-  - push-secret-push-crossview-admin-password.yaml
   - push-secret-seed-r2-credentials.yaml
   - push-secret-seed-wedding-db-backup-r2.yaml
   - push-secret-seed-github-app.yaml