We Had It All as Code in GitOps. Then We Rebuilt the K3s Cluster, and Every Sealed Secret Became Undecryptable
Rebuilding a K3s cluster with GitOps left every Sealed Secret undecryptable. The real cause was how the private key was handled. Here's the failure mechanism, the recovery steps, and how to prevent it from happening again.