- Add minio-s3-credentials ClusterExternalSecret - Auto-create secret in namespaces with minio-s3: enabled label - Add minio-s3 label to zot namespace via managedNamespaceMetadata - Credentials stored in Vault at secret/minio-s3-credentials
- Change secret paths from <category>/<app> to <app> - databases/postgresql → postgresql - databases/minio → minio - databases/pgweb → pgweb - cluster-infrastructure/velero → velero
- Move ExternalSecret files from vault/ to manifests/secret.yaml - Merge multiple secrets with --- separator (postgresql) - Update kustomization.yaml references - Remove vault/ folders Apps: postgresql, postgresql-dev, pgweb, minio, velero