Why: after the engine is first configured, rotate-root changes the live admin
password so it diverges from the KV seed. Re-reading the (possibly stale) seed
on a later apply must not push it back and clobber the rotated password. Ben
asked that the seed be used only when initially creating the config.
Change:
- Add lifecycle ignore_changes on admin_username/admin_password to the
gitea_secret_backend resource, making the module create-only for the seeded
credential. Noted inline that the rancher/litellm seed modules lack this.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkinben
13c1f5c1ba