{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-24T22:44:15.019Z",
  "record_id": "VXI-EXT-PROCUREMENT-VELERO-REPOSITORY-PASSWORD-EXISTING-BACKUPS-01-v1",
  "record_kind": "external_reference",
  "title": "Velero backup repository password changes",
  "system": "Velero v1.18.4",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Can changing the Velero repository credential secret after the first backup preserve access to earlier backups automatically?",
  "near_questions": [
    "Why are old Velero backups inaccessible after changing the repository password?",
    "When should a Velero custom backup password be set?",
    "Does changing velero-repo-credentials re-encrypt existing archives?",
    "What recovery evidence is needed before rotating a Velero repository secret?"
  ],
  "supported_claims": [
    {
      "claim": "The v1.18.4 FSB guide says the backup repository is created on the first backup targeting it and the custom repository password should be set before that operation. Changing the secret password after repository creation prevents Velero from connecting to older backups. Editing the Kubernetes secret is therefore not documented as an automatic re-encryption or password migration of existing archives.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "No password, key material or buyer restore was accessed.",
    "No independently verified physical deletion, complete recovery, legal compliance or security assurance.",
    "Buyer deployment testing, live runtime enforcement, certification or permission to act",
    "Expanded capabilities or licences for existing INDEX executables"
  ],
  "public_summary": "The v1.18.4 FSB guide says the backup repository is created on the first backup targeting it and the custom repository password should be set before that operation. Changing the secret password after repository creation prevents Velero from connecting to older backups. Editing the Kubernetes secret is therefore not documented as an automatic re-encryption or password migration of existing archives.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Velero v1.18.4 — file-system-backup",
    "source_url": "https://raw.githubusercontent.com/vmware-tanzu/velero/4ee1e79a7aed367fd9b767b8219ec65bd0c96892/site/content/docs/main/file-system-backup.md",
    "checked_on": "2026-10-24",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-VELERO-REPOSITORY-PASSWORD-EXISTING-BACKUPS-01-v1",
    "candidate_record_sha256": "0e6e6bbd498bfdce444f594ee2402c5a7a69974d9651e468c813d6f3fdf875de",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The v1.18.4 FSB guide says the backup repository is created on the first backup targeting it and the custom repository password should be set before that operation. Changing the secret password after repository creation prevents Velero from connecting to older backups. Editing the Kubernetes secret is therefore not documented as an automatic re-encryption or password migration of existing archives.",
    "required_buyer_context": "Repository creation and backup history; Credential-change sequence and protected recovery material; Connectivity and restore validation for retained archives. Buyer deployment not inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-24",
    "claim_to_check": "Can changing the Velero repository credential secret after the first backup preserve access to earlier backups automatically?",
    "documented_statement": {
      "status": "documented",
      "statement": "The v1.18.4 FSB guide says the backup repository is created on the first backup targeting it and the custom repository password should be set before that operation. Changing the secret password after repository creation prevents Velero from connecting to older backups. Editing the Kubernetes secret is therefore not documented as an automatic re-encryption or password migration of existing archives.",
      "source_ids": [
        "velero-file-system-backup"
      ]
    },
    "review_inference": {
      "status": "review_inference",
      "statement": "Plan credential changes without silently losing recovery access to retained backups. The required reconciliation is a review judgment; no buyer deployment was inspected.",
      "source_ids": [
        "velero-file-system-backup"
      ]
    },
    "buyer_evidence_required": [
      "Repository creation and backup history",
      "Credential-change sequence and protected recovery material",
      "Connectivity and restore validation for retained archives"
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Refuse transparent rotation or erasure claims based only on changing the credential secret."
    },
    "unknowns": "No password, key material or buyer restore was accessed.",
    "unknown_finding": {
      "status": "unknown",
      "statement": "No password, key material or buyer restore was accessed."
    },
    "evidence_sources": [
      {
        "source_id": "velero-file-system-backup",
        "url": "https://raw.githubusercontent.com/vmware-tanzu/velero/4ee1e79a7aed367fd9b767b8219ec65bd0c96892/site/content/docs/main/file-system-backup.md",
        "final_url": "https://raw.githubusercontent.com/vmware-tanzu/velero/4ee1e79a7aed367fd9b767b8219ec65bd0c96892/site/content/docs/main/file-system-backup.md",
        "status": 200,
        "captured_at_utc": "2026-10-24T22:29:01.991Z",
        "sha256": "eac7a7da06432d8c97e6eea957d4892e29be3d479fa6100128dea518ef1c08d0",
        "bytes": 40736,
        "title": "Velero v1.18.4 — file-system-backup",
        "hash_basis": "Decoded HTTP response body bytes",
        "rights_review": "Original bounded paraphrase; source bodies are captured privately and not redistributed. Repository Apache-2.0 licence reviewed.",
        "checked_on": "2026-10-24",
        "capture_status": 200,
        "claim_review_completed": true,
        "reviewed_sections": [
          "File System Backup; pros and cons",
          "Relationship with Volume Snapshots",
          "Repository credentials before first backup"
        ],
        "version_context": "Released Velero v1.18.4 (2026-09-28); pinned vmware-tanzu/velero revision 4ee1e79a7aed367fd9b767b8219ec65bd0c96892. Source documentation is not independent evidence of buyer deployment behaviour."
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Documentation review only; the buyer must establish applicability and actual outcomes. INDEX does not inspect or control the deployment.",
    "paid_value": {
      "decision_context": "Plan credential changes without silently losing recovery access to retained backups.",
      "free": "Complete review, sources, practical questions and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Recheck the pinned source, deployed version, selection policy and retained operation results before relying on a current outcome."
    },
    "buyer_relevance": "Plan credential changes without silently losing recovery access to retained backups.",
    "refusal_conditions": [
      "Refuse transparent rotation or erasure claims based only on changing the credential secret."
    ]
  },
  "niche": {
    "niche_id": "enterprise-ai-data-custody-exit-assurance",
    "label": "Enterprise AI Data Custody & Exit Assurance",
    "classification_id": "custody",
    "classification_label": "AI Data Custody, Retention & Exit Assurance",
    "topic_id": "custody",
    "buyer_intent": "Plan credential changes without silently losing recovery access to retained backups.",
    "comparison_role": "supplementary_discovery"
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#velero-repository-password-existing-backups",
  "machine_readable_record": "/varexis-index/records/velero-repository-password-existing-backups.json"
}