docs(migration): warn against secrets metadata migration in read-only mode

[nkwiatkowski]

Problem

The metadata migration guides don't mention that kestra migrate metadata secrets cannot run when the secret manager is in read-only mode. A customer running AWS Secrets Manager in read-only (scoped) mode hit a cryptic secretsmanager:GetSecretValue permission error and was unsure whether it was a blocker.

Fix

Add a warning to both the 1.3 LTS migration guide and the 1.1 KV & Secrets metadata migration guide: read-only secret managers do not use the secrets metadata store, so the migration is neither needed nor supported, and skipping it is expected and safe.

Evidence

Companion code PR (which makes the command fail with a clear message in read-only mode): kestra-io/kestra-ee#10631.

Closes https://github.com/kestra-io/kestra-ee/issues/10630.

[github-actions]

☁️ Cloudflare Worker Preview Deployed!

🔗 https://ks-fix-10630-secret-migration-rea-docs.kestra-io.workers.dev
🔗 https://b1fe1644-docs.kestra-io.workers.dev

🔦 Lighthouse Benchmark

Tested: http://localhost:8787 on 2026-09-01 15:18 UTC
Compared against main baseline from 2026-09-01

Scores (0–100, higher is better)

Page	Performance	Accessibility	Best Practices	SEO
Home	62	84	54	92
Get Started	68	83	54	100
Pricing	98	92	54	100
Enterprise	97	83	54	100
Cloud	91	80	54	100
About Us	85	91	54	100
Docs Landing	93	88	54	92
Contribute to Kestra (simple docs)	99	88	54	92
Flow (full featured docs)	95	90	54	92
Blog Index	65 🔻 -10	91	54	100
Blog Post (sample)	89	88	54	100
VS Page (sample)	97	88	54	100
Plugins Landing	92	81	54	92
Plugin Page (sample)	94	88	54	100
Plugin Debug Page (sample)	92	88	54	100
Plugin Debug Return Page (sample)	93	88	58	100
Blueprints Landing	74	91	54	100
Blueprint Audit Logs CSV Export	0	0	0	0

Core Web Vitals (lower is better)

Page	LCP	FCP	TBT	CLS	Speed Index
Home	1.26 s	0.66 s	1074 ms 🔻	0.000 🟢	2.66 s 🔻
Get Started	2.10 s	0.66 s	486 ms 🟢	0.000	0.98 s
Pricing	1.06 s	0.60 s	32 ms	0.000 🟢	0.86 s
Enterprise	1.27 s	0.64 s	25 ms	0.000 🟢	0.82 s
Cloud	1.93 s	0.63 s	38 ms	0.001	1.06 s
About Us	2.72 s	0.67 s	26 ms	0.000	0.87 s
Docs Landing	1.02 s 🟢	0.58 s	178 ms 🔻	0.000	0.97 s
Contribute to Kestra (simple docs)	0.99 s	0.51 s	60 ms	0.003	0.80 s
Flow (full featured docs)	1.16 s	0.62 s	125 ms	0.000	1.14 s
Blog Index	9.78 s	0.56 s	29 ms	0.000 🟢	13.51 s 🔻
Blog Post (sample)	2.17 s	0.58 s	24 ms	0.000	0.71 s
VS Page (sample)	1.15 s	0.62 s	40 ms	0.064	0.71 s
Plugins Landing	0.91 s	0.56 s	48 ms	0.000	3.01 s
Plugin Page (sample)	0.90 s	0.61 s	44 ms 🔻	0.000	2.35 s 🔻
Plugin Debug Page (sample)	1.00 s 🔻	0.63 s	125 ms 🔻	0.000	2.28 s
Plugin Debug Return Page (sample)	0.83 s	0.58 s	72 ms	0.000	2.52 s
Blueprints Landing	2.64 s	1.19 s 🔻	27 ms	0.000 🟢	4.18 s 🔻
Blueprint Audit Logs CSV Export	0.00 s	0.00 s	0 ms	0.000	0.00 s

Legend

🟢 improved  ·  🔻 regressed  ·  (blank) no significant change
Score threshold: ±10 pts  ·  Metric threshold: ±30% of baseline

View full Lighthouse HTML report for a page

Full per-page Lighthouse Results (LHR) are attached as the lhr-reports artifact on this run. Download and unzip it, then open https://googlechrome.github.io/lighthouse/viewer/ and drop the <page>-lhr.json file into the page to see every audit, opportunity, and diagnostic.