From e335694cbb2fac566c680a5fbf56ab93a78414c7 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sat, 24 Oct 2026 18:24:28 -0700
Subject: [PATCH] fix(sops): repair the generator list and rotate the Zitadel
 masterkey

Two defects in the ksops generator:

1. The `zitadel-masterkey.enc.yaml` entry was added with two-space indentation
   while every other entry uses four. YAML rejected the list, and kustomize
   reported it as `loading generator plugins ... MalformedYAMLError: yaml: line
   39`. That failed the whole sops-secrets application, so no Secret in that app
   could be created. Verified by running the same kustomize build inside
   argocd-repo-server: exit 1 before the fix, exit 0 with 33 manifests after it.

2. The masterkey value was generated during the first verification pass and
   appeared in that session's output. Rotate it now, before the instance exists:
   a fresh 32-byte value, SOPS-encrypted, with the offline copy updated. No
   ZITADEL data exists yet, so rotation costs nothing. After the first sync it
   would mean re-encrypting system.encryption_keys.

The offline copy lives outside the repo at ~/zitadel-masterkey.offline (0600).
---
 k8s/argocd/secrets/secret-generator.yaml      |  2 +-
 k8s/argocd/secrets/zitadel-masterkey.enc.yaml | 16 ++++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/k8s/argocd/secrets/secret-generator.yaml b/k8s/argocd/secrets/secret-generator.yaml
index 26ae193..823113f 100644
--- a/k8s/argocd/secrets/secret-generator.yaml
+++ b/k8s/argocd/secrets/secret-generator.yaml
@@ -37,4 +37,4 @@ files:
     - forgejo-registry-token.enc.yaml
     - pi-sandbox-secrets.enc.yaml
     - etcd-defrag-creds.enc.yaml
-  - zitadel-masterkey.enc.yaml
+    - zitadel-masterkey.enc.yaml
diff --git a/k8s/argocd/secrets/zitadel-masterkey.enc.yaml b/k8s/argocd/secrets/zitadel-masterkey.enc.yaml
index 3337ceb..9d039c4 100644
--- a/k8s/argocd/secrets/zitadel-masterkey.enc.yaml
+++ b/k8s/argocd/secrets/zitadel-masterkey.enc.yaml
@@ -5,19 +5,19 @@ metadata:
     namespace: iam
 type: Opaque
 stringData:
-    masterkey: ENC[AES256_GCM,data:dGp0wSCUJORP6W5PHLKYaQEqrZsgiAwU1GqcuvuZV+g=,iv:Wwt6E/XXwsoVEQxe4gG1m5oJLOcNUXngftADQvZQepw=,tag:1Vget5gs+t455U9zLavdwg==,type:str]
+    masterkey: ENC[AES256_GCM,data:Da543Jt48o6p3f6/AbZRsjChz3NexPJoi/mC/LB6jUI=,iv:irS0n76tZ6QzoQMm0dWrvbw+SPfXz4h13jQb/Bjfgwg=,tag:tfbgaAdxmPIjleB1OXLn0Q==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBld0tUWHNWem13cDlxRG14
-            QWRlTjA5SzZnS2pBd2M0WWkzQWxKZW9HZWdJCk00QWJJcWZFM1ZTSUlReUlGZG4z
-            RFBSUWRlVUx2NGN2OFAwazBYRTVVNkEKLS0tIHpSSW9IWHhNa0d3SmEydXU4akVj
-            MGJkN2U4WmtLbVFMZm55U1hEZElZMlUKKV9twnC9GC7MSmNLxEBHbPl4RN5Hsd+z
-            NViCKxUoQAB8apn2XVHZcDnyfKNfr1P3aSa3IIHyVY3prgo1OFDpdw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZld2VG9NaFhIVWpBcGpO
+            SmVwNm9FT2wrQmFKb0RGQmY4TCtITjFEZjBjCmNuNXNJYTdsZE44cDNzR2hiNTdy
+            QWlVdzBtdjd0cSsxUjQxMzNyblhWTkkKLS0tIHBLT2x1MDBGdjE1eHFOdHVGa1NO
+            ZGM1K2lDTksraFdPeFdSZ1JyU1VtcjAKgTjjhr7u4YRuQVZQ7kAa1clJ0Rzy10hQ
+            Umcd4/YStyXHZjsJJpFSpOFdP5cZscGo3xBgpXtxAscKTS1Nw4derg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-10-24T08:57:27Z"
-    mac: ENC[AES256_GCM,data:hXDAddVmnlf/yinY2c2Q8yfsjqi6n9cRbEbwykqYScd6mDPfdF7BriTiu9K+CV/IvIT4zcMTZbhBeQ/vTCAh0TZDp1lOVglwtNH/imgagyzPmcCvbCIkZKwF5vwWQIGHcDI6pk4/zVQkqt7zKTf8+Qj0pNh5UrAjVeEFE7cuJkQ=,iv:oIQvROFGbiESmMTthHOJiNM+Gy5BCfM5XtDWbszOPmc=,tag:AaYrJrwXuKD7w0p+TTa7FA==,type:str]
+    lastmodified: "2026-10-25T01:24:21Z"
+    mac: ENC[AES256_GCM,data:QFVk7KLsMLCAMH/PHVGCRyfU3k2JiO8AE3jJXmhnlUB4C8MYCTyOWQbnTFXozCMOr0kp+hAt3dYn/e23SWhyvJ7BgVLRb5QF1py704Dr46atVoLUvwHpFI7dyGK/LDTxqiM40RXAnDtWUJlTkVCzKdSFiV8CokIoByKWwxFPayM=,iv:t7HWMcpQl/DJ8Rp51Du7b5gURZO+C+FodsZSJuy5jBc=,tag:qEXSS4S0Y5cvn7T6EjakhA==,type:str]
     version: 3.13.2