From 797e11ce119db97634936cf3f6652a64cc2861de Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 28 Sep 2026 11:11:06 +0800
Subject: [PATCH] feat(secrets): add forgejo-registry-pat for api namespace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Encrypted SOPS secret (age) — api-gateway image promoter needs
REGISTRY_PAT to query Forgejo v2 registry for image digests.
Key: pat  Value: bdf6a1d... (registry PAT from existing forgejo-registry-pat secret)
Namespace: api  Secret name: forgejo-registry-pat
---
 .../secrets/forgejo-registry-pat-api.enc.yaml | 23 +++++++++++++++++++
 k8s/argocd/secrets/secret-generator.yaml      |  1 +
 2 files changed, 24 insertions(+)
 create mode 100644 k8s/argocd/secrets/forgejo-registry-pat-api.enc.yaml

diff --git a/k8s/argocd/secrets/forgejo-registry-pat-api.enc.yaml b/k8s/argocd/secrets/forgejo-registry-pat-api.enc.yaml
new file mode 100644
index 0000000..91690c6
--- /dev/null
+++ b/k8s/argocd/secrets/forgejo-registry-pat-api.enc.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: forgejo-registry-pat
+    namespace: api
+type: Opaque
+stringData:
+    pat: ENC[AES256_GCM,data:alYPvHBVqnf13NZu6jtgA6WdFM4x46s5mIY8uEnfWdq0Vp+7oKrY1A==,iv:JbUjes5ZB9eKQ1nkV02++7F/BaWIROfT6gjShzajXro=,tag:ApjawJold0QApnX1GUXGhw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bFZhU3JLSUZEVWhYdEdZ
+            MURoSWNlZjY0RkxyaWlwU2ZTVjJ5V2FnMVVZCis5YlBwQnZrWnVJNFh4UnNldmx6
+            Y2JjdnpkRTVGSjRSZ0U0THdDZHIrNHcKLS0tIHZDd1BDVGRDSHJEQThuTExORWs2
+            b3BxenY4WHhpRkRTZHJGMkNYMm14RnMKH//Xpqbf/ZBNFQ43D0eFUWwRcQWqA3CC
+            RG8U9wyxC6YrlruU2hY6eB2x0OjsVic34ZGaR752Bwyp0Pz49C/k3g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-28T03:10:55Z"
+    mac: ENC[AES256_GCM,data:nLZueHygckw+Gddlea90tRU8h8nEGpe21JUi9nCdpc0ctkSlTDqcR3Q7JFPwbEGHGFU5UJ2xnkBZEDIVmExJryqPBMXT7hQd3ySeQgPwAPGt6zEhlRc5jXhqmmrpJiiN5XUL52AZVDwcWACg7kVzBXIClzihFRW+UqjJZhdtELM=,iv:C0H4AFfdfpsBvP1z2chVvW/VTejxYxwNn/KuA50LeH0=,tag:ZEkTCTKvoZH7DjrcwfL3dw==,type:str]
+    version: 3.13.2
diff --git a/k8s/argocd/secrets/secret-generator.yaml b/k8s/argocd/secrets/secret-generator.yaml
index 625c0a9..6ade342 100644
--- a/k8s/argocd/secrets/secret-generator.yaml
+++ b/k8s/argocd/secrets/secret-generator.yaml
@@ -12,6 +12,7 @@ files:
   - authentik-secrets.enc.yaml
   - cloudflare-secrets.enc.yaml
   - forgejo-registry-pat.enc.yaml
+  - forgejo-registry-pat-api.enc.yaml
   - forgejo-registry-pull.enc.yaml
   - forgejo-runner-token.enc.yaml
   - forgejo-secrets.enc.yaml