fix(sops): repair the generator list and rotate the Zitadel masterkey

Two defects in the ksops generator:

1. The `zitadel-masterkey.enc.yaml` entry was added with two-space indentation
   while every other entry uses four. YAML rejected the list, and kustomize
   reported it as `loading generator plugins ... MalformedYAMLError: yaml: line
   39`. That failed the whole sops-secrets application, so no Secret in that app
   could be created. Verified by running the same kustomize build inside
   argocd-repo-server: exit 1 before the fix, exit 0 with 33 manifests after it.

2. The masterkey value was generated during the first verification pass and
   appeared in that session's output. Rotate it now, before the instance exists:
   a fresh 32-byte value, SOPS-encrypted, with the offline copy updated. No
   ZITADEL data exists yet, so rotation costs nothing. After the first sync it
   would mean re-encrypting system.encryption_keys.

The offline copy lives outside the repo at ~/zitadel-masterkey.offline (0600).

This commit is contained in:

rock

2026-10-24 18:24:28 -07:00

parent d1a7d3be6e

commit e335694cbb

2 changed files with 9 additions and 9 deletions

									
										k8s/argocd/secrets/secret-generator.yaml
									
		+1
		-1
	
												View File
												
				@@ -37,4 +37,4 @@ files:

				    - forgejo-registry-token.enc.yaml

				    - pi-sandbox-secrets.enc.yaml

				    - etcd-defrag-creds.enc.yaml

				  - zitadel-masterkey.enc.yaml

				    - zitadel-masterkey.enc.yaml