fix(sops): repair the ksops generator list and rotate the Zitadel masterkey #66

2026-10-25T01:24:38Z

rock commented

2026-10-25 01:24:38 +00:00

Fixes the two-space indentation that made secret-generator.yaml invalid YAML (kustomize: loading generator plugins ... MalformedYAMLError: line 39), and rotates the Zitadel masterkey before any ZITADEL data exists.

Verified by running the same kustomize build inside argocd-repo-server: exit 1 before, exit 0 with 33 manifests after.

Fixes the two-space indentation that made `secret-generator.yaml` invalid YAML (kustomize: `loading generator plugins ... MalformedYAMLError: line 39`), and rotates the Zitadel masterkey before any ZITADEL data exists. Verified by running the same kustomize build inside `argocd-repo-server`: exit 1 before, exit 0 with 33 manifests after.

rock added 1 commit 2026-10-25 01:24:40 +00:00

fix(sops): repair the generator list and rotate the Zitadel masterkey e335694cbb

Two defects in the ksops generator:

1. The `zitadel-masterkey.enc.yaml` entry was added with two-space indentation
   while every other entry uses four. YAML rejected the list, and kustomize
   reported it as `loading generator plugins ... MalformedYAMLError: yaml: line
   39`. That failed the whole sops-secrets application, so no Secret in that app
   could be created. Verified by running the same kustomize build inside
   argocd-repo-server: exit 1 before the fix, exit 0 with 33 manifests after it.

2. The masterkey value was generated during the first verification pass and
   appeared in that session's output. Rotate it now, before the instance exists:
   a fresh 32-byte value, SOPS-encrypted, with the offline copy updated. No
   ZITADEL data exists yet, so rotation costs nothing. After the first sync it
   would mean re-encrypting system.encryption_keys.

The offline copy lives outside the repo at ~/zitadel-masterkey.offline (0600).

rock merged commit 111b19dac2 into main

2026-10-25 01:24:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#66