fix(secrets): populate the empty sops placeholders and drop the unused one #55

2026-10-06T02:03:25Z

rock commented

2026-10-06 02:03:25 +00:00

What

Four .enc.yaml files in k8s/argocd/secrets/ were committed as 0-byte placeholders (commit 0304461, next to scripts/iam/rotate-secrets.sh). Three now hold real SOPS-encrypted content and the fourth is removed.

file	now	source
`memory-agent-oidc.enc.yaml`	Secret `memory-agent-oidc`/`poimen`, 4 keys	the live Secret (identical values, so applying is idempotent)
`oauth2-credentials.enc.yaml`	Secret `oauth2-credentials`/`iam`, 5 client secrets	per-app live creds: api-gw, minio, poimen, paperless, grafana
`forgejo-registry-token.enc.yaml`	Secret `forgejo-registry-token`/`cicd`, `username` + `password`	`username=rock` (matches the SecretRotation `appId: rock/riotpiao.com`), `password` = the live registry PAT
`database-passwords-backup.enc.yaml`	removed	nothing references it anywhere in the repo — no producer, no consumer

All three are registered in the ksops generator, so ArgoCD creates them (29 files listed now).

Why it matters

registry-cleanup-cronjob.yaml mounts forgejo-registry-token with optional: true and reads /etc/registry-secret/{username,password}. That Secret never existed, so the job has been running unauthenticated and cleaning nothing, silently — crane auth login and the catalog query could not have succeeded. This PR gives it the credential it asks for.

Evidence

Values round-trip: decrypting each file yields entries whose SHA-256 matches the live source Secret, key for key.
Decrypted inside argocd-repo-server with its production env (SOPS_AGE_KEY_FILE=/sops-age/key.txt): all three OK — the same key ksops uses at build time.
A wrong key fails on the same files, so the check discriminates.

Notes / follow-ups

secret-rotation-controller (sample CR in k8s/apps/secret-rotation-controller/crd.yaml) writes k8s/argocd/secrets/forgejo-registry-secret.enc.yaml with secretRef: forgejo-registry-secret/kube-system/REGISTRY_TOKEN — a name mismatch with the CronJob's forgejo-registry-token in cicd. Decide which name wins; today the rotation controller and the consumer disagree.
scripts/iam/rotate-secrets.sh writes plaintext k8s/argocd/secrets/*.yaml and encrypts over the top — it creates these files, so the committed empties were an artifact of never having completed a rotation.

## What Four `.enc.yaml` files in `k8s/argocd/secrets/` were committed as **0-byte placeholders** (commit 0304461, next to `scripts/iam/rotate-secrets.sh`). Three now hold real SOPS-encrypted content and the fourth is removed. | file | was | now | source | | --- | --- | --- | --- | | `memory-agent-oidc.enc.yaml` | 0 bytes | Secret `memory-agent-oidc`/`poimen`, 4 keys | the live Secret (identical values, so applying is idempotent) | | `oauth2-credentials.enc.yaml` | 0 bytes | Secret `oauth2-credentials`/`iam`, 5 client secrets | per-app live creds: api-gw, minio, poimen, paperless, grafana | | `forgejo-registry-token.enc.yaml` | 0 bytes | Secret `forgejo-registry-token`/`cicd`, `username` + `password` | `username=rock` (matches the SecretRotation `appId: rock/riotpiao.com`), `password` = the live registry PAT | | `database-passwords-backup.enc.yaml` | 0 bytes | removed | nothing references it anywhere in the repo — no producer, no consumer | All three are registered in the ksops generator, so ArgoCD creates them (29 files listed now). ## Why it matters `registry-cleanup-cronjob.yaml` mounts `forgejo-registry-token` with `optional: true` and reads `/etc/registry-secret/{username,password}`. That Secret never existed, so the job has been **running unauthenticated and cleaning nothing, silently** — `crane auth login` and the catalog query could not have succeeded. This PR gives it the credential it asks for. ## Evidence - Values round-trip: decrypting each file yields entries whose SHA-256 matches the live source Secret, key for key. - Decrypted **inside `argocd-repo-server`** with its production env (`SOPS_AGE_KEY_FILE=/sops-age/key.txt`): all three `OK` — the same key ksops uses at build time. - A wrong key fails on the same files, so the check discriminates. ## Notes / follow-ups - `secret-rotation-controller` (sample CR in `k8s/apps/secret-rotation-controller/crd.yaml`) writes `k8s/argocd/secrets/forgejo-registry-secret.enc.yaml` with `secretRef: forgejo-registry-secret/kube-system/REGISTRY_TOKEN` — a **name mismatch** with the CronJob's `forgejo-registry-token` in `cicd`. Decide which name wins; today the rotation controller and the consumer disagree. - `scripts/iam/rotate-secrets.sh` writes plaintext `k8s/argocd/secrets/*.yaml` and encrypts over the top — it creates these files, so the committed empties were an artifact of never having completed a rotation.

rock added 1 commit 2026-10-06 02:03:27 +00:00

fix(secrets): populate the empty sops placeholders and drop the unused one c93a24f786

(cherry picked from commit f6207ff2b0)

rock added 1 commit 2026-10-06 02:05:52 +00:00

Merge origin/main into fix/secrets-placeholders (rebuild ksops file list, fix #54 indent) f780e31f9c

rock merged commit 719fa77521 into main

2026-10-06 04:48:54 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#55