rock
e335694cbb
Two defects in the ksops generator: 1. The `zitadel-masterkey.enc.yaml` entry was added with two-space indentation while every other entry uses four. YAML rejected the list, and kustomize reported it as `loading generator plugins ... MalformedYAMLError: yaml: line 39`. That failed the whole sops-secrets application, so no Secret in that app could be created. Verified by running the same kustomize build inside argocd-repo-server: exit 1 before the fix, exit 0 with 33 manifests after it. 2. The masterkey value was generated during the first verification pass and appeared in that session's output. Rotate it now, before the instance exists: a fresh 32-byte value, SOPS-encrypted, with the offline copy updated. No ZITADEL data exists yet, so rotation costs nothing. After the first sync it would mean re-encrypting system.encryption_keys. The offline copy lives outside the repo at ~/zitadel-masterkey.offline (0600).
24 lines
1.2 KiB
YAML
24 lines
1.2 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: zitadel-masterkey
|
|
namespace: iam
|
|
type: Opaque
|
|
stringData:
|
|
masterkey: ENC[AES256_GCM,data:Da543Jt48o6p3f6/AbZRsjChz3NexPJoi/mC/LB6jUI=,iv:irS0n76tZ6QzoQMm0dWrvbw+SPfXz4h13jQb/Bjfgwg=,tag:tfbgaAdxmPIjleB1OXLn0Q==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZld2VG9NaFhIVWpBcGpO
|
|
SmVwNm9FT2wrQmFKb0RGQmY4TCtITjFEZjBjCmNuNXNJYTdsZE44cDNzR2hiNTdy
|
|
QWlVdzBtdjd0cSsxUjQxMzNyblhWTkkKLS0tIHBLT2x1MDBGdjE1eHFOdHVGa1NO
|
|
ZGM1K2lDTksraFdPeFdSZ1JyU1VtcjAKgTjjhr7u4YRuQVZQ7kAa1clJ0Rzy10hQ
|
|
Umcd4/YStyXHZjsJJpFSpOFdP5cZscGo3xBgpXtxAscKTS1Nw4derg==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
|
encrypted_regex: ^(data|stringData)$
|
|
lastmodified: "2026-10-25T01:24:21Z"
|
|
mac: ENC[AES256_GCM,data:QFVk7KLsMLCAMH/PHVGCRyfU3k2JiO8AE3jJXmhnlUB4C8MYCTyOWQbnTFXozCMOr0kp+hAt3dYn/e23SWhyvJ7BgVLRb5QF1py704Dr46atVoLUvwHpFI7dyGK/LDTxqiM40RXAnDtWUJlTkVCzKdSFiV8CokIoByKWwxFPayM=,iv:t7HWMcpQl/DJ8Rp51Du7b5gURZO+C+FodsZSJuy5jBc=,tag:qEXSS4S0Y5cvn7T6EjakhA==,type:str]
|
|
version: 3.13.2
|