rock
e335694cbb
Two defects in the ksops generator: 1. The `zitadel-masterkey.enc.yaml` entry was added with two-space indentation while every other entry uses four. YAML rejected the list, and kustomize reported it as `loading generator plugins ... MalformedYAMLError: yaml: line 39`. That failed the whole sops-secrets application, so no Secret in that app could be created. Verified by running the same kustomize build inside argocd-repo-server: exit 1 before the fix, exit 0 with 33 manifests after it. 2. The masterkey value was generated during the first verification pass and appeared in that session's output. Rotate it now, before the instance exists: a fresh 32-byte value, SOPS-encrypted, with the offline copy updated. No ZITADEL data exists yet, so rotation costs nothing. After the first sync it would mean re-encrypting system.encryption_keys. The offline copy lives outside the repo at ~/zitadel-masterkey.offline (0600).
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
apiVersion: viaduct.ai/v1
|
|
kind: ksops
|
|
metadata:
|
|
name: sops-secret-generator
|
|
annotations:
|
|
config.kubernetes.io/function: |
|
|
exec:
|
|
path: ksops
|
|
files:
|
|
- agent-pod-models.enc.yaml
|
|
- agent-pod-ssh-key.enc.yaml
|
|
- authentik-secrets.enc.yaml
|
|
- cloudflare-secrets.enc.yaml
|
|
- forgejo-registry-pat-api.enc.yaml
|
|
- forgejo-registry-pull.enc.yaml
|
|
- forgejo-runner-token.enc.yaml
|
|
- forgejo-secrets.enc.yaml
|
|
- grafana-oidc-secrets.enc.yaml
|
|
- grafana-secrets.enc.yaml
|
|
- homarr-auth-oidc.enc.yaml
|
|
- homarr-db-encryption.enc.yaml
|
|
- homarr-secrets.enc.yaml
|
|
- homelab-ca-secrets.enc.yaml
|
|
- loki-secrets.enc.yaml
|
|
- minio-secrets.enc.yaml
|
|
- paperless-secrets.enc.yaml
|
|
- vault-secrets.enc.yaml
|
|
- vault-unseal-keys.enc.yaml
|
|
- portfolio-secrets.enc.yaml
|
|
- gotify-admin-secrets.enc.yaml
|
|
- gotify-tokens-secrets.enc.yaml
|
|
- gotify-smtp-secrets.enc.yaml
|
|
- forgejo-smtp-secrets.enc.yaml
|
|
- paperless-ai-secrets.enc.yaml
|
|
- memory-agent-oidc.enc.yaml
|
|
- oauth2-credentials.enc.yaml
|
|
- forgejo-registry-token.enc.yaml
|
|
- pi-sandbox-secrets.enc.yaml
|
|
- etcd-defrag-creds.enc.yaml
|
|
- zitadel-masterkey.enc.yaml
|