homelab/k8s/security/ci-cd/sops-cmp-plugin.yaml

# ConfigMap holding the SOPS CMP plugin spec + generate script. Mounted into the
# repo-server sidecar at /home/argocd/cmp-server/config/plugin.yaml (the path the
# argocd-cmp-server binary reads) and /home/argocd/plugins/generate.sh.
#
# The plugin decrypts every k8s/**/*secrets*.enc.yaml Helm-values fragment and
# emits correctly-keyed Kubernetes Secrets to stdout — no helm template inside
# the plugin. Applied to the argocd namespace (bootstrap resource).
apiVersion: v1
kind: ConfigMap
metadata:
  name: sops-cmp-plugin
  namespace: argocd
data:
  plugin.yaml: |
    apiVersion: argoproj.io/v1alpha1
    kind: ConfigManagementPlugin
    metadata:
      name: sops-secrets
    spec:
      version: v1.0
      generate:
        command: [sh, -c]
        args:
          - /home/argocd/plugins/generate.sh
  generate.sh: |
    #!/bin/sh
    set -eu
    export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
    # CMP runs with cwd = the app source path; sops-secrets app points at repo
    # root, so enc files resolve from the current directory.
    REPO_ROOT="$(pwd)"

    emit_secret() {
      # $1 ns  $2 name  then key=jqpath pairs read from decrypted $ENC
      ns="$1"; name="$2"; shift 2
      printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: %s\n  namespace: %s\ntype: Opaque\ndata:\n' "$name" "$ns"
      for kv in "$@"; do
        k="${kv%%=*}"; path="${kv#*=}"
        val="$(echo "$DEC" | yq -r "$path")"
        printf '  %s: %s\n' "$k" "$(printf '%s' "$val" | base64 -w0)"
      done
      printf -- '---\n'
    }

    # ── authentik (iam) ────────────────────────────────────────────────
    # Separate secret (authentik-secrets) merged via envFrom AFTER the chart's
    # own `authentik` config secret — avoids two ArgoCD apps owning `authentik`.
    DEC="$(sops -d "$REPO_ROOT/k8s/security/iam/authentik-secrets.enc.yaml")"
    emit_secret iam authentik-secrets \
      AUTHENTIK_SECRET_KEY=.authentik.secret_key \
      AUTHENTIK_BOOTSTRAP_PASSWORD=.authentik.bootstrap_password \
      AUTHENTIK_BOOTSTRAP_TOKEN=.authentik.bootstrap_token \
      AUTHENTIK_POSTGRESQL__PASSWORD=.authentik.postgresql_password

    # ── loki S3 (logging) ──────────────────────────────────────────────
    DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/loki-secrets.enc.yaml")"
    emit_secret logging loki-s3-creds \
      access_key_id=.loki.storage.s3.accessKeyId \
      secret_access_key=.loki.storage.s3.secretAccessKey

    # ── grafana (logging) ──────────────────────────────────────────────
    DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")"
    # grafana chart's admin.existingSecret needs BOTH admin-user and admin-password.
    printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: grafana-admin\n  namespace: logging\ntype: Opaque\ndata:\n  admin-user: %s\n  admin-password: %s\n---\n' \
      "$(printf 'admin' | base64 -w0)" \
      "$(echo "$DEC" | yq -r '.adminPassword' | base64 -w0)"
    emit_secret logging grafana-oidc \
      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET

    # ── vault S3 backend creds (iam) ───────────────────────────────────
    # Vault's s3 storage stanza reads AWS_ACCESS_KEY_ID/SECRET from vault-minio-creds
    # (keys access_key/secret_key). MinIO root creds live in minio-creds' config.env
    # shell exports — parse them out.
    MINIO_ENV="$(sops -d "$REPO_ROOT/k8s/infrastructure/minio/minio-secrets.enc.yaml" \
      | yq -r 'select(.metadata.name=="minio-creds") | .stringData."config.env"')"
    MINIO_AK="$(printf '%s' "$MINIO_ENV" | sed -n 's/.*MINIO_ROOT_USER="\([^"]*\)".*/\1/p')"
    MINIO_SK="$(printf '%s' "$MINIO_ENV" | sed -n 's/.*MINIO_ROOT_PASSWORD="\([^"]*\)".*/\1/p')"
    printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: vault-minio-creds\n  namespace: iam\ntype: Opaque\ndata:\n  access_key: %s\n  secret_key: %s\n---\n' \
      "$(printf '%s' "$MINIO_AK" | base64 -w0)" \
      "$(printf '%s' "$MINIO_SK" | base64 -w0)"