k8s/argocd/secrets/secret-generator.yaml

apiVersion: viaduct.ai/v1
kind: ksops
metadata:
  name: sops-secret-generator
  annotations:
    config.kubernetes.io/function: |
      exec:
        path: ksops
files:
  - authentik-secrets.enc.yaml
  - cloudflare-secrets.enc.yaml
  - forgejo-secrets.enc.yaml
  - grafana-oidc-secrets.enc.yaml
  - grafana-secrets.enc.yaml
  - homarr-secrets.enc.yaml
  - homelab-ca-secrets.enc.yaml
  - minio-secrets.enc.yaml
  - vault-secrets.enc.yaml
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`apiVersion: viaduct.ai/v1`
			`kind: ksops`
			`metadata:`
			`name: sops-secret-generator`
			`annotations:`
			`config.kubernetes.io/function: \|`
			`exec:`
			`path: ksops`
			`files:`
fix(iam): deploy authentik-secrets as kind:Secret via ksops — was a helm-values fragment wired to nothing, so envFrom secretRef authentik-secrets never resolved (CreateContainerConfigError); provides AUTHENTIK_SECRET_KEY/BOOTSTRAP_PASSWORD/BOOTSTRAP_TOKEN 2026-08-12 13:37:39 -07:00			`- authentik-secrets.enc.yaml`
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`- cloudflare-secrets.enc.yaml`
			`- forgejo-secrets.enc.yaml`
			`- grafana-oidc-secrets.enc.yaml`
			`- grafana-secrets.enc.yaml`
			`- homarr-secrets.enc.yaml`
			`- homelab-ca-secrets.enc.yaml`
			`- minio-secrets.enc.yaml`
			`- vault-secrets.enc.yaml`