k8s/argocd/secrets/secret-generator.yaml

apiVersion: viaduct.ai/v1
kind: ksops
metadata:
  name: sops-secret-generator
  annotations:
    config.kubernetes.io/function: |
      exec:
        path: ksops
files:
  - agent-pod-models.enc.yaml
  - agent-pod-ssh-key.enc.yaml
  - authentik-secrets.enc.yaml
  - cloudflare-secrets.enc.yaml
  - forgejo-registry-pat.enc.yaml
  - forgejo-registry-pull.enc.yaml
  - forgejo-runner-token.enc.yaml
  - forgejo-secrets.enc.yaml
  - grafana-oidc-secrets.enc.yaml
  - grafana-secrets.enc.yaml
  - homarr-auth-oidc.enc.yaml
  - homarr-db-encryption.enc.yaml
  - homarr-secrets.enc.yaml
  - homelab-ca-secrets.enc.yaml
  - loki-secrets.enc.yaml
  - minio-secrets.enc.yaml
  - paperless-secrets.enc.yaml
  - vault-secrets.enc.yaml
  - vault-unseal-keys.enc.yaml
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`apiVersion: viaduct.ai/v1`
			`kind: ksops`
			`metadata:`
			`name: sops-secret-generator`
			`annotations:`
			`config.kubernetes.io/function: \|`
			`exec:`
			`path: ksops`
			`files:`
fix(agent-pod): remote tui session for multi-agent 2026-08-18 14:23:55 -07:00			`- agent-pod-models.enc.yaml`
			`- agent-pod-ssh-key.enc.yaml`
fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError) 2026-08-18 15:08:04 -07:00			`- authentik-secrets.enc.yaml`
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`- cloudflare-secrets.enc.yaml`
Add Forgejo registry PAT secret (encrypted with SOPS, ksops managed) 2026-08-23 16:15:26 -07:00			`- forgejo-registry-pat.enc.yaml`
feat: let the runner build and the cluster pull from the Forgejo registry 2026-08-19 21:48:01 -07:00			`- forgejo-registry-pull.enc.yaml`
feat(forgejo): add runner-token Secret via ksops — forgejo-runner register initContainer needs the registration token (from gitea actions generate-runner-token); was missing so runner deploy stuck 0/1 2026-08-12 16:19:38 -07:00			`- forgejo-runner-token.enc.yaml`
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`- forgejo-secrets.enc.yaml`
			`- grafana-oidc-secrets.enc.yaml`
			`- grafana-secrets.enc.yaml`
fix(homarr): add auth-oidc-secret + db-encryption Secrets via ksops — homarr chart's envSecrets expect these exact names (oidc-client-id/secret, db-encryption-key); were never created so homarr CreateContainerConfigError 2026-08-12 14:08:18 -07:00			`- homarr-auth-oidc.enc.yaml`
			`- homarr-db-encryption.enc.yaml`
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`- homarr-secrets.enc.yaml`
			`- homelab-ca-secrets.enc.yaml`
fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError) 2026-08-18 15:08:04 -07:00			`- loki-secrets.enc.yaml`
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`- minio-secrets.enc.yaml`
feat: add paperless-ngx with OIDC, CNPG db, cp-3 HDD media, MinIO backup 2026-08-25 11:11:37 -07:00			`- paperless-secrets.enc.yaml`
refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments 2026-08-12 13:16:15 -07:00			`- vault-secrets.enc.yaml`
fix: deploy authentik/loki/vault Secrets via ksops (were dead helm-values fragments, causing CreateContainerConfigError) 2026-08-18 15:08:04 -07:00			`- vault-unseal-keys.enc.yaml`