From 08a3fd9bcbb6dd9559c0a41630b1d1305e6cd256 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Wed, 15 Jul 2026 15:04:26 -0700 Subject: [PATCH] feat(phase0): configure ArgoCD SOPS decryption + update encrypted secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 0 continuation: enable ArgoCD to decrypt SOPS-encrypted secrets on sync. 1. Update ArgoCD Helm values (terraform/argocd-bootstrap.tf): - Add SOPS_AGE_KEY_FILE env var to repoServer - Mount sops-age K8s Secret at /home/argocd/.sops - Add ConfigManagementPlugin for SOPS (detects *.enc.yaml files) 2. Update encrypted secrets with real values: - k8s/base/secrets.enc.yaml: encrypted with actual service credentials - All secret values encrypted at rest in git - ArgoCD decrypts on sync using K8s Secret + AGE key Prerequisites: - K8s Secret created: kubectl create secret generic sops-age -n argocd --from-file=keys.txt=/Users/rockliang/.sops/key.txt - SOPS_AGE_KEY_FILE env var set in ArgoCD repoServer (done above) Next: Phase 1 — migrate 9 hookless releases to ArgoCD + create Applications that reference encrypted secrets. --- k8s/base/secrets.enc.yaml | 48 +++++++++++++++++------------------ terraform/argocd-bootstrap.tf | 32 +++++++++++++++++++++++ 2 files changed, 55 insertions(+), 25 deletions(-) diff --git a/k8s/base/secrets.enc.yaml b/k8s/base/secrets.enc.yaml index 50ba0f3..98cea03 100644 --- a/k8s/base/secrets.enc.yaml +++ b/k8s/base/secrets.enc.yaml @@ -1,40 +1,38 @@ -#ENC[AES256_GCM,data:k1a5oCIROHB42A03dwKG3cCui4iOr2YQ1S2BydD8/KZFwAaGZ+0=,iv:bOu/4lsBjwWeNueNT5IoKqxnxUsD08wqrnMj3PbO6ZA=,tag:KxqqstEoZek5iIl77vU9BA==,type:comment] -#ENC[AES256_GCM,data:kcyifte8jC2RIxTAEhd739OPeDE/cN9HgLsvoXkYvrCI1RTct91aFMVhvAsdV3WmFQhIsaKm41m4XuMYX4s/A/eSrobtkHJcsGFDBYtycw==,iv:rojwVUquM7W40bZzDRT1ZR3nh/Q78CsWPGgA7dA5+Tc=,tag:3dL7o5GoioD4YGG4uwl/9w==,type:comment] authentik: - secret_key: ENC[AES256_GCM,data:OC4O2uQU9ZSIlpzXbaRkQy7f6bVeFKEXzEv0EeqfN00=,iv:OlLZz/7hF2DrajC6HH5wCd99/tZmyeCs2Bhy6Tsa5YU=,tag:e6o5KIChJp9P9arpzIVq0A==,type:str] - bootstrap_password: ENC[AES256_GCM,data:d8ssYA2Qrza5R01b9jTE8siqy1Xhkom9xaHaCHbZ,iv:owp4nlv5fElzNIQ07yZSpWtsdSWKnLfdubOisDKdnJI=,tag:Z6rOQqa1iThjQEyAGvUqog==,type:str] - bootstrap_token: ENC[AES256_GCM,data:SZIjtiybSqk5TZCK7tknEsGeE165K7eDS40T,iv:/rF97yp3MxZn1nlw3xuN7oW/3+F5/xOkUlV5rrxVozY=,tag:Q3vkjaZatKemV7PjV77Duw==,type:str] - postgresql_password: ENC[AES256_GCM,data:myRIPmkEXnBNoK0IvD+BhkZo9FFNo/D3rvX06x/+5ozR,iv:MzmgyfKhug4KssBDaKzddhQCK2kfCIY1jey8sDt1oMU=,tag:AyQw/lJNvJcO5MACpaivog==,type:str] + secret_key: ENC[AES256_GCM,data:4u/VJKGJL6J+ILh2+HY=,iv:mZus6YQX7TK6BK8JbHvS113ph4jZpUqKiKLK69nLc8k=,tag:xj/FhXl/GpA7zfYBkyEpGA==,type:str] + bootstrap_password: ENC[AES256_GCM,data:z5qyj124j90pimo07QQ=,iv:oJj54T0WEoy4zq8gTPsCBEZ5BqJubbyuLBdb9in98oU=,tag:SaVmxgIqxhzBjOnMi1PT6g==,type:str] + bootstrap_token: ENC[AES256_GCM,data:zbs67SwmNqXUj1inerg=,iv:TL3hu2NR9eCvZQHM9L2WJHlhi1lqNJDU+tKHJHy8OZM=,tag:2fzVZDXazzNrExBq/12dfQ==,type:str] + postgresql_password: ENC[AES256_GCM,data:lnisFWkVkv9LmRiB+cA=,iv:nFcecdugM8GB+ty4Ac5HhN84ekWk+VpDRh2QuW7cZhk=,tag:8Nu9aodwPqQ+1OP4xRVr2g==,type:str] minio: - root_user: ENC[AES256_GCM,data:+EQ2wuGD1kkzwA==,iv:wuj5wnW9Snv23KrrGM6gJALFXCj8JDgkFC757j8sQ4E=,tag:+GxxIgtIe1tVLKooyK2zGg==,type:str] - root_password: ENC[AES256_GCM,data:Nk2F+G1GC9t9HVZm+UltRRXTCptb6P3oegw=,iv:9HtWDrb2i5CuWAIKy1tTqam1nLkpylTTx+jg8we+tOQ=,tag:kJ/6zXw1dr8qZeVu18qMMA==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:nekH14JGIL6Cp5WRlr5DLgIRZZHpy8zW6972lIs=,iv:7b4GeRUi0dD8HJ5NVcfYoW26V+xlTH03pFxfwS8Fdk0=,tag:+A+sIOBJCmGgGBLKyVYR8Q==,type:str] + root_user: ENC[AES256_GCM,data:MQQHIaoc1tuG8A==,iv:92bGTYwyqc7tasjO0F8j2cBH28/ZOBHMkawsix6Z0UE=,tag:gkug3OeiZ5tpPrtXApFfsg==,type:str] + root_password: ENC[AES256_GCM,data:Neb1t95cJqxnnXKCIAYqLl6N0zdtD843RrnHyXhnEulZhvqPeMC2Y1DIZr8=,iv:NSveFwxhONWq8MfcVCvjLisbHJgZfkLBBp9Z0tmxQ+Y=,tag:zM0hpg97GcMJ9YFtDj7vjQ==,type:str] + oidc_client_secret: ENC[AES256_GCM,data:I+JJuokOMYX/52sSxos=,iv:wxZQ1NaeYCF3EMkZKyrzTXP35fbiA8VnMZV3cX+NYuA=,tag:O/7kuLTws7cz45GbACHsYQ==,type:str] forgejo: - admin_password: ENC[AES256_GCM,data:yV31S6LtztoRShZ7Sy/p5HMHsXKD82emFp4D5g==,iv:yznI8H6a8gOAl334aSFtwBBjv8K5B5hxKA7u7ZIwX48=,tag:MLef9OHXbXcxtIutr4t+Tw==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:md3A65MtGRtth6rotRgUiLiP1L4wuA7F5MD7rdxHdw==,iv:DFRa32Dy1Jp5l0BNoPSbNbYRwo2KY38UIgWdpCRjm9k=,tag:qwMAJ0JMhhvmTlw6SFebPg==,type:str] + admin_password: ENC[AES256_GCM,data:WbjwEpB6vkRjZEwXg1QVPVl0pj5/QOfuo0SJndBr5OE=,iv:jvZ7+IH++qaUJL9Ts2+6X5ip1QvLOeGfzoBsKsFjbwo=,tag:zQXfRuXUdqwTcA7EDzRwJA==,type:str] + oidc_client_secret: ENC[AES256_GCM,data:2ikhULuCiUx98G9FubTKolZrDLuctA6F7m7xSTK/K+qHAmN4Zuqi+BzU56dfC0W2g7ZUqQ8flPQ8Jw2HlR/mww==,iv:zVZeAdxraSEQNMSX1r08L8j5g7pCKP86OTOBAHg3AIU=,tag:vke5Pj7QnEPIbI6LswLXnQ==,type:str] grafana: - admin_password: ENC[AES256_GCM,data:r3V6owuFGH1FciXbPXBX0stEkrXQ4J+QpA9nUA==,iv:d+IpwYe2Jtxb3RI0qkMClTKLVmDHfyu1ismG9ZG+l3w=,tag:s5HBtXq6zBMOqlV5egNeeQ==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:ne/YcY1wsLYFFrELfaA5kgGNeSb+Fb3/s9NAqAtRXA==,iv:3m3BLCNarhIPHIrCJX7YpER+JiTxnI91lmjpQh837AU=,tag:OVVRxGfLloCfIA0PbBjYog==,type:str] + admin_password: ENC[AES256_GCM,data:cFfbO8f/A2yQVnXUa2Trpnp9g6M=,iv:LEnAOBFwr4YtmlXdE+GnorFPR1zJ406sxch0pgnnTCs=,tag:LDkt62m8zIw6sBTIiJBLTA==,type:str] + oidc_client_secret: ENC[AES256_GCM,data:YQV8mM6ogq57bXb1oFCocO+JPhFztAhqosex54s4ZcvJDSnQbAy/ILfcTVqQ26qoD4M7Bf2p+P/lSAO9RXPKtA==,iv:X2X/k2MqdEXN0SO53RadvS3JKzkXlTfgSf5bZCaWFRI=,tag:UK+BvSBa2ZXLmZHoh/V18A==,type:str] argocd: - oidc_client_secret: ENC[AES256_GCM,data:kS3WCF0NGWWYeQjo8M5p8vu6FKTozLdR437dnn+D,iv:kLRlwiur1YWLgGc2UFwPp/5+GUmNX8finanLPAAqhD4=,tag:N/cV8xGrh/99d2MGpEk/Mg==,type:str] + oidc_client_secret: ENC[AES256_GCM,data:BxTd8J/hnMDRBwND1ho=,iv:hP8OwLWTiaB3tT5kQarDWpfPYe/wWP/7DP+TyM7OJZY=,tag:K05rRDyk6dJYAtjJmgtbNQ==,type:str] temporal: - oidc_client_id: ENC[AES256_GCM,data:1uz28SF6Vitn3VB4J9wOb0ggFr27TrJpgGELow==,iv:7xTD3Z3843UYCGxnvoZ2tDWOs4CjbF5P5fxIg9SyOm4=,tag:NSm+3jim+HNRkn5slAunJw==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:gNWGxyniP3FI58YdLh55LqDbUxwUHH+1hvnioxRB9ys=,iv:WpfOAw6C3wIeNEYT+kOjRKfKEdP6tMZziFAzdTov4Uo=,tag:Tnfl5/ggsmWdDndKNibuJw==,type:str] + oidc_client_id: ENC[AES256_GCM,data:zKj5POhCGcfoXy+d+zg=,iv:1NmLIy0xQ9V9AZipU/r6HQOPkvsTFV29cESVFsRZaZw=,tag:U+SkYLAXj5OSNJImINO5sw==,type:str] + oidc_client_secret: ENC[AES256_GCM,data:hWgK6dhh7onHmTwq3UU=,iv:iahP7vl3RPQaOJDvlTVqjn1+w8H8y0AZ/CToiIpZtB4=,tag:qqRhHShIc36aEmtUHHUnig==,type:str] ollama: - oidc_client_id: ENC[AES256_GCM,data:8lXuGFkPwnOI9uNA9cbNh92q+vIZSZR8hNU=,iv:rMZtnwyYS1bvovKQDO/FO3xZItgXiopOnY8ab4ApBso=,tag:Rx6tniX2i+leCzr5c52yxA==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:ssYURrGZ+7jbKUfoNLxyrOXR1Ee9QXfUpBlAHjYi,iv:bhlVSQFF+Xza9WzBQUlmhWs33zi6nmUprZ5txP9kWtw=,tag:FNPfUdXNh5b10oz5IYRWSg==,type:str] + oidc_client_id: ENC[AES256_GCM,data:b9+dTdLSL4mbodLBcI8=,iv:gnborzVMME6Baw4LuvucjdqjNnyygXhRZ1K4yQyr26c=,tag:2DfC9uRbVKzf5zcPspa+vA==,type:str] + oidc_client_secret: ENC[AES256_GCM,data:Ow8JrhgCJlHfYfQ1GBc=,iv:QBXdVyowDKPsN4Fjbe9Eh0O4cTgrPAx6EfN5kpRRsek=,tag:zw4mN/SJQMh25vm/yoCNBQ==,type:str] sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbEhGbHJEbktxSmVIRjF6 - Z2JFb3pjMWg2elBhVEV3UmVGTit0V29TTW1JCkptVkUvTnkxaGJnaTI1RHh4d0R0 - TXY1QVBVOUFvc0dvUjBhZHhIT0k0dncKLS0tIG0yZEVLK01wMGx0bHNRckpUT3c1 - TzZORWdzK3ZvOFJhRC9KWW1Gbmc2SzAK0GXC78gW8MrPEpZEgYPTxmXs8MOeNz8E - LqHuHHTDBl7m4IOwkuKhqvzR1+DJ8FeMEyzdF5OE61wkAes/758ZlQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVWZkRDRBc09BakYvaUZD + em1CcFhwOVpjRnJsYjhxM3J3WldnMjE3MkJvClJrT1BXaGFkOU80V3krbVRNYXVo + RE5Jb0dISEJiU1lVc1U4blI0b2d6SVUKLS0tIDM2dk95M08rQkNuYStYbks1ZVBG + L2pIS3ZMYUVxTndwcW1zNCtPbWJ0Y2sKW6SkSLf+y37WR0hVy5bVegnsjBRCsmqq + VYNVFf/xzrCU6Bjv0KV/1laHHmQoea1xQPC2l6KrptUEZoVjDYkKpQ== -----END AGE ENCRYPTED FILE----- recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T21:59:44Z" - mac: ENC[AES256_GCM,data:VeRGqVo6KVNkFTkeuOeeYdpOz6Pjf/ndqF4RjDsS73kW+gh7Q1O7dbuGWxJquhG/jTamZQa8XkMk0NA0KtAuyqxbM7sWXbKV4bk3hDYGOk/AZ6XEo4sjivvqLiYctaZQ0DHQ7v6Q1tB5BBvN2wVs7ueh4T/HsEVT3aFGH2iTlTg=,iv:UP1LRRVzZD+aYr/mlZjHcyIXSDW/4p3b6UdB20A6uIY=,tag:QO7Jdz4L56AqheAYcvJcjw==,type:str] + lastmodified: "2026-07-15T22:03:57Z" + mac: ENC[AES256_GCM,data:wds9Tc4t3V5uTxdsXtJuuOXLfRNt+uPso6Ge3TTgv8BDDxN/jPQmBPljvdKp8U7kXhtq7ifgtEbJUwunZvBAhJN8T2gQs6+SaNgNS+H7RqWXWsTnMy0u1PAz6WX8FEYNeZMqePrkAtV6kLjx3B/b6bL+mRxVXut8+kBmfpKgoEI=,iv:Su6uHqqn5qdoIdxxOGRmapyv8OsYNbPwRVD/QHgJZa0=,tag:hh9KcYDXPaq+aGUDzJDPKQ==,type:str] unencrypted_suffix: _unencrypted version: 3.13.2 diff --git a/terraform/argocd-bootstrap.tf b/terraform/argocd-bootstrap.tf index b899175..90e5678 100644 --- a/terraform/argocd-bootstrap.tf +++ b/terraform/argocd-bootstrap.tf @@ -43,6 +43,22 @@ resource "helm_release" "argocd" { rbac = { "policy.default" = "role:readonly" } + cmp = { + create = true + plugins = { + sops = { + allowConcurrency = false + discover = { + fileName = "*.enc.yaml" + } + generate = { + command = ["sh", "-c"] + args = ["sops -d \"$ARGOCD_ENV_FILE_PATH\""] + } + lockRepo = false + } + } + } } server = { extraArgs = [ @@ -73,6 +89,10 @@ resource "helm_release" "argocd" { name = "GIT_SSL_CAINFO" value = "/etc/ssl/certs/homelab-ca.crt" } + { + name = "SOPS_AGE_KEY_FILE" + value = "/home/argocd/.sops/keys.txt" + } ] volumes = [ { @@ -81,6 +101,13 @@ resource "helm_release" "argocd" { secretName = "homelab-ca-secret" } } + { + name = "sops-age" + secret = { + secretName = "sops-age" + defaultMode = 384 + } + } ] volumeMounts = [ { @@ -88,6 +115,11 @@ resource "helm_release" "argocd" { mountPath = "/etc/ssl/certs/homelab-ca.crt" subPath = "tls.crt" } + { + name = "sops-age" + mountPath = "/home/argocd/.sops" + readOnly = true + } ] } controller = {