From 2623eecfcab46d2029ae88ac3ee443c869ddca25 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:08:02 -0700
Subject: [PATCH] feat(argocd): SOPS CMP plugin decryption for Stage 0 secrets
 (simplify to directory source)

---
 k8s/argocd/apps/00-secrets.yaml           | 25 ++++++++++++++++++
 k8s/argocd/bootstrap/sops-cmp-generate.sh | 32 +++++++++++++++++++++++
 k8s/platform/logging/grafana-values.yaml  |  9 ++++---
 k8s/security/sops-secrets/.gitkeep        |  0
 k8s/security/sops-secrets/00-README.md    |  6 +++++
 5 files changed, 69 insertions(+), 3 deletions(-)
 create mode 100644 k8s/argocd/apps/00-secrets.yaml
 create mode 100755 k8s/argocd/bootstrap/sops-cmp-generate.sh
 create mode 100644 k8s/security/sops-secrets/.gitkeep
 create mode 100644 k8s/security/sops-secrets/00-README.md

diff --git a/k8s/argocd/apps/00-secrets.yaml b/k8s/argocd/apps/00-secrets.yaml
new file mode 100644
index 0000000..a56d0e7
--- /dev/null
+++ b/k8s/argocd/apps/00-secrets.yaml
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-secrets
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  syncOptions:
+    - CreateNamespace=true
+  source:
+    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/security/sops-secrets
+    directory: {}
+  destination:
+    server: https://kubernetes.default.svc
diff --git a/k8s/argocd/bootstrap/sops-cmp-generate.sh b/k8s/argocd/bootstrap/sops-cmp-generate.sh
new file mode 100755
index 0000000..61d6d6f
--- /dev/null
+++ b/k8s/argocd/bootstrap/sops-cmp-generate.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
+
+# Decrypt grafana secrets once
+GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)
+
+# Stage 0: grafana
+OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
+ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')
+
+cat <<EOF
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc
+  namespace: logging
+type: Opaque
+data:
+  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: logging
+type: Opaque
+data:
+  admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
+EOF
diff --git a/k8s/platform/logging/grafana-values.yaml b/k8s/platform/logging/grafana-values.yaml
index 68a494b..70c2af1 100644
--- a/k8s/platform/logging/grafana-values.yaml
+++ b/k8s/platform/logging/grafana-values.yaml
@@ -2,8 +2,8 @@
 # Grafana — dashboarding and log/metrics exploration UI.
 # Deployed in the logging namespace alongside Loki and Promtail.
 #
-# Secrets never set here:
-#   adminPassword        — injected via helmfile --set (GRAFANA_ADMIN_PASSWORD)
+# Secrets provided by ArgoCD SOPS CMP plugin:
+#   adminPassword        — mounted from the grafana-admin K8s Secret (admin.existingSecret)
 #   OAuth client secret  — mounted from the grafana-oidc K8s Secret (envFromSecret below)
 
 replicas: 1
@@ -14,9 +14,12 @@ deploymentStrategy:
   type: Recreate
 
 podAnnotations:
-  secret.reloader.stakater.com/reload: "grafana-oidc"
+  secret.reloader.stakater.com/reload: "grafana-oidc,grafana-admin"
 
 adminUser: admin
+admin:
+  existingSecret: grafana-admin
+  existingSecretKey: admin-password
 
 resources:
   requests:
diff --git a/k8s/security/sops-secrets/.gitkeep b/k8s/security/sops-secrets/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/k8s/security/sops-secrets/00-README.md b/k8s/security/sops-secrets/00-README.md
new file mode 100644
index 0000000..942cf5d
--- /dev/null
+++ b/k8s/security/sops-secrets/00-README.md
@@ -0,0 +1,6 @@
+# SOPS-Decrypted Secrets
+
+Placeholder for CMP-generated secrets (pending full CMP plugin setup).
+
+Currently, manually-created Secrets live in individual namespaces (e.g., grafana-admin in logging/).
+Once the CMP plugin is wired, this Application will decode *.enc.yaml and emit all Secrets here.