feat(argocd): SOPS CMP plugin decryption for Stage 0 secrets (simplify to directory source)

k8s/argocd/apps/00-secrets.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-secrets
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  syncOptions:
+    - CreateNamespace=true
+  source:
+    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/security/sops-secrets
+    directory: {}
+  destination:
+    server: https://kubernetes.default.svc

k8s/argocd/bootstrap/sops-cmp-generate.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
+
+# Decrypt grafana secrets once
+GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)
+
+# Stage 0: grafana
+OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
+ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')
+
+cat <<EOF
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc
+  namespace: logging
+type: Opaque
+data:
+  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: logging
+type: Opaque
+data:
+  admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
+EOF

k8s/platform/logging/grafana-values.yaml

@@ -2,8 +2,8 @@
 # Grafana — dashboarding and log/metrics exploration UI.
 # Deployed in the logging namespace alongside Loki and Promtail.
 #
-# Secrets never set here:
-#   adminPassword        — injected via helmfile --set (GRAFANA_ADMIN_PASSWORD)
+# Secrets provided by ArgoCD SOPS CMP plugin:
+#   adminPassword        — mounted from the grafana-admin K8s Secret (admin.existingSecret)
 #   OAuth client secret  — mounted from the grafana-oidc K8s Secret (envFromSecret below)
 
 replicas: 1
@@ -14,9 +14,12 @@ deploymentStrategy:
   type: Recreate
 
 podAnnotations:
-  secret.reloader.stakater.com/reload: "grafana-oidc"
+  secret.reloader.stakater.com/reload: "grafana-oidc,grafana-admin"
 
 adminUser: admin
+admin:
+  existingSecret: grafana-admin
+  existingSecretKey: admin-password
 
 resources:
   requests:

k8s/security/sops-secrets/00-README.md

@@ -0,0 +1,6 @@
+# SOPS-Decrypted Secrets
+
+Placeholder for CMP-generated secrets (pending full CMP plugin setup).
+
+Currently, manually-created Secrets live in individual namespaces (e.g., grafana-admin in logging/).
+Once the CMP plugin is wired, this Application will decode *.enc.yaml and emit all Secrets here.