From 2ec6eba9d23558f965b09e5c8a4421bdc6cdbf39 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 20 Jul 2026 22:55:23 -0700
Subject: [PATCH] =?UTF-8?q?fix(sops-cmp):=20correct=20loki=20s3=20path=20(?=
 =?UTF-8?q?.loki.storage.s3),=20emit=20authentik-secrets=20separately,=20d?=
 =?UTF-8?q?rop=20broken=20discover=20=E2=80=94=20merge=20via=20server/work?=
 =?UTF-8?q?er/migrate=20envFrom?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Loki keys are under .loki.storage.s3 not .loki.s3 (returned null). Emit a separate
authentik-secrets Secret (not 'authentik', which the Helm chart owns) and merge it
via envFrom on server/worker/migrate. Remove discover fileName (caused MatchRepository
timeouts; app names the plugin explicitly).
---
 k8s/security/ci-cd/sops-cmp-plugin.yaml | 10 +++++-----
 k8s/security/iam/authentik-values.yaml  | 11 +++++++++++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/k8s/security/ci-cd/sops-cmp-plugin.yaml b/k8s/security/ci-cd/sops-cmp-plugin.yaml
index 57db161..bb40815 100644
--- a/k8s/security/ci-cd/sops-cmp-plugin.yaml
+++ b/k8s/security/ci-cd/sops-cmp-plugin.yaml
@@ -22,8 +22,6 @@ data:
         command: [sh, -c]
         args:
           - /home/argocd/plugins/generate.sh
-      discover:
-        fileName: "./*.sops-marker"
   generate.sh: |
     #!/bin/sh
     set -eu
@@ -45,8 +43,10 @@ data:
     }
 
     # ── authentik (iam) ────────────────────────────────────────────────
+    # Separate secret (authentik-secrets) merged via envFrom AFTER the chart's
+    # own `authentik` config secret — avoids two ArgoCD apps owning `authentik`.
     DEC="$(sops -d "$REPO_ROOT/k8s/security/iam/authentik-secrets.enc.yaml")"
-    emit_secret iam authentik \
+    emit_secret iam authentik-secrets \
       AUTHENTIK_SECRET_KEY=.authentik.secret_key \
       AUTHENTIK_BOOTSTRAP_PASSWORD=.authentik.bootstrap_password \
       AUTHENTIK_BOOTSTRAP_TOKEN=.authentik.bootstrap_token \
@@ -55,8 +55,8 @@ data:
     # ── loki S3 (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/loki-secrets.enc.yaml")"
     emit_secret logging loki-s3-creds \
-      access_key_id=.loki.s3.accessKeyId \
-      secret_access_key=.loki.s3.secretAccessKey
+      access_key_id=.loki.storage.s3.accessKeyId \
+      secret_access_key=.loki.storage.s3.secretAccessKey
 
     # ── grafana (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")"
diff --git a/k8s/security/iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml
index d70a30b..73c998a 100644
--- a/k8s/security/iam/authentik-values.yaml
+++ b/k8s/security/iam/authentik-values.yaml
@@ -92,6 +92,10 @@ _caInitContainers: &caInitContainers
     envFrom:
       - secretRef:
           name: authentik
+      # SOPS-CMP-emitted secret values (SECRET_KEY, PG password, bootstrap creds)
+      # merged after the chart config secret — see sops-cmp-plugin.yaml.
+      - secretRef:
+          name: authentik-secrets
     volumeMounts: *caVolumeMounts
 
 _caEnv: &caEnv
@@ -107,6 +111,10 @@ _caEnv: &caEnv
 # Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
 server:
   replicas: 1
+  # Merge SOPS-CMP-emitted secret values after the chart's own `authentik` secret.
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   service:
@@ -145,6 +153,9 @@ server:
 # into the server process but the worker pod is still required.
 worker:
   replicas: 1
+  envFrom:
+    - secretRef:
+        name: authentik-secrets
   deploymentStrategy:
     type: Recreate
   resources: