fix(argocd): wire SOPS CMP sidecar + grafana-admin secret on repo-server

k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml

@@ -11,23 +11,19 @@ data:
     metadata:
       name: sops-secrets-v1.0
     spec:
-      version: v1.0
-      init:
-        command: [sh, -c]
-        args:
-          - |
-            # Install sops if not present
-            if ! command -v sops &> /dev/null; then
-              wget -qO- https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 > /usr/local/bin/sops
-              chmod +x /usr/local/bin/sops
-            fi
       generate:
         command: [sh, -c]
         args:
           - |
-            # Find all .enc.yaml files and decrypt them
+            # Find all .enc.yaml files and decrypt them, separating multi-doc output.
+            # Skip files that aren't full K8s manifests (no top-level "kind:") — some
+            # .enc.yaml files hold raw Helm values, not standalone Secret objects.
             find . -name '*.enc.yaml' -type f | while read -r file; do
-              sops -d "$file"
+              decrypted=$(sops -d "$file")
+              if echo "$decrypted" | grep -q '^kind:'; then
+                echo "---"
+                echo "$decrypted"
+              fi
             done
       discover:
         find:

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -45,7 +45,7 @@ repoServer:
       cpu: 100m
       memory: 256Mi
     limits:
-      cpu: 500m
+      cpu: 1000m
       memory: 1Gi
 
   # Tolerations for control-plane
@@ -54,6 +54,61 @@ repoServer:
       operator: Exists
       effect: NoSchedule
 
+  # Fetch sops binary into shared emptyDir (runs as root; main containers can't write /usr/local/bin)
+  initContainers:
+    - name: install-sops
+      image: alpine:3.20
+      command: [sh, -c]
+      args:
+        - |
+          wget -qO /sops-bin/sops https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64
+          chmod +x /sops-bin/sops
+      volumeMounts:
+        - mountPath: /sops-bin
+          name: sops-bin
+
+  # SOPS CMP sidecar (decrypts *.enc.yaml via argocd-cmp-cm ConfigMap plugin)
+  extraContainers:
+    - name: sops-secrets-v1
+      command: [/var/run/argocd/argocd-cmp-server]
+      image: quay.io/argoproj/argocd:v3.4.5
+      env:
+        - name: SOPS_AGE_KEY_FILE
+          value: /sops-age/key.txt
+        - name: PATH
+          value: /sops-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+      volumeMounts:
+        - mountPath: /var/run/argocd
+          name: var-files
+        - mountPath: /home/argocd/cmp-server/plugins
+          name: plugins
+        - mountPath: /tmp
+          name: cmp-tmp
+        - mountPath: /home/argocd/cmp-server/config/plugin.yaml
+          subPath: sops-secrets-v1.0.yaml
+          name: argocd-cmp-cm
+        - mountPath: /sops-age
+          name: sops-age
+          readOnly: true
+        - mountPath: /sops-bin
+          name: sops-bin
+          readOnly: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+
+  volumes:
+    - name: sops-bin
+      emptyDir: {}
+    - name: cmp-tmp
+      emptyDir: {}
+    - name: argocd-cmp-cm
+      configMap:
+        name: argocd-cmp-cm
+    - name: sops-age
+      secret:
+        secretName: sops-age
+
 # Controller configuration
 controller:
   resources: