feat(argocd): wire SOPS CMP sidecar + fix loki/grafana/authentik secret resolution

k8s/platform/logging/grafana-values.yaml

@@ -157,6 +157,18 @@ tolerations:
     operator: Exists
     effect: NoSchedule
 
+# Pin to az-a (talos-cp-1) — the only node running Longhorn. Without this the
+# scheduler may place grafana on cp-2/cp-3, where its Longhorn PVC cannot attach
+# ("CSINode does not contain driver driver.longhorn.io").
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: topology.kubernetes.io/zone
+              operator: In
+              values: [az-a]
+
 # ClusterIP only — access via ingress (grafana.riotpiao.com) or port-forward.
 service:
   type: ClusterIP

k8s/platform/logging/loki-values.yaml

@@ -37,8 +37,10 @@ loki:
       region: us-east-1          # MinIO ignores region but Loki's S3 client requires it
       s3ForcePathStyle: true
       insecure: true
-      access_key_id: ""          # overridden by helmfile --set (MINIO_ROOT_USER)
-      secret_access_key: ""      # overridden by helmfile --set (MINIO_ROOT_PASSWORD)
+      # Interpolated at runtime from the loki-s3-creds Secret (SOPS-CMP emitted),
+      # injected as env vars via extraEnvFrom below. Requires -config.expand-env.
+      access_key_id: "${access_key_id}"
+      secret_access_key: "${secret_access_key}"
     bucketNames:
       chunks: loki-chunks
       ruler: loki-ruler
@@ -110,6 +112,14 @@ loki:
 singleBinary:
   replicas: 1
 
+  # Interpolate ${access_key_id}/${secret_access_key} in the S3 config from the
+  # loki-s3-creds Secret (SOPS-CMP emitted).
+  extraArgs:
+    - "-config.expand-env=true"
+  extraEnvFrom:
+    - secretRef:
+        name: loki-s3-creds
+
   resources:
     requests:
       cpu: 100m
@@ -124,6 +134,11 @@ singleBinary:
     storageClassName: longhorn
     size: 5Gi
 
+  # Pin to az-a (talos-cp-1) — sole Longhorn node; otherwise the PVC fails to
+  # attach on cp-2/cp-3.
+  nodeSelector:
+    topology.kubernetes.io/zone: az-a
+
 # ── Disable micro-service replicas ───────────────────────────────────────────
 # In SingleBinary mode the chart still templates read/write/backend Deployments
 # unless explicitly set to 0. Setting replicas: 0 keeps them out of the cluster.