feat(argocd): wire SOPS CMP sidecar + fix loki/grafana/authentik secret resolution

k8s/security/ci-cd/argocd-values.yaml

@@ -91,6 +91,69 @@ repoServer:
     serviceMonitor:
       enabled: true
 
+  # ── SOPS ConfigManagementPlugin ─────────────────────────────────────────────
+  # initContainer fetches sops+yq into a shared volume; the sidecar runs
+  # argocd-cmp-server with the plugin.yaml from the sops-cmp-plugin ConfigMap and
+  # decrypts *.enc.yaml with the age key from the sops-age Secret.
+  initContainers:
+    - name: install-sops-tools
+      image: alpine:3.20
+      command: [sh, -c]
+      args:
+        - |
+          set -e
+          apk add --no-cache curl
+          curl -sSfL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /custom-tools/sops
+          curl -sSfL https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_amd64 -o /custom-tools/yq
+          chmod +x /custom-tools/sops /custom-tools/yq
+      volumeMounts:
+        - name: custom-tools
+          mountPath: /custom-tools
+  extraContainers:
+    - name: sops-cmp
+      image: quay.io/argoproj/argocd:v3.4.5
+      command: [/var/run/argocd/argocd-cmp-server]
+      env:
+        - name: PATH
+          value: /custom-tools:/usr/local/bin:/usr/bin:/bin
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        seccompProfile:
+          type: RuntimeDefault
+      volumeMounts:
+        - mountPath: /var/run/argocd
+          name: var-files
+        - mountPath: /home/argocd/cmp-server/plugins
+          name: plugins
+        - mountPath: /home/argocd/cmp-server/config/plugin.yaml
+          subPath: plugin.yaml
+          name: sops-cmp-plugin
+        - mountPath: /home/argocd/plugins/generate.sh
+          subPath: generate.sh
+          name: sops-cmp-plugin
+        - mountPath: /custom-tools
+          name: custom-tools
+        - mountPath: /sops-age
+          name: sops-age
+        - mountPath: /tmp
+          name: cmp-tmp
+  volumes:
+    - name: custom-tools
+      emptyDir: {}
+    - name: cmp-tmp
+      emptyDir: {}
+    - name: sops-cmp-plugin
+      configMap:
+        name: sops-cmp-plugin
+        defaultMode: 0555
+    - name: sops-age
+      secret:
+        secretName: sops-age
+
 applicationSet:
   replicas: 1
   resources: