rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(argocd): clone the public GitHub seed anonymously over HTTPS and delete the SSH deploy-key Secret — its private half had been committed in plaintext to a public remote, and a public repo needs no credential at all

Browse Source
This commit is contained in:
Story Crater Bot
2026-08-18 15:08:04 -07:00
parent ee1bbed921
commit 5f16f16f0f
14 changed files with 41 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap.sh
+5 -10
View File
@@ -12,16 +12,15 @@
# - Talos cluster up; kubectl context points at it # - Talos cluster up; kubectl context points at it
# - helm 3, kubectl # - helm 3, kubectl
# - SOPS age key at $SOPS_KEY (for the ArgoCD SOPS CMP plugin) # - SOPS age key at $SOPS_KEY (for the ArgoCD SOPS CMP plugin)
# - GitHub read-only deploy key private half at $DEPLOY_KEY (public half added #
# to the GitHub repo's Deploy keys) # The GitHub seed repo is public, so it is cloned anonymously over HTTPS — no
# deploy key, no repository Secret, one less thing to bootstrap before ArgoCD.
# #
set -euo pipefail set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BOOT="$SCRIPT_DIR/k8s/bootstrap" BOOT="$SCRIPT_DIR/k8s/bootstrap"
SOPS_KEY="${SOPS_KEY:-$HOME/.sops/key.txt}" SOPS_KEY="${SOPS_KEY:-$HOME/.sops/key.txt}"
DEPLOY_KEY="${DEPLOY_KEY:-$HOME/.ssh/argocd_seed}"
GITHUB_SSH="[email protected]:Riotpiaole/riotpiao.homelab.com.git"
log() { echo "[$(date +%H:%M:%S)] $*"; } log() { echo "[$(date +%H:%M:%S)] $*"; }
die() { echo "ERROR: $*" >&2; exit 1; } die() { echo "ERROR: $*" >&2; exit 1; }
@@ -39,7 +38,6 @@ preflight() {
kubectl cluster-info >/dev/null || die "kubectl not configured / cluster unreachable" kubectl cluster-info >/dev/null || die "kubectl not configured / cluster unreachable"
command -v helm >/dev/null || die "helm 3 not found" command -v helm >/dev/null || die "helm 3 not found"
[[ -f "$SOPS_KEY" ]] || die "SOPS age key missing at $SOPS_KEY" [[ -f "$SOPS_KEY" ]] || die "SOPS age key missing at $SOPS_KEY"
[[ -f "$DEPLOY_KEY" ]] || die "GitHub deploy key missing at $DEPLOY_KEY (see phase4-argocd/seed-repo-secret.example.yaml)"
log "✅ preflight ok" log "✅ preflight ok"
} }
@@ -194,12 +192,9 @@ p3_forgejo() {
p4_argocd() { p4_argocd() {
phase "PHASE 4: ArgoCD (seeded from GitHub)" phase "PHASE 4: ArgoCD (seeded from GitHub)"
# Always ensure namespace + repository secret (idempotent) # Always ensure namespace (idempotent). The seed repo is public — ArgoCD clones
# it anonymously over HTTPS, so there is no repository Secret to create.
kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f - kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
kubectl -n argocd create secret generic seed-github-repo \
--from-literal=type=git --from-literal=url="$GITHUB_SSH" \
--from-file=sshPrivateKey="$DEPLOY_KEY" --dry-run=client -o yaml | kubectl apply -f -
kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository --overwrite 2>/dev/null || true
# Decrypt and apply any encrypted secrets from bootstrap dir (local SOPS) # Decrypt and apply any encrypted secrets from bootstrap dir (local SOPS)
if command -v sops &> /dev/null; then if command -v sops &> /dev/null; then
k8s/argocd/apps/00-secrets.yaml
+1 -1
View File
@@ -17,7 +17,7 @@ spec:
syncOptions: syncOptions:
- CreateNamespace=true - CreateNamespace=true
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
# ksops decrypts every *.enc.yaml here at kustomize-build time (repo-server # ksops decrypts every *.enc.yaml here at kustomize-build time (repo-server
# runs `kustomize build --enable-alpha-plugins --enable-exec`). Replaces the # runs `kustomize build --enable-alpha-plugins --enable-exec`). Replaces the
k8s/argocd/apps/00-substrate.yaml
+3 -3
View File
@@ -21,7 +21,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/bootstrap/cert-manager/cert-manager-values.yaml - $values/k8s/bootstrap/cert-manager/cert-manager-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -93,7 +93,7 @@ spec:
project: homelab project: homelab
revisionHistoryLimit: 3 revisionHistoryLimit: 3
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
# A real kustomization.yaml (resources: the 3 issuer/CA files) renders these # A real kustomization.yaml (resources: the 3 issuer/CA files) renders these
# deterministically. The previous directory.include with bare filenames # deterministically. The previous directory.include with bare filenames
@@ -127,7 +127,7 @@ spec:
project: homelab project: homelab
revisionHistoryLimit: 3 revisionHistoryLimit: 3
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/bootstrap/ingress path: k8s/bootstrap/ingress
destination: destination:
k8s/argocd/apps/10-storage-observability.yaml
+7 -7
View File
@@ -17,7 +17,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/infra/minio/minio-operator-values.yaml - $values/k8s/infra/minio/minio-operator-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -41,7 +41,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/infra/minio path: k8s/infra/minio
destination: destination:
@@ -66,7 +66,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/infra/longhorn path: k8s/infra/longhorn
destination: destination:
@@ -94,7 +94,7 @@ spec:
skipCrds: true skipCrds: true
valueFiles: valueFiles:
- $values/k8s/infra/monitoring/prometheus-values.yaml - $values/k8s/infra/monitoring/prometheus-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -144,7 +144,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/infra/monitoring/crds path: k8s/infra/monitoring/crds
destination: destination:
@@ -175,7 +175,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/infra/monitoring path: k8s/infra/monitoring
destination: destination:
@@ -205,7 +205,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/infra/monitoring/blackbox-exporter-values.yaml - $values/k8s/infra/monitoring/blackbox-exporter-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
k8s/argocd/apps/20-logging.yaml
+3 -3
View File
@@ -19,7 +19,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/infra/logging/loki-values.yaml - $values/k8s/infra/logging/loki-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -53,7 +53,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/infra/logging/grafana-values.yaml - $values/k8s/infra/logging/grafana-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -87,7 +87,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/infra/logging/promtail-values.yaml - $values/k8s/infra/logging/promtail-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
k8s/argocd/apps/30-security.yaml
+4 -4
View File
@@ -17,7 +17,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/infra/iam/vault-values.yaml - $values/k8s/infra/iam/vault-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -46,7 +46,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/infra/iam/authentik-values.yaml - $values/k8s/infra/iam/authentik-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -68,7 +68,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/infra/iam path: k8s/infra/iam
destination: destination:
@@ -90,7 +90,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/infra/forgejo-runner path: k8s/infra/forgejo-runner
destination: destination:
k8s/argocd/apps/40-data.yaml
+1 -1
View File
@@ -14,7 +14,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/infra/databases path: k8s/infra/databases
destination: destination:
k8s/argocd/apps/50-messaging.yaml
+3 -3
View File
@@ -68,7 +68,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/apps/messaging/kafka-cluster path: k8s/apps/messaging/kafka-cluster
destination: destination:
@@ -89,7 +89,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/apps/messaging/queue-crd path: k8s/apps/messaging/queue-crd
destination: destination:
@@ -110,7 +110,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/apps/messaging/management-service path: k8s/apps/messaging/management-service
destination: destination:
k8s/argocd/apps/55-api-gateway.yaml
+2 -2
View File
@@ -28,13 +28,13 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/apps/api/kong-values.yaml - $values/k8s/apps/api/kong-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
# The nginx Ingress for api.riotpiao.com. Kept in this Application rather # The nginx Ingress for api.riotpiao.com. Kept in this Application rather
# than the central k8s/bootstrap/ingress/ingress.yaml because that one syncs # than the central k8s/bootstrap/ingress/ingress.yaml because that one syncs
# in wave 1, before namespace `api` exists. # in wave 1, before namespace `api` exists.
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/apps/api path: k8s/apps/api
destination: destination:
k8s/argocd/apps/60-applications.yaml
+6 -6
View File
@@ -19,7 +19,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/apps/temporal/temporal-values.yaml - $values/k8s/apps/temporal/temporal-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -48,7 +48,7 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/apps/portainer/portainer-values.yaml - $values/k8s/apps/portainer/portainer-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
destination: destination:
@@ -71,7 +71,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/apps/cloudflared path: k8s/apps/cloudflared
destination: destination:
@@ -104,7 +104,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/apps/sms path: k8s/apps/sms
destination: destination:
@@ -133,10 +133,10 @@ spec:
helm: helm:
valueFiles: valueFiles:
- $values/k8s/apps/homarr/homarr-values.yaml - $values/k8s/apps/homarr/homarr-values.yaml
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
ref: values ref: values
- repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/apps/homarr # PostSync hook: fix-probes-job.yaml path: k8s/apps/homarr # PostSync hook: fix-probes-job.yaml
destination: destination:
k8s/argocd/projects/homelab-project.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ metadata:
spec: spec:
description: Homelab GitOps — single-repo, in-cluster destinations only description: Homelab GitOps — single-repo, in-cluster destinations only
sourceRepos: sourceRepos:
- git@github.com:Riotpiaole/riotpiao.homelab.com.git - https://github.com/Riotpiaole/riotpiao.homelab.com.git
# Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/* # Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/*
- https://cloudnative-pg.github.io/charts - https://cloudnative-pg.github.io/charts
- https://dl.gitea.com/charts/ - https://dl.gitea.com/charts/
k8s/argocd/root/homelab-root.yaml
+1 -1
View File
@@ -12,7 +12,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
targetRevision: main targetRevision: main
path: k8s/argocd/apps path: k8s/argocd/apps
directory: directory:
k8s/bootstrap/phase4-argocd/root-app-github.yaml
+3 -3
View File
@@ -3,8 +3,8 @@
# GitHub seed so ArgoCD can deploy everything after the control plane. After # GitHub seed so ArgoCD can deploy everything after the control plane. After
# Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml. # Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml.
# #
# repoURL is the SSH form — must match the `url` in the seed-repo deploy-key Secret # repoURL is anonymous HTTPS — the seed repo is public, so no deploy key and no
# (see seed-repo-secret.example.yaml). Apply that Secret before this. # repository Secret are needed. Nothing to apply before this.
--- ---
apiVersion: v1 apiVersion: v1
kind: Namespace kind: Namespace
@@ -44,7 +44,7 @@ metadata:
spec: spec:
project: homelab project: homelab
source: source:
repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git # GitHub seed (SSH) repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git # GitHub seed (SSH)
targetRevision: main targetRevision: main
path: k8s/argocd/apps path: k8s/argocd/apps
destination: destination:
k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml
-28
View File
@@ -1,28 +0,0 @@
# ArgoCD repo credential for the PRIVATE GitHub seed — deploy key (read-only).
# Apply at Phase 0 BEFORE root-app-github.yaml. This is a TEMPLATE: never commit
# the real private key.
#
# ssh-keygen -t ed25519 -C "argocd@homelab" -f argocd_seed -N ""
# # add argocd_seed.pub → GitHub repo → Settings → Deploy keys (Read-only, no write)
# kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
# kubectl -n argocd create secret generic seed-github-repo \
# --from-literal=type=git \
# [email protected]:Riotpiaole/riotpiao.homelab.com.git \
# --from-file=sshPrivateKey=argocd_seed
# kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository
#
# url MUST match root-app-github.yaml's repoURL (SSH form).
apiVersion: v1
kind: Secret
metadata:
name: seed-github-repo
namespace: argocd
labels:
argocd.argoproj.io/secret-type: repository
stringData:
type: git
url: [email protected]:Riotpiaole/riotpiao.homelab.com.git
sshPrivateKey: |
-----BEGIN OPENSSH PRIVATE KEY-----
REPLACE-WITH-READ-ONLY-DEPLOY-KEY-PRIVATE-HALF — DO NOT COMMIT THE REAL KEY
-----END OPENSSH PRIVATE KEY-----