fix(argocd): CPU limit throttling repo-server, skip non-manifest .enc.yaml docs, add grafana-admin admin-user key
repoServer CPU limit (500m) was too tight once the SOPS sidecar added real decrypt work under the liveness probe's 1s timeout — repo-server kept getting killed mid-sync. Raised to 1000m (node has 23+ idle cores, no scarcity). Separately, the generate script's doc-separator fix exposed that several .enc.yaml files (cloudflared, temporal, authentik, loki) are raw Helm-values snippets, not K8s manifests — ArgoCD hard-failed the whole batch on the first one missing 'kind:'. Script now skips those, so correctly-shaped Secrets (grafana-admin included) sync independently. grafana-admin also needed an admin-user key alongside admin-password — the chart looks up both from the same existingSecret.
This commit is contained in:
Story Crater Bot
@@ -15,9 +15,15 @@ data:
|
|||||||
command: [sh, -c]
|
command: [sh, -c]
|
||||||
args:
|
args:
|
||||||
- |
|
- |
|
||||||
# Find all .enc.yaml files and decrypt them
|
# Find all .enc.yaml files and decrypt them, separating multi-doc output.
|
||||||
|
# Skip files that aren't full K8s manifests (no top-level "kind:") — some
|
||||||
|
# .enc.yaml files hold raw Helm values, not standalone Secret objects.
|
||||||
find . -name '*.enc.yaml' -type f | while read -r file; do
|
find . -name '*.enc.yaml' -type f | while read -r file; do
|
||||||
sops -d "$file"
|
decrypted=$(sops -d "$file")
|
||||||
|
if echo "$decrypted" | grep -q '^kind:'; then
|
||||||
|
echo "---"
|
||||||
|
echo "$decrypted"
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
discover:
|
discover:
|
||||||
find:
|
find:
|
||||||
|
|||||||
@@ -45,7 +45,7 @@ repoServer:
|
|||||||
cpu: 100m
|
cpu: 100m
|
||||||
memory: 256Mi
|
memory: 256Mi
|
||||||
limits:
|
limits:
|
||||||
cpu: 500m
|
cpu: 1000m
|
||||||
memory: 1Gi
|
memory: 1Gi
|
||||||
|
|
||||||
# Tolerations for control-plane
|
# Tolerations for control-plane
|
||||||
|
|||||||
@@ -1,23 +1,24 @@
|
|||||||
apiVersion: ENC[AES256_GCM,data:BTs=,iv:xd8LqaXGfzo52SPAQYuUmHVcFD68hST+MRhs5JHjwU4=,tag:oJVWyA9pFBkTTzjB6gmahQ==,type:str]
|
apiVersion: ENC[AES256_GCM,data:TMY=,iv:ImbG3BggYpU11BV84Kwt1NrwoSZIrsoiZovqPM2ziWQ=,tag:xbld3DauQbVC7LrOyDgU+w==,type:str]
|
||||||
kind: ENC[AES256_GCM,data:+bWoytA7,iv:dTjYaCtLsQ63Utq9uW2BNydSFsBFe1z3+Ev9suCjN/k=,tag:Jl00LjJayDxycWKt9sfzew==,type:str]
|
kind: ENC[AES256_GCM,data:PrsNgt4i,iv:6ICJnhTiMP0QFX2xQxqE59AkbtFXQ3UJwH/v/2KaQdw=,tag:wyWWV21lB+Oy23AoXDdFJQ==,type:str]
|
||||||
metadata:
|
metadata:
|
||||||
name: ENC[AES256_GCM,data:4QXIyXaahJc+++YKcQ==,iv:l1321009Nz16407LDntwoxXAKcrKaGAWYi6uYhlgocw=,tag:vPSTVlxgj0v8cIHf8lI3Gw==,type:str]
|
name: ENC[AES256_GCM,data:yceBbeA92I2IMgwPww==,iv:Aw9oxB0x3eLODe/XVGKd5A4UdKoW1ChbRM7Un0kkwFQ=,tag:wTQfMQlO+ecU0epYGh32zA==,type:str]
|
||||||
namespace: ENC[AES256_GCM,data:kegyFUpUTg==,iv:FcKkgCI+yDM0dDFq2+hDbqzwpNCGKQkhXiMXB57IadA=,tag:UyXgT7dJ+5ECY5ptBER08w==,type:str]
|
namespace: ENC[AES256_GCM,data:MNtEckGs1Q==,iv:mf2ySxEaRrsPLgkwUUjmJuzklo74t8UTeCsUean2nx0=,tag:xvhxXljTD/uKCfwS6I4IZw==,type:str]
|
||||||
type: ENC[AES256_GCM,data:2a2VYwV4,iv:uwMiEGmUOxvmbHyDtTYN4jflni+z3tgsFsODc4M60yE=,tag:8gEA5x+dPm8svxpEhNNfsA==,type:str]
|
type: ENC[AES256_GCM,data:ykoXlXwe,iv:OMjn8JxX8g/jJSsIL911FX4autWEQDk1UGzfnnfKSjQ=,tag:8xhWjuq1jIhS9LxIGCa/PA==,type:str]
|
||||||
stringData:
|
stringData:
|
||||||
admin-password: ENC[AES256_GCM,data:sLmcTvdXQbI/EfUTyw==,iv:kyIAyCPn6iinaaKcjpGDPtzDoi28GhX8ykImSsZxbOg=,tag:r1Til5RWCej2nLDOXAjnZw==,type:str]
|
admin-user: ENC[AES256_GCM,data:TJBiqjs=,iv:UwIdUTnI2soFYGjZz6xj8boacSMYHxTg0Bl1xFLllsU=,tag:zavbhAUpsjOChoGZ17cPRQ==,type:str]
|
||||||
|
admin-password: ENC[AES256_GCM,data:t+vGIzaybTrLzY001A==,iv:4V3wlpMMfakInQoqD6gxk+0A6lWCm3aPw31gpa0sKss=,tag:cbduSqiUnJFj0uOCjfKDSg==,type:str]
|
||||||
sops:
|
sops:
|
||||||
age:
|
age:
|
||||||
- enc: |
|
- enc: |
|
||||||
-----BEGIN AGE ENCRYPTED FILE-----
|
-----BEGIN AGE ENCRYPTED FILE-----
|
||||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAycTcwSEdVbXkvd1RLMmNK
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZlZiOWt3SFNiYzhNL252
|
||||||
ZzZWSVB1RHZaK2RhbmZCYmI5eFZPN05KUG1NCkl5WW54VjZJM1U2ODFGd3NDQkVH
|
Vlh1WkNHZXYxV1ZsNG90YXhydlpJTURmS1ZBCmJYOTBvKzUvS3cvRGZRcDlQRFRS
|
||||||
OHRDaFVoL3Rqdm5YVFJodkZGNWxzNE0KLS0tIGVwVC9velV2d0doSklScWtuQk8v
|
c3pZNjZnbUw1Tml6eVBETnBRQ2xNK3MKLS0tIHU5UFdBSk1TUnBjdlZaODBNRkVy
|
||||||
c1l4TWdrL1JhUjYxRm8zNEdMcTJGVkEK43xCEPxYJa0nv7AJixflsawuKkcjNnPu
|
azBhbjN6a1BRNVh0cUtMU24zK29jMlEK4Y8+P1L/O80xG+qtdF1I8fvfURX/IvtF
|
||||||
lj+PUeQzWNKGziWsEjRMyFCux6hIzr5mwk8R0CAu8WLFWQOKu6Mqag==
|
dFIn1EF7YRqMy4KWKx6QSewjo8Vx7JuBDZtRDPCGNJKIKJU3R9NK3w==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|
recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|
||||||
lastmodified: "2026-08-11T21:04:35Z"
|
lastmodified: "2026-08-11T21:40:58Z"
|
||||||
mac: ENC[AES256_GCM,data:rTgYeF39pNDXerJ3mn4J+Cg2JTye3rZnNd7RHUZjayO5S+uvnZa0a7bNBNEXmf0ctqKIamsnPbMDWluNt8/vN9h4AsU0ssajrWH0hK45XYJtAiHJ2YP1CdWgYYMxalsEitw8OnO/eJ70wuxbAs8eVTHIbSVjcDmRYGJyblUjM3U=,iv:E1yYQJpr/MV0RRWNRCZmUvw/Lkr69GtAmpOja014aPs=,tag:OoMR94Y/lhrAeEW8ZEkj3w==,type:str]
|
mac: ENC[AES256_GCM,data:761EqFteOI+BuznsTV8+wIOoOJAnCYvIPYy9gpdHSkDf+QbW6k3HUCjvPN/sNXfAEtbjIf28W6iW+zhljAbe3lpOXrY2Fy4O9i/e1ltXvsBUND6FWB3TkdSaweycRGoAPTsR9vb74INqecR4O0LITcGHL+Yl3TLPzwSJhxiqpiU=,iv:ug2qqUEhlXharDqegsiPSrlmqV7z0qQBv8Ha96qH+Lo=,tag:JY+xjJgX7o6o83tSvng7eQ==,type:str]
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.13.2
|
version: 3.13.2
|
||||||
|
|||||||
Reference in New Issue
Block a user