refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00
parent e650bf792c
commit 8ff3060ff0
31 changed files with 383 additions and 393 deletions
@@ -19,8 +19,10 @@ spec:
  source:
    repoURL: [email protected]:Riotpiaole/riotpiao.homelab.com.git
    targetRevision: main
-    path: .
-    plugin:
-      name: sops-secrets-v1.0
+    # ksops decrypts every *.enc.yaml here at kustomize-build time (repo-server
+    # runs `kustomize build --enable-alpha-plugins --enable-exec`). Replaces the
+    # old sops-secrets-v1.0 CMP whose discover glob silently hijacked kustomize
+    # rendering of any app whose path contained a *.enc.yaml.
+    path: k8s/argocd/secrets
  destination:
    server: https://kubernetes.default.svc