refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00
parent e650bf792c
commit 8ff3060ff0
31 changed files with 383 additions and 393 deletions
@@ -0,0 +1,20 @@
+authentik:
+    secret_key: ENC[AES256_GCM,data:/7NF9khX7mCjwB7WI5BgbPQtLdqqrwkNuH9BoSCY5pAT2HdU5fVFxdsGguEo4UUmSSvrJ32AmaRgG2Xf3sJweKctyGsuNLauOzQXrYdqa2k=,iv:ZkDp4gOHY1eH44cDhGaZILi8dFDTNuYf1CVE+qrapzE=,tag:G2r3uuiixADJ/qQh/mT7Mw==,type:str]
+    bootstrap_password: ENC[AES256_GCM,data:4uNAXv1uuqiYO1j5CKntjHPWAX4+ek8v1zIrAFHJF+U=,iv:ccA703HMomR58cD2/6wK1W0IKJb7U1hNws6fmwG15E8=,tag:eO9zZ0TwUuXZ/vdHkSeO7w==,type:str]
+    bootstrap_token: ENC[AES256_GCM,data:OYRsLR+hzoKof7rZzzTu5eST6ByqRq+U+LWlhEC4qkLKVChhXi+mdIuK6RO5RHmHtgCBTyIikvwbFMLPSXAIEw==,iv:EJCetXnkNe+UuhWk4f3vr3kIEbCuVplVKHPne3aVIQ8=,tag:Rv/oDbf5afG7QHwSm/8SBg==,type:str]
+    postgresql_password: ENC[AES256_GCM,data:FG07lU+lJMm268FmpgZ4XaEk98ANWMiJ0zExLTl4Rkw=,iv:VSJ3d8p4f5SQM2lVdhSLY5dqdQTKwcfzOCATIM5M/cw=,tag:E5917Q6ofdSrrS9Pe8uMIg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFcStlcXdQb1AvZmxFT2U0
+            N05yYi9WQkc3WWsrMHc3VXBPQllnLzZEd2dFCnhuUENiWTg5OVV4MXBBd29rSVdN
+            MUdyZURiUHFXZlNld2NEOHkwa1RGZEEKLS0tIGRjUkFHL1lNcnErZ21UOE9TUTE4
+            RTNEMW5xbDJHYitTSjQ2cnRtSG9iQXMKXlHsfHV4EOoesW89I4McQdpKLfrcP1Cu
+            B3RhKbwPVVTx4RkSJ/Y02mV4C/MtHH8q1j4DgBvoBxU04efmD7u0VQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-08-12T18:02:01Z"
+    mac: ENC[AES256_GCM,data:w+RVU9gs7BaW8BOHISBhqGI3rj7gHwDgz71cAwpxemhJvM2D7to3ntGrae+W7jIvy/jie2Bnf40XfCOlgbuJGbAOZpyEodO80UhGNAr2XJH8mu1E4yJrq1Il+obTvDQU+cs4c78Ix/Mr+MzLnCLP/N3U0Qw5qJhxAGaDhH0g0AA=,iv:BgjCQM88VTInwvAbtudWkiuureT7wSM7QmCwlSGMycw=,tag:u4Z0lgXMJ9q4UE1hv/yl1A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
@@ -0,0 +1,17 @@
+cloudflared:
+    tunnelToken: ENC[AES256_GCM,data:mFqJUuK8bzKnPAk4ZwBSLP7p6IiUCldmFNKSS5P75rKBgrrTrRB24Vqf6W7UwM2w+/CNzkQ0QByNw4/TzjHDgNH1UJAYXlVvm4H8/NPp4WPWlv5YO67l/mAmPVnBEmJzU0KgivCQm3psEYiEfbgiIbujqr0isgtkU856BimYHqtEdBmYRuJ5c73noaV6NWB1aTnEiCOmmNs+NCkN2GswgSi/zJLbd0HJPQT8h8+3rI8L7nC0/HJvYw==,iv:O3i0v+M5L3i9O7SbBtDAJe5IsQDgw+alI0Y9arZNojs=,tag:Tl9f0oVsBi68AyK3QwlHfg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWlk3V1d1cjFXV3VrMUVN
+            LzA3NlVKbllHYkdEb2pESEJkQ2RyU3UzOVZnCk1NdGVUSVpHMHNYUGhOdEhoTi81
+            YVlvU2Q2WmRUdC9KTGlBaUVnU01rbzgKLS0tIEhLNzl2UmpwYjQwNTl1YllnQ09X
+            Y0ZwR1N3Y2VNQ3VkbkJvRG56RWE3UWMK5tv5dgjKlbHq1Rh4NC0+3b9n1yTE/7vW
+            TehGG7k18zclBiZD2y5l4/CeDPM/yi5kfbPuxG1kURffw1xUeac+Ig==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-08-12T18:02:01Z"
+    mac: ENC[AES256_GCM,data:DshqXuhhJo0eLMTJ+HeAEk6JOtzGQ6OyUd7fSIGWHL/rGfDPliDBdTqpWw1899kgF0LRxY87rTTod65KvINp2HHc8KBQKa5MiAoTXQBThlFYIHFDOL2XQve9p6TKzsVDsQrBsl0lGt9V+Ou+YWUGh9kx63me1wAl8aZ9ltwWvZ0=,iv:4exYbWC7f7WGUncT1KcjrTy0r8Ox3YCctShyMiiaw+4=,tag:YMYOvwm2844LC76n3QvEdQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
@@ -0,0 +1,24 @@
+loki:
+    storage:
+        s3:
+            accessKeyId: ENC[AES256_GCM,data:vH6ysm5g9tDxmQ==,iv:a6oz4kQciHc/sqT1lu05CqI8+iJmi82JAQJ9BM5yBjo=,tag:90PuLvoHdm2GUKN931B4CQ==,type:str]
+            secretAccessKey: ENC[AES256_GCM,data:SC8AU4nRAlSeWPumJ+RY6MGQgfXpw0HDILG52urcNISDyB/5ViKZsfHinps=,iv:0rq4mv8cQ1za8ZLlR8voePiwZFdzK8sbRDDqgloO68g=,tag:cljugMlbkwvzVzdNS929mA==,type:str]
+            bucketNames:
+                chunks: ENC[AES256_GCM,data:byLUVs3mp4N/eDs=,iv:Jqt3iHhLaHae6g4CsylytZxg+3fnTdw4PUinhaUaOCI=,tag:uGsocMDRYltQxpPCsDffrA==,type:str]
+                ruler: ENC[AES256_GCM,data:Fqmd8hmoo4V8pw==,iv:K1ddZrCVFAo+CZet+BV7KJh6RVPzGbsnVIkoZpjWCU0=,tag:gTi2VInLznoOKDh5UPDpSQ==,type:str]
+                admin: ENC[AES256_GCM,data:Hn0yFD0ApG9+bw==,iv:DpuT40Jl9H1nH04u+gm7pHFox7QrZ52WqNQuBqGiz8Y=,tag:KI9dlstNNC7ZRj5TqFWpDQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERnBENi81eVpWVDRndkRu
+            a05mM3kvUVFKVWdEVWxKMjFDMVhpUXJGeVUwCmQ0bjQrMUNBbXByNENGNEtSbGdO
+            NVVRNlZFK2FOV3Y3ZTJpRGloV0hCVEkKLS0tIGxoaSsvVTlvdk5SdklqemxWWUs3
+            dE40YVlOTlFray9aNUhpZ2t1VU4xY2MKyKmoJGrsjA3uoglXjfs6s0IXeswbO5K+
+            eayKHEaxky+lngiLBlw7b0S94eGAAHHyNNA2Ii93UuK89RmK8pWRxQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-08-12T18:02:01Z"
+    mac: ENC[AES256_GCM,data:4Bjk5OYL7lnbt1WBcLQvKxJDn6aRaACFSPXpvF1mzb2dNN4sG9di3BErV5tB7BTtRC6Z3C57IrV6u5FUIKNRg46oFGIv5FoQpzvR9OA7G+wN+gCaMg/hv9ruBqOUhjsHLRUWGqI9aou2cQt3V7I/L8a5eEWkoBquA9YJjEkwPEk=,iv:H9PjzPpFKMlDjETU/lutXHOADzWYX1kg42mmea4+3o4=,tag:XCvH+svw/A8dr0FnzGdgeQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
@@ -0,0 +1,18 @@
+temporal:
+    oidc_client_id: ENC[AES256_GCM,data:gyzO+wMlDrg=,iv:4n5fIeiVG2JZOCD4yZ4Asm/gWvRl0QNFiRGTR1bs8ws=,tag:MV1b/F5OOihe+K5qlkZnTA==,type:str]
+    oidc_client_secret: ENC[AES256_GCM,data:ND7XhSln6AVq6Qy465M6x5Hupjp+xZQKnqT+OW1U+bR7CAmsnZNom1wVpm0=,iv:qxa8aqUVoN31PpzAhs6bNMDCM6yPvOT27urIrM1rfo0=,tag:SRoQ7q7Nqn8TZGxmLxKXKg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1MEVQSkE2WmpOanp2cXY4
+            M3NVNmd0U056bE52dXk5YUNBcE04c0V2SW04Cm1KTDIyc08xRHR4bnU2N1ptbHFM
+            UXRuOVQzaU1vQStZMG9yRzYyd09Idm8KLS0tIERTNjl1Q1ZtTDlGcGFpdlAwVjhQ
+            U0VxMTJBRkc1bGlXZkFxZDQ4OWlwYlEKF35/ZOxDMvxhXV4rIhtNdaE7+vQ9JOs4
+            +ou88d2WnLD9U50fa1RC3+zS/5CwzIAOetfHeVSjPLkO9oVXuGhU3g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-08-12T18:02:01Z"
+    mac: ENC[AES256_GCM,data:Gf9u8t515vhogURw7sOb5cAMKeEBEzuX3V6mDP4OtT6bPinyLRwvgp/j5E5lB0ANYggFHXiv4FL8Nb/pAQXxNe0v8rxwuWiTSspJrM2l2JzZ/nLDAfQiyOVUsoYY15HsGzjbmRT5VEQf/9ceSVqS2tAliZj7hH/hDsncc46vWHI=,iv:gOuSf898MMtzW6L2K+Z/yObn+9Bg42JvT0IlhGK+HSs=,tag:2MEPiaSqdedUibMuO/2RSg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2