refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00
parent e650bf792c
commit 8ff3060ff0
31 changed files with 383 additions and 393 deletions
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:AYk=,iv:/1G8RSCBaiQ6msQEPPOO4LzlbYOzEbNvT9OwnY0E1JQ=,tag:Gq2I92mI3c1FFsbv2ZE+BQ==,type:str]
-kind: ENC[AES256_GCM,data:PbHIh8xS,iv:KMW7WL9ZjTmUz3NOQRhjsuAH2EZFXGk1P4hhl7cp8c0=,tag:9vJiqOtV3EhVfXWjJr4ZhA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:mF7O9mz8+KGfU6DJ8ifP974at95QOPH7yIaC,iv:1qXckUq4RTBZ06YNLXsuMW1UWRK9cgymDdVnmwLZles=,tag:v2dzEB+J23h4MxxkcJThIg==,type:str]
-    namespace: ENC[AES256_GCM,data:7omPsuwSfF1IwvCN,iv:YCv7jIXpkzTx9iu9ScwHme8Nc8iqJr1xn8yXK/OsHk8=,tag:5zslu/jpTpMHi2XvCP92Ig==,type:str]
-type: ENC[AES256_GCM,data:nF1pv2+3,iv:iseIGnyGeVE76BORrjX/TnvrfzaRMOFrQ7oWT0jIS9M=,tag:qTpF2hYVmnCwL8EQA9Ot8w==,type:str]
-stringData:
-    api-token: ENC[AES256_GCM,data:Evzvkz7ywKLsTXA0/ZF09Y+uKWDQ16SbAsogo4t9aAd+zsvFAnsyVifQc0SUNxzjSv8FXws=,iv:uFvlesWdZUbiuh8WTq1uLBRtuptV2tXxGJ6PVgu7vCI=,tag:thpyhOHtKWNn0bi1Xi1q6w==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwM0ovVUZmZVFmbjlwOXgx
-            U2h6aDNVVmV6NC8xckZtN3lwVytneHZvQ0VFCld3YjlhTFU5aVd0T3NpOUU3NW16
-            ak10VVFiMnNsNG9GS0tIN1ViZjRrcG8KLS0tIFNScE5ibkYvQWszeDl2UkF2VHpG
-            Rzd2NlNSYlRYY0pkaDY1YklGS1NaWFUKTmYqAOF+iPbgl8Qv1qEyGLSDn3Yqw3Sd
-            iYpwVUPMrrLG9FiaSTUavmkv96DCEnof3GStaYsd62MXFWHW9eFAtA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-20T19:49:33Z"
-    mac: ENC[AES256_GCM,data:6d8l+mal0zlwSyK1zkvpE8Y2cknXM+deaiIdzc2nySEm2pkC2ryY6exmPOsiyjDFrH9vnvwpvWxUqOZc1GPJ7/Pe6lDsdgT7ZPKrzJwfG07lXCZTNMTKruQ745mPgMzoJ82OjC8dXrXRXAqbFMw7SJeCajlfwL2Odmqr0reTnYs=,iv:FEcmRP5KYbI6QBZDLvcgF4ko4g5j2I8+eFrzPay80fw=,tag:cdUfwl+8Zwjyvu/p8htS1w==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,24 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:oU0=,iv:3EeP5hzIKy1MR7HAcN361qTju4CuiQGXM6aqmO6Wdj8=,tag:8X8DAsv3E4DePq1HsVtjUw==,type:str]
-kind: ENC[AES256_GCM,data:QJLvTWAw,iv:PUdCdWZSB0T84G3lpMASZMGDMfcI6kOOEaFxMleQMM4=,tag:ZPCpk7VooHXX3EoJYHZGwg==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:PD2sYpXC4OmEaxDc+kJiOjoM,iv:r7S5dVjCVofPZxr3k/QNKUJZ9r9I6bnlovHuczKTe1I=,tag:YfxMOfz2hkxaSexFcAIn4Q==,type:str]
-    namespace: ENC[AES256_GCM,data:spnMj7c3tTdxe3NG,iv:a9k4Dza2N3jDgW0P+mQFO0tnebqlFdgDz8VoxCBaKXw=,tag:DyicmVMjc2vs9O2VDV/g9Q==,type:str]
-type: ENC[AES256_GCM,data:KFto63io+fvte6QKcbr3QiU=,iv:vgtvyP+ssOOD003IL4uPY3L/LjxCsWJXaVE4scCeB4E=,tag:naazs19L3BV0ndgGak/Slg==,type:str]
-stringData:
-    tls.crt: ENC[AES256_GCM,data:0m4hJGFUiv8bRI7YPPSAuus/aD+x7NwZgdvhjbunUXNjC7sA8Tq0BPmsYCEHi/IeWEmaZECFrztIfrYhfLSbR+Q00rmBkxWeXNzDxk12/kEOiAFSSfKrC/wM3PuLf+0hgD7w0qRBHxrgfIK56Hn+U03hgkHYp3HaGBXDYgd2Ikb7RAY3Wk8LkWprD2N8uFBsoD86PYl6VdYcBK+fP8DeV49mxBTi2Jhy1e/s2QiNunaEP4ibX1n6E3uKMn5MQsXxNpjDdLnVkW6TsCVMjxTeTzGgzFCAeYcYj2XcT3AA0tLJHPEiXTI1uPBMKBm9h2MofKP4ROF8op2DN4EHtNJywqJRqJ2OmGPLkpEloyRn2howlS+xBDNPe/GCxFJieyT6q0Zb6Cv1QDdwC3Tzc/Y5g0IFnfOXUgepQEnG5Vo/qYoe69vfxA0Ti2zeRQQcrJZ5UIGasypIrrR/1ROsJWvkZIlzilA4UqJXx1FB7fXxTA8P2KeFPti+s7zYv8oAVi5VQsZ589ahQbuzMLrbodDPvqkbGua+w0BkuYeO1rqxhWwZxlwvZkBgOZD8aHnsWpvWed/tI0keGxUxhEaPFGyXotDKLCjJArPUQQxFwHovAH997LigZVytGUpiku5BcournPQCYRkPoMMvWa2kAF/BRcgsFpFcGzCEqZtNZvrveGhLtoKIRBoJDHUqwUGb4drV2i+zR+W19mJARzr+ZtnlbUvW6hUo0aRDVE5AsEUDOvDLlNrtHCdtw5JdsL2IxBrTbNKtTeokcpFDf8sOXbD97AWBiXxAjW4q0kKYRie1KrSJcnVnQfFC9xIQv3Vswmqce3ARI8qY6c7XRLO8gAhq+xja513FIhd3O7sn9iJUwdhaSUziIL8vU5OSCyJStHPq5VZRSoaOCj/dyK/p3WI//cxAyei+djKsAef76/B5V383QsIFQGGPKoHcKj0KlkHhJmfU1xYMRhgILFbwFpZhTtLzn/+FWGUKmErYd6Zdwm2hbBEZuLX5AVOYw9N5ZKBWpCkXwfSHrLeR1sytCtZHo0UCXWiw6u+NFVQs7/k5HatFpFKZnzdy/iA4R6cbaLoFqyNPW/jRP7W5TMFwoQAu3sJ2TmbOLrR7lPbEynaCua/veaCHO2wCKqNA4xVlnzDIUxncwWz3Ag6a7pwbFhysLH7DqHFe7FAzA/BHJRlKgScC2U9Iegn+761KmM5RQATsiXHQiCBqWWc5aGriL/YhA1Cx42is3Jn8w9qrs8M1tOff9kzAD504Md+wWT8/XYb3wR8fK+9LJSYjJsb8ZB2x2Vev6WmyElkHkop4JGYyG8P5lbCBMsy1SxDviFQWgoHuY5p86d4EMiLmkr5aV4WMNeIBcSEs6R3cG8QpXJdAXkpg6UWs28ioESh1cyf/IXA0hujVMZJpt1yUBS79pGFHyQzDgrrYnPcqX7d8CO6y3SUVDMSevj5AksaN6NRPOCg7gTkMMHs84csEleue73v/K8rFthBc1/N2L1XKd7ca60SA1262hOD98af/PSSSKduOgmFYYh/+5ary1Z0AqWjF9RoMf940T9KBf0KurZutBQlsFf1FFst6WyAzJJrMrmk9H1dimmpQHlVplu+TRRw7HgRi5cOVmZaogD3HfS4JIxzIOOrJgN5fFtVEMHeXQffIB4oFFDmkO7Hul3SLrAJ3GyXCIV4wg8LWtlL+i4UcKz5gppkcKEHrc3Dzz4oCPDSqnL5qZLJS2BUy2coK9ExtSpFipawLLjpVsn6Uiiun+/z+lKYaIkv4yljy3UqtOzQHG2McmNI9dxhOFBMBX5Ir8CwXz9elR7d4UZo30ny4ruNZQs4ZeFR8HAqSQLBz57v45EmY9qqeDM+fsKlvatyqIOafiNcqGJoE+U9cmRabs7LIZjsBlyxLXFjhGDCjBC/gZusbd58Vj1WaUHd5hK01pqEpwpJEhSBGKsz4q5gD9fvEnBSqwVCtBS20ghtTFVU8THzkxo4t+3IwmhRX5rkmsE9WDw+xrX/8l+Bl43ySIk3+9pIZL8DXJkflkrqpxoaVt29X3XW/mlRru5zZXbUqTHmq2F7Wqe8t2vV2U19L6mqeT6NPrfyET7w8PD6P6PzIt6fSLj6cayD5Ak28Xves6jZ2U/Jkoolc37m7pTil1HBi9/QdZiOd7tDCrVF7S3BbMNC0/L0Z6m0u+5d3H3Folc505gi2QSdcG0MmNgPpzXkA+uu9Ul7Lj5B6/ZQ3BKTwAmOk2eIKY4rA3dRm2XPicJvfb8lqOUInnBLSzECuSNBYpbm3lshgX56BsmixPF8f10TuOsedHuiEaMFXTTH+Lg==,iv:XF6gBHB/Bt+KMgSqjTnrE7OZNdsL19a0Eat35cXkmKI=,tag:F0qjYxb6zAD9RTf/1hvyBw==,type:str]
-    tls.key: ENC[AES256_GCM,data:pS231THhY0lKJqmlAfEJwWzH1SQX8kfqAARI0cd1tqkKlhpuN9Jn1XlEy1oGmhtxBh4tmgLZ9tv99EzOn46DsLPxdfrmhd7w+hiVEOn8as+9CnjbrluRO5ilTL1sVbDm+NGp3Pyvr+RQUDubSR6aJzx2dFzeQmLpjywAK/ZmN2YCeN1IyZGClbV9LoL7K9CZjmP0MVSNmTVxQwmm345khP5AOHyZPE8OIvGAGQKxXTrOAJTFXBEmGPIz0LdBUaWLb0Mc4yjhg6XY7bfHty8/DgGn21fHF4OUFgPOnQbnRFHJQewq23epYIPh8oa2GaPUgumLzUGfrAFpEX86LB6wb1BkcoYYuqG00J39RKkw34YKsNBsRGOQWsCPWKCDKHGVvsBsAYBXhtvgZ6O5MQSFEoqKtbIEtwYJnmext1ovWBx4KzDo90WPm5X6q5a4Ij+glj63K695PlRcux5b4OnJHzUvaPjJgyzlIUphQJ6p6iqNB05/TOIf2s2qOE0LlE9zlw6EGZkSgSdklxPS/4844FINkhMfXfceb8wSNcnucxNIQvRnfBC4siUBkN4ddC6e2pizmqeNcPSmPvW+ZaoRrbnp1VB/NR/PpyYAGkb6uTLdVdh6kl/nIEShCpjTiKUH8dlu+4yBENcrW7hCeOjWZZc7U4USWUvWWsNdghD5GeXY1K8PR23hg8SUGoFs2gK6gsAr9eQbHWH1340yOdODaKjqVMTXGeHpQ9R9QaIIa1svbsekD6m3f+23yP4ALJUpWdXGSYJ7NbNKjpf5v5lcfZfct+9OhTJlaxDdDGFGXr0qs9xVFgYC8tnobTUAfvjcNI7JIizPKSFNr9UgfOuHQYJP6whvJRJ1AUJ+/17zbtdB2Pawyg9Z6dUp+e/MxFNlGFKx5ydx1en8NTOZvH2zmzt7nlvtpRnbcfwljlJFzjFeFIum7+dxlotjFF22hQqXXm2LWArEXDIHzG2yJU4lDva7gQdcGBYdWqd/LTMCFDYFk08bNtf2wV2MaEw4kOcPYpmRzVL0r6ToBCSLKBRCzhE3FcSIIyvWda7OhWk4xEfIFD9ESK29qyr8KJxEPxwzdbCE7tYnPlx77vq1NtWSmbkOV1nlo0r2aQWVPt2ziSwo3UrwscH+tTUQOjTQeeqhx3euFhTZ8mS9nKzHay7Jx9DIYRQ7ozRpaL38qxyg/3eD7VnPItk4Nh+TosWY2CniVZEkXRrBniJ+gzr153mrbya8/fzcTE/xpA51WU1JR+q8xY5YkDm+8f1nrogPQN/Lez1H4sjI1qyQ0PPVhNBX+kHh1n43fjOGiH3DHYAda7GqxjHfq21aGWu8zN9O60yjJYf/TYHDZgCdOIbpMuqW8TBn3YMwZUdKNVAgnU2+zy5HepHZqj59ovLL2t0n5urewDkA/NJNygpnBBm1Wxt7oOP4fTkicg4kkHQOM+u0Qh4be3Ery3KrHCDjt9yrApg6fa3zmKNNQnL3TaprpRHJ6VGO15Gd7vc0Q3wzHP3qUOpL+XbkkhZo7PoVYninb4nYZnoKcP7cGIQjxlfiDWhKRW0kTdW0eUyV8B1KhiyJ9qkHvuQPxDfjlDQs6yxAkMr11KCoESqugDizIuqgBG4n53PdltrP3cEp4ntuZ17UvHDOuNI42gb+dEC6v5pd0PI0mOtY8n0kJsl928+mW999aZXL7dN2R7ik64n45+P9tqP32o89u2MZPShDpg9HkcHqdfSXb00mNnnKIUaXPfO5i5XeiBq7nl9KXUCK6hkYCFooiKsVl8e9LcKJQeS3EDTolDtbhw3iiBjJY3Ci68qlSnsKjv6Z8ZbzsmIzrcd5lTdkMJI3b880y4RTEkWML4K2I78l9VzLe4y2BPHCnWhzyxjzVgCzRdq6KAQLzpJtqCGr+vAKiIqwOxwR5J90QSeMM+c5zDnZOBzN879F1Zln+EL4OCfn24m/3ivShQHskdzsLO0KK7jNNrlh1K4m/4+Ey/BMNu6bDUuLTuvd6NziTCoQnWIXbnV1aQ2ZtBbbwPfDhHZcXpNTt2OqVBOk3jcGsJOF+iBjkhO9n4+uVJF/9sFDZmdpNhVoJ8knjCJE1RnSLaz3UWX0gyoBgeRzyDKOJjO66RMMYCiMYHwtuI4+8s27QB/xSEjzTdigSgxjcwz9oZkRSK41cKHj6ExWQO2VGLxkZNgjoURey+cE3IcLe+UOKKnqiB/64YJwO/RxtcvXKaG9TIVczCov3N2S5vuKoa1JSjs/X0BXMvrFZQw9oB1dCaae7pY8tG0BOHKKBBsmY+jLW0D0PWj+1hptU4Ua1sqPVq8xcOm40mgJkDNhGJnyhBkUKy7jDn5kXLswAxI3RzRWlP3Sa4ss18dd/xUkEigQX5KP2xu8vecgjws/LwE7LqSGrRP5KblDtSr/CVzZ58yGg/fjrwo3KN43sHefJkrC17FWxoyV4YXxoy9jlfWINOoXO1602UshHigXWXiHtEXVvUvwst5nsqqBBPJ6j9rgemQ1gVpsghNGcmHWcMuA0gWPfF91OxsLBGb4L4pcagfEy6+j9JhHfaNW5nMRHyDORZcmkL6FfedeYZhkxcPMT4BMuagf4L2GYkZbEH8QjwGLygDK8o8KqwJod0+/cO1xTbNzFMjYZm3SygMkMUNigGpRRefVHf3+MGg4E0+lmc8LuwCwZ6ZuFOrndj+mbT3VMDzq9QngWYtYK3YY4EYxSlvqTfCeGVVIhZyiVrBz7fnzXA131BB/nREKXzNVnUcjqxpu2wp9hffJ+BDkOGRbh3eXXhLZLpWMtlvpROoHNuizzgbD0+B6BR6SLuH31lp4ooJYCHCgZUXUg+Men1VD4bMEhxd3vSlJl0EFry390lYzDg1vpt2pSI+Nkvb5J4wDIJQ7e3MAy3hy37XOGRiKTTBa5hvaUnY4Dm8TYsI49E6Cx5pfmz/NTCrUjEdKybI5PbQFCLmtCB4aN03zMNWndZDw4mDexu43octUkke1m2+XvUxew5/uVGGZ6AmOT/OJEBs2eO1CEzR3+dlFEQCv3GOmVy/dd7/QqQmhf9iLlIavu16xd2ThfEfKulF+o5ccqLy36OVc82/5nRhJElGg6bW/hRpRI+GS6AkEED2cVNYWFd1YuTUT4VNvr2vEfTftFeTVNYkrtV1u5OaWFQWRDqt8vEOkkidxmAd4VKBnrRkd1mYtnzsGRqYVKMkGc8v2R8PqU1M5PJZIzqwQLiAnjILPz5DxbTuYvbrMRkhP1V5nnk/GrpeEd/tGJN9F0K9bSI9jQ7R/eKtqZe5EfOqH0RnNsLZC+Mdp3OZbgx9swYz5zLtwD2sx+U57v22zHPGL0pcMHWgxXG8JHk1NRzlLsi4ZvKsKBwx4ya9E9BZTbSXYTQh/MbSuvcr/OMdQ1FvaL6HtJa6+Pl26+sVYXYlTLQF/t2PYU9SxFOFt34ZH2qNNIPcx0NzSN3exX34ApDSUnF0IRBF9cauG0oB+fVjB4OWTLfxY6KhZRKJhFVdyYd58GGMWMs2RBvojTf1UX2Jr9tzTK6/itk4KiCnLOV1mgmwEpvmoto6mwHzYeSgwzYnQxQxnL+Xt5O9eya7TDXp75MMynjuEujeI27D3xvCHqCEPszgNJ+p113YqO4IOTMBhwhYWl9KOIl5HEhvcVl3lZ+qPeXXG7Xui84IIUx2BVtFySAx4CKktVFUef3Z9KHEbioRJDdZuBWeJuUYMWAhBM5Gxds/BGwOMpGoAQa9USWUs8WIWvJ3MzGQOB9B0lBb/JaW+tfs4zXardzmVoBNzeDpvWpIgYXjK8ah3duliIXxNGg8U/QYmL6EC3jWTdkINwEu4qDFyU7feNocqrs4uWFalyqzehwQQiRHcF8lzDHHA9d8+l9UTiaTxbNaqiO2Bwq4gPpzx/P1IR+Pkc+Tc0QwnwGueaJRaPVa53biUKb9oZktC8u7p4l2W5PTT8Di7uo7lnSYlZfMXwsK1h3Ht+8obXPkGjtE42MflI9ADFZLjehP+hKgXn8PpeGCZl5rP4BmofzjxVKaNKI3DUavdh5DrXBcz2AP9m8qliFmI2NOKjLx6WjLzEaWXKL4pZU7KJbA0+88LrSYc828tShne4Nmyv8KDdnQ4t1YXnhuuAiJDF+nh2ouLwKmR+ru1XcBpR+sdYnaKtm7N5pDC3Lr/htoiEl4J58AOLIkYo5er8vSrXyWFUOTiYWa72DhzupAhnJqZ2ACB7lRMDvjvSaTjNM+TNzT/id4zxa8Lu35J030vXNoMGBa+QlfQozZUidtODgu+b/07KsZTqz69kDFREgmN1xk5T/1lFzpSLhcp3kdlbj8RmZ/hncOaH327nZ3ouXiSAD+NIpg+uDFqtHXgknhG9kY=,iv:z03p38PcVSVeaQ/1SwCR+HGxfzBzSO9lBdToMHL3Jao=,tag:UBGwaOV/BsyxVnvrcDS+rg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaCtRMTBEcVI1TXl5S1NN
-            bDUyL0N3eDVRMmN4YzZOdkpUUitQL3kzd0h3Cnh1ek16OE1VUkR2bTdVNkk2Z29O
-            RWRraDRTclR4WVRSZnQzRnBjb3kyNlkKLS0tIHAxbWZNaWI0RU9qRmIrSWFqQ0Fw
-            Rjl0L1ZBQjNPbXJMZWNkUXJxOGFub28KQCTZP02Yk19EdkkiZ379eMNRGbExoMNy
-            JJ/4KCa1uFoUooRE3mudpBfc5xDAe/lkW60NUFrAFYZoVmRkYH9vSg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-08-12T02:49:29Z"
-    mac: ENC[AES256_GCM,data:QiBWiTUOTnyLUbQL1kcc5rjyEBVuGIaGCW7E7ln08bS94G1oworgbmShqBx2ygXg0VZaWBLcoe45i6CC49vCPB7JJdZcVOczHC72ekYBF4foq6eJP1zttEC5HrHlGIOW9LeahHmMF8Gbodx7HQ2aps/hZ03kxS75yCyFlVuEPrk=,iv:vf+h6fR1Tu1VUyl007HLzO9vuzACd3KVYsR77u8aB1A=,tag:9JMPHhvUACi1Q4mfZTp+qA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,26 +0,0 @@
-#ENC[AES256_GCM,data:85lNBL02TeroUW8dissgxEwjnOZnb0fg7jndGim3/QSi3/hFEF8FQa9nrQ==,iv:lM1jBHIxFkQriZ6BjGRXAlymUs5nX4Kvt1WNxUeZlkU=,tag:wm/D5qVcrcu3VXcZkEj70A==,type:comment]
-apiVersion: ENC[AES256_GCM,data:Vrs=,iv:0TzPcIoozs2MXJNXkzgcVtjjBUgfOHaSXQZiD37fb+Q=,tag:CabTlLwtz6RcBF/gr4Ri4g==,type:str]
-kind: ENC[AES256_GCM,data:22Y5w+Df,iv:Mf2s3h8++Vxqb4JoymHXY4/WAknDZ2GGrVVtKK51JxI=,tag:k5DHUqWGMBPpLkQXADaMlw==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:ItXKquY5a7gu8CJZog==,iv:jxbj7Qtv+DRbhzTdvtv+eJuTQPNIf497NZPYA6ld4s0=,tag:XdaaSavFBxOjvxna2kr/Tg==,type:str]
-    namespace: ENC[AES256_GCM,data:VH6NMg==,iv:4PfWZu5qVGXP3ZzRHMrh5N9dzJ3SoUPPo58ppcDTnpk=,tag:Vr8E+WF0Z9ym3GyTGbdi2g==,type:str]
-type: ENC[AES256_GCM,data:DmbHZRIk,iv:EZHnf1h1L29G1HOBYBSBeydNe4nC8XiBOw8YEL3kxrY=,tag:pFhUSMAIEqJET3NmaajO1g==,type:str]
-stringData:
-    username: ENC[AES256_GCM,data:ZTrmFA==,iv:1+tLTAxrDitXJwCAEccaVQzc9I9lNRgT3FsxO2NPDDc=,tag:69Wn4a8pjhdUycc/MXsn3Q==,type:str]
-    password: ENC[AES256_GCM,data:w7Vn8XaC1ykNrwPpJjVYg8J5KXkUbaPspu0CoceqHVdai6BFNW5rtA==,iv:jAwDFvJfQ1GkeU/qpEVUAQ6cWqxYE8nrgs+/RouyUxg=,tag:foGmYika/9uNBdsKVrspEA==,type:str]
-    email: ENC[AES256_GCM,data:pIOq80OjVERFCXJmx8+qTJEw,iv:mfkMj3u8W2ZX4N4IH39mZXfEp+xphS4shaJcFOD/LEE=,tag:FOSq0E7VzzOM69Bn77v2Dw==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSi84U3FQZXJrYzA0WCtS
-            c1g1Sm04eFhha2huSEVCd2x3OGVUT08yejFjCmpPV0NsTVRyWTRVUkx6WktKaU1k
-            Vk12VGRIejRWbjQxeDZxdFUxWkgzaVUKLS0tIDRZdFNxY1AvcFhOREMxU01zTzhX
-            RzFmMjdjOFd4ZkxscnBIa1E2NWtRaVEK7qZXtq2VwZBwsLAulRh93TpCXCos0Vu7
-            fX+/oMEN6gF5VxDJ/e5C644EKUY+tSLAoh75xA5DAytOxEVdhe2ozA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-25T17:45:22Z"
-    mac: ENC[AES256_GCM,data:gi8smimG00EQbF492BVzsWOEubGdT0zSG39D+r3fgLL/wgtDqF2mgtFA0iDiy1pInt1Viu8yYpu1l/eBSD8BNW4bfrglIHOJdb1I5+19u8SMebhWCwbEcbiHaXNmVUKKapGsNjbApCApq00NXoOZuOUSUzZlh19JPvg/vd7nl2M=,iv:n8Kni4RQhj/VgIruqptVa6m0YwFJF6v2+p2boJsLT5c=,tag:Tc4gkhH7hSrJKEOJ3X3SjQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,30 +0,0 @@
-# ArgoCD CMP plugin for SOPS secret decryption
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cmp-cm
-  namespace: argocd
-data:
-  sops-secrets-v1.0.yaml: |
-    apiVersion: argoproj.io/v1alpha1
-    kind: ConfigManagementPlugin
-    metadata:
-      name: sops-secrets-v1.0
-    spec:
-      generate:
-        command: [sh, -c]
-        args:
-          - |
-            # Find all .enc.yaml files and decrypt them, separating multi-doc output.
-            # Skip files that aren't full K8s manifests (no top-level "kind:") — some
-            # .enc.yaml files hold raw Helm values, not standalone Secret objects.
-            find . -name '*.enc.yaml' -type f | while read -r file; do
-              decrypted=$(sops -d "$file")
-              if echo "$decrypted" | grep -q '^kind:'; then
-                echo "---"
-                echo "$decrypted"
-              fi
-            done
-      discover:
-        find:
-          glob: "**/*.enc.yaml"
@@ -42,57 +42,48 @@ repoServer:
      operator: Exists
      effect: NoSchedule

-  # Fetch sops binary into shared emptyDir (runs as root; main containers can't write /usr/local/bin)
+  # SOPS decryption is now done natively inside kustomize via the ksops exec
+  # generator (see k8s/argocd/secrets/), not a CMP sidecar. The repo-server's
+  # own `kustomize build --enable-alpha-plugins --enable-exec` runs ksops, which
+  # shells out to sops using the age key at SOPS_AGE_KEY_FILE. Install sops +
+  # ksops into a shared emptyDir on PATH; the repo-server container mounts them.
+  env:
+    - name: SOPS_AGE_KEY_FILE
+      value: /sops-age/key.txt
+    - name: XDG_CONFIG_HOME
+      value: /.config
  initContainers:
-    - name: install-sops
+    - name: install-sops-ksops
      image: alpine:3.20
      command: [sh, -c]
      args:
        - |
-          wget -qO /sops-bin/sops https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64
-          chmod +x /sops-bin/sops
+          set -e
+          apk add --no-cache curl tar
+          curl -sSL -o /custom-tools/sops \
+            https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64
+          chmod +x /custom-tools/sops
+          curl -sSL https://github.com/viaduct-ai/kustomize-sops/releases/download/v4.5.1/ksops_4.5.1_Linux_x86_64.tar.gz \
+            | tar -xz -C /custom-tools ksops
+          chmod +x /custom-tools/ksops
      volumeMounts:
-        - mountPath: /sops-bin
-          name: sops-bin
+        - mountPath: /custom-tools
+          name: custom-tools

-  # SOPS CMP sidecar (decrypts *.enc.yaml via argocd-cmp-cm ConfigMap plugin)
-  extraContainers:
-    - name: sops-secrets-v1
-      command: [/var/run/argocd/argocd-cmp-server]
-      image: quay.io/argoproj/argocd:v3.4.5
-      env:
-        - name: SOPS_AGE_KEY_FILE
-          value: /sops-age/key.txt
-        - name: PATH
-          value: /sops-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-      volumeMounts:
-        - mountPath: /var/run/argocd
-          name: var-files
-        - mountPath: /home/argocd/cmp-server/plugins
-          name: plugins
-        - mountPath: /tmp
-          name: cmp-tmp
-        - mountPath: /home/argocd/cmp-server/config/plugin.yaml
-          subPath: sops-secrets-v1.0.yaml
-          name: argocd-cmp-cm
-        - mountPath: /sops-age
-          name: sops-age
-          readOnly: true
-        - mountPath: /sops-bin
-          name: sops-bin
-          readOnly: true
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999
+  volumeMounts:
+    - mountPath: /usr/local/bin/sops
+      name: custom-tools
+      subPath: sops
+    - mountPath: /usr/local/bin/ksops
+      name: custom-tools
+      subPath: ksops
+    - mountPath: /sops-age
+      name: sops-age
+      readOnly: true

  volumes:
-    - name: sops-bin
+    - name: custom-tools
      emptyDir: {}
-    - name: cmp-tmp
-      emptyDir: {}
-    - name: argocd-cmp-cm
-      configMap:
-        name: argocd-cmp-cm
    - name: sops-age
      secret:
        secretName: sops-age
@@ -138,6 +129,8 @@ configs:
  cm:
    admin.enabled: "true"
    application.instanceLabelKey: argocd.argoproj.io/instance
+    # Let every kustomize build run the ksops exec generator.
+    kustomize.buildOptions: --enable-alpha-plugins --enable-exec
    
  params:
    server.insecure: false