refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -42,57 +42,48 @@ repoServer:
       operator: Exists
       effect: NoSchedule
 
-  # Fetch sops binary into shared emptyDir (runs as root; main containers can't write /usr/local/bin)
+  # SOPS decryption is now done natively inside kustomize via the ksops exec
+  # generator (see k8s/argocd/secrets/), not a CMP sidecar. The repo-server's
+  # own `kustomize build --enable-alpha-plugins --enable-exec` runs ksops, which
+  # shells out to sops using the age key at SOPS_AGE_KEY_FILE. Install sops +
+  # ksops into a shared emptyDir on PATH; the repo-server container mounts them.
+  env:
+    - name: SOPS_AGE_KEY_FILE
+      value: /sops-age/key.txt
+    - name: XDG_CONFIG_HOME
+      value: /.config
   initContainers:
-    - name: install-sops
+    - name: install-sops-ksops
       image: alpine:3.20
       command: [sh, -c]
       args:
         - |
-          wget -qO /sops-bin/sops https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64
-          chmod +x /sops-bin/sops
+          set -e
+          apk add --no-cache curl tar
+          curl -sSL -o /custom-tools/sops \
+            https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64
+          chmod +x /custom-tools/sops
+          curl -sSL https://github.com/viaduct-ai/kustomize-sops/releases/download/v4.5.1/ksops_4.5.1_Linux_x86_64.tar.gz \
+            | tar -xz -C /custom-tools ksops
+          chmod +x /custom-tools/ksops
       volumeMounts:
-        - mountPath: /sops-bin
-          name: sops-bin
+        - mountPath: /custom-tools
+          name: custom-tools
 
-  # SOPS CMP sidecar (decrypts *.enc.yaml via argocd-cmp-cm ConfigMap plugin)
-  extraContainers:
-    - name: sops-secrets-v1
-      command: [/var/run/argocd/argocd-cmp-server]
-      image: quay.io/argoproj/argocd:v3.4.5
-      env:
-        - name: SOPS_AGE_KEY_FILE
-          value: /sops-age/key.txt
-        - name: PATH
-          value: /sops-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-      volumeMounts:
-        - mountPath: /var/run/argocd
-          name: var-files
-        - mountPath: /home/argocd/cmp-server/plugins
-          name: plugins
-        - mountPath: /tmp
-          name: cmp-tmp
-        - mountPath: /home/argocd/cmp-server/config/plugin.yaml
-          subPath: sops-secrets-v1.0.yaml
-          name: argocd-cmp-cm
-        - mountPath: /sops-age
-          name: sops-age
-          readOnly: true
-        - mountPath: /sops-bin
-          name: sops-bin
-          readOnly: true
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999
+  volumeMounts:
+    - mountPath: /usr/local/bin/sops
+      name: custom-tools
+      subPath: sops
+    - mountPath: /usr/local/bin/ksops
+      name: custom-tools
+      subPath: ksops
+    - mountPath: /sops-age
+      name: sops-age
+      readOnly: true
 
   volumes:
-    - name: sops-bin
+    - name: custom-tools
       emptyDir: {}
-    - name: cmp-tmp
-      emptyDir: {}
-    - name: argocd-cmp-cm
-      configMap:
-        name: argocd-cmp-cm
     - name: sops-age
       secret:
         secretName: sops-age
@@ -138,6 +129,8 @@ configs:
   cm:
     admin.enabled: "true"
     application.instanceLabelKey: argocd.argoproj.io/instance
+    # Let every kustomize build run the ksops exec generator.
+    kustomize.buildOptions: --enable-alpha-plugins --enable-exec
     
   params:
     server.insecure: false