refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00
parent e650bf792c
commit 8ff3060ff0
31 changed files with 383 additions and 393 deletions
@@ -1,20 +0,0 @@
-authentik:
-    secret_key: ENC[AES256_GCM,data:55ne/khf01ZD3FP2Zek+0Ar9C+GP/GPf33PwOwgXdnOXF4kLrEwwJ/E7yrH0nkBKGO221ClGBjlo7kb5vGMmmmg8TVBa1upQbk8b0s723n8=,iv:ZkDp4gOHY1eH44cDhGaZILi8dFDTNuYf1CVE+qrapzE=,tag:JTE4tfMJSowsn9YZ0xKFng==,type:str]
-    bootstrap_password: ENC[AES256_GCM,data:vBk/ivCG4x2TlvURrDxHAiaZlxrF+PeHBAuoZR6muWw=,iv:ccA703HMomR58cD2/6wK1W0IKJb7U1hNws6fmwG15E8=,tag:MdhTx9ebXLjRCnDpUxpJ0g==,type:str]
-    bootstrap_token: ENC[AES256_GCM,data:NwGZzaL8JufXYp6sjeeN1etdgaHT8IuaZFLZJegzs+fPXMvVCGPKKlStythIOa3gwgCXkhA+kV8+jyxYKr1UMw==,iv:EJCetXnkNe+UuhWk4f3vr3kIEbCuVplVKHPne3aVIQ8=,tag:kwlE+9O6DczO+mn9Rqx+Rw==,type:str]
-    postgresql_password: ENC[AES256_GCM,data:+WeZKo+24awwWfTAt5q6KJRkqaHD7YmlnKm4oGaUNvw=,iv:VSJ3d8p4f5SQM2lVdhSLY5dqdQTKwcfzOCATIM5M/cw=,tag:6K8mQmyLEg7KJi3bg+zPig==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSDJSYmRQNDdjWjlORmJX
-            Zm9yd2xRNi9XKy95Y2NQWUMyTGxjb1NjRTNzCnlNbko5NVJVSitiaE1DQ2QvMVoy
-            czRya01EaFZmZzAzcjRESG5NY1JIVTAKLS0tIFZ1UkREaGc4VUczMjFITWR6N0Ez
-            NStJZmpuWEw1dlRFcExZUlFLWkpBSFkK9r0NG3IKV7+AU00VXVCuHu+aBOOLydD0
-            ncioyDrJWgkyDxn9+BNZh4vX8vEERANYh+1/3P99Ubz28tifhmi2vg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T23:22:55Z"
-    mac: ENC[AES256_GCM,data:+MqbhlVnhriigDEj/AMJj4yLjcIjxkQc4QANcVeAXefcljHS4yOVtrwh2js3l9WVyIgVdl0MdlW+ycykBU4Pi3u4sdJoiJd945wZDsHvFCREYZIZdsVW/EHmKjIroqxQfeEtbWDStkaE+WTF/yGrZ2HLLztrXIafxZq7KhbXlo0=,iv:PCzhd8j539BxvpQQCds1vMXm3gfmlvSnrbtfOpFaKrY=,tag:NiHwSfQRvf//lpjFAKA1Jg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,24 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:6rk=,iv:KFms9ElUhHn+w9flx5nzLfwvfJsMN0u8+YDMqFgB6V8=,tag:bT1/FnwegVzqMmnYvLgiQg==,type:str]
-kind: ENC[AES256_GCM,data:9nKNMjB+,iv:rzn3Pt2pJcbDj55NYafUamNLTBrtluUPeLKorzpskGA=,tag:RNP8/lD/8yBGLNxsti+OXw==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:yNadKj5FHjMNYtpHwwoPolM=,iv:f9pwyirRf/mLqr8LhuNPE53guP5mlZmPftNhtFKSbFA=,tag:ch5+QHuzDqV0b1sJ/yZp7A==,type:str]
-    namespace: ENC[AES256_GCM,data:6Qia,iv:rkU3kw12xPeVkVRn3w8WIZlc0+11jGeg1jZBX3kRfaQ=,tag:S0tx0vf3cYb9rKW0puKClQ==,type:str]
-type: ENC[AES256_GCM,data:482sksR1,iv:7gmqUtqcYzDHp99fYdinL4yYSTvjoyHlTnhHbEynGQY=,tag:zTY3HrpCS/GH8FZiskA+ng==,type:str]
-stringData:
-    access_key: ENC[AES256_GCM,data:j1D85IgXb7IMAA==,iv:QuGF69veC8FWOSAbwzv7vhKYkF0yOp0ty/U0hdmroAA=,tag:oNfKovQ7wY3tSBWMEJ2QiA==,type:str]
-    secret_key: ENC[AES256_GCM,data:ptw+7ykLtHYzzFWWofRCVuo0wlW+NvaJEvbZJUU0VWM5DJ0xC6bnbvKKOvc=,iv:dyKnNC8255FCmOd61xczuk0Ww9MYZmHCDc+JY60AjIQ=,tag:2j8ogpKxElsI3En+NDL2Hw==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSQkVqdUUwY1BJbk10b1J0
-            aVBoTjIvelpGNldGRlQrdDJPdHRieXVkSFRjCkhSajhVSDJqSmNBMm90SGM3Z3Nm
-            eDFYVnl5dEtySjZJY01lamFDdHBSUGsKLS0tIDlSZTRJbkRxTXdXb0plWkVVelQ2
-            a1FWbm9Xd05tM0hoNkRQTHRleC9yZGsKWZnhsPX4bWrF5SGRncN566mywyYCL+EW
-            AEiIoIRhaue1bzamEAa1qj3Weg7IR4ORDAyNqW8BKdDyzYf+S8U0qg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-08-11T22:57:06Z"
-    mac: ENC[AES256_GCM,data:M09M9xNROHSkUfmNZgZ5SF08249AnGGEFbLPsQwgYpHSNt49lEXBtUYKoFDeITfh//orACF/qk7NXwNIr3x2i/6NGEipbRGXl9JcOrT8Df5Z64CRT365Y5agomagOZHJcb5cw238ejaaSfErZ9R8ZmAtK5kbnW8PvELPdovaMTU=,iv:TcMdAX2dx4M8jSahkLE7/vxmLM/hzbYOyDv5tyPWllk=,tag:0JnakV3PwwG0jq+hcghgiw==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2