refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-18 15:08:04 -07:00
parent e650bf792c
commit 8ff3060ff0
31 changed files with 383 additions and 393 deletions
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:oE0=,iv:w1yJeQvN0MPZlPx8VQZmC6zkRaHW4rtjjROea0Kx9X4=,tag:Q6/g6shLyarH7fq3213uWA==,type:str]
-kind: ENC[AES256_GCM,data:x2QYj605,iv:C8c/jKh5pnBOtHqXsTEchGf9DACU/5hOJ0Mp/+Jk1kg=,tag:2tE/oKg6ma0F9/hzXSoZ+w==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:BBXxuz8iuqdpE3W3,iv:bWEqo28kH3bxzfI3ipiY6dsqhIcl9wIxBjFu0mxVGLg=,tag:aKN13YwwVYl0813BaNW2Ng==,type:str]
-    namespace: ENC[AES256_GCM,data:0msz8sHCrQ==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:d8owVKUbOOmo/TJ8X00WdA==,type:str]
-type: ENC[AES256_GCM,data:SS8WJgF3,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:x+cc6pIRCZNxbZRWyTvzUQ==,type:str]
-stringData:
-    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:+jGjNWkjUZKd3vzTwkbSurCfXix3xSX567Kfq+M1mp4JoBEvWB2FAcaaYgs8NxYuQHia0v3oV+lRyoo96IOCSw==,iv:NCeW/UfIl0RvHV39ubN2mDfFp7GTQNuFv8KiEF+7KOE=,tag:WiHvx83dlIR/xTfgDS7NoA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqOE5iODMzdUlGMzY5TS8x
-            UUhIUDJYenIxTTNNTC96WjB2NDl1cDl6QlhrCmxrMGlEa25EQkY3WDRGMUs5S0pq
-            NVVacUQyV3hYNHF4WGZ6a1dFbi9xbzgKLS0tIHBYVFpQRnZwTUJQYTdjWjNkVW1W
-            Nm81dWZpMFBYL003Y2NSOTJOWmozMjQKntzx0PHgydDFUDdUe5EMxmaGIL8rpUh4
-            +3q8rxu6wdQQ6RmgiySbpS2Cfs17z2t6zkqdVbvuyqlSkjMrMk1+bw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-08-11T23:33:41Z"
-    mac: ENC[AES256_GCM,data:0bbUl3wQjuGOoKA1c13lNYRcyQI8iUlrHibN2rJReYMqzQ37hHquxZNS3GJC4xQiXwaqNgNQeOO3BRW7qzjQWb5QxB2axVdvEaWjJzS6cxzr8/ONPELZRHFBgNkWIMi4f3fi8BTJKE2p6rsepHH6JL5JYVl8DO/j68mKUObjAe8=,iv:ojFWfOMJ8cVcKLsJBl1HjCk6sJucxsEZMxl5f59tf78=,tag:zqBso7DGAkvoJuE0PZMq0Q==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,24 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:TMY=,iv:ImbG3BggYpU11BV84Kwt1NrwoSZIrsoiZovqPM2ziWQ=,tag:xbld3DauQbVC7LrOyDgU+w==,type:str]
-kind: ENC[AES256_GCM,data:PrsNgt4i,iv:6ICJnhTiMP0QFX2xQxqE59AkbtFXQ3UJwH/v/2KaQdw=,tag:wyWWV21lB+Oy23AoXDdFJQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:yceBbeA92I2IMgwPww==,iv:Aw9oxB0x3eLODe/XVGKd5A4UdKoW1ChbRM7Un0kkwFQ=,tag:wTQfMQlO+ecU0epYGh32zA==,type:str]
-    namespace: ENC[AES256_GCM,data:MNtEckGs1Q==,iv:mf2ySxEaRrsPLgkwUUjmJuzklo74t8UTeCsUean2nx0=,tag:xvhxXljTD/uKCfwS6I4IZw==,type:str]
-type: ENC[AES256_GCM,data:ykoXlXwe,iv:OMjn8JxX8g/jJSsIL911FX4autWEQDk1UGzfnnfKSjQ=,tag:8xhWjuq1jIhS9LxIGCa/PA==,type:str]
-stringData:
-    admin-user: ENC[AES256_GCM,data:TJBiqjs=,iv:UwIdUTnI2soFYGjZz6xj8boacSMYHxTg0Bl1xFLllsU=,tag:zavbhAUpsjOChoGZ17cPRQ==,type:str]
-    admin-password: ENC[AES256_GCM,data:t+vGIzaybTrLzY001A==,iv:4V3wlpMMfakInQoqD6gxk+0A6lWCm3aPw31gpa0sKss=,tag:cbduSqiUnJFj0uOCjfKDSg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZlZiOWt3SFNiYzhNL252
-            Vlh1WkNHZXYxV1ZsNG90YXhydlpJTURmS1ZBCmJYOTBvKzUvS3cvRGZRcDlQRFRS
-            c3pZNjZnbUw1Tml6eVBETnBRQ2xNK3MKLS0tIHU5UFdBSk1TUnBjdlZaODBNRkVy
-            azBhbjN6a1BRNVh0cUtMU24zK29jMlEK4Y8+P1L/O80xG+qtdF1I8fvfURX/IvtF
-            dFIn1EF7YRqMy4KWKx6QSewjo8Vx7JuBDZtRDPCGNJKIKJU3R9NK3w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-08-11T21:40:58Z"
-    mac: ENC[AES256_GCM,data:761EqFteOI+BuznsTV8+wIOoOJAnCYvIPYy9gpdHSkDf+QbW6k3HUCjvPN/sNXfAEtbjIf28W6iW+zhljAbe3lpOXrY2Fy4O9i/e1ltXvsBUND6FWB3TkdSaweycRGoAPTsR9vb74INqecR4O0LITcGHL+Yl3TLPzwSJhxiqpiU=,iv:ug2qqUEhlXharDqegsiPSrlmqV7z0qQBv8Ha96qH+Lo=,tag:JY+xjJgX7o6o83tSvng7eQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,24 +0,0 @@
-loki:
-    storage:
-        s3:
-            accessKeyId: ENC[AES256_GCM,data:rUe9BzMuNEk7Lg==,iv:a6oz4kQciHc/sqT1lu05CqI8+iJmi82JAQJ9BM5yBjo=,tag:M1CJmBQlbz/H08S2Y7eUCA==,type:str]
-            secretAccessKey: ENC[AES256_GCM,data:WEvUewgbriABBYllwMtyKsQw850Eb0J6CHc/MEY/NlsolWp9+eq6wKChknI=,iv:0rq4mv8cQ1za8ZLlR8voePiwZFdzK8sbRDDqgloO68g=,tag:r4GNYDa2fL1+d0gY5ndG1Q==,type:str]
-            bucketNames:
-                chunks: ENC[AES256_GCM,data:cAwa5qibAOvuhCk=,iv:Jqt3iHhLaHae6g4CsylytZxg+3fnTdw4PUinhaUaOCI=,tag:jVduzj+ggN9vQSD62qZ0jw==,type:str]
-                ruler: ENC[AES256_GCM,data:G1r90YhXWGkUOw==,iv:K1ddZrCVFAo+CZet+BV7KJh6RVPzGbsnVIkoZpjWCU0=,tag:o1xK1XLVtOqehTBIn9cNHg==,type:str]
-                admin: ENC[AES256_GCM,data:LhWklk60wExptQ==,iv:DpuT40Jl9H1nH04u+gm7pHFox7QrZ52WqNQuBqGiz8Y=,tag:ylGjb9J5CGXq/CxHtq732g==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVW4vV0xvaGw4VUlGL1Fa
-            Tjh4V3RUV2d5L1padVZRVkE1V3BTRjg4bzNzCndjSHowU0s5a3I4NGsxNlBUVXFo
-            M1kwQjh3Rkw0VnlDWnh4Q3NSMmdUcXMKLS0tIGl4RWNvVzVyMHo5TC93SXJyWU1G
-            QzBJK0RrSnFiaTgxNnNiZWthM1J4TnMKPb3uoQLHPSTW0+6Kgsapa5/u6cN7aJa1
-            NcQIhd/PPibvvGb47OgLrh8djg7uGpVDMMn3v0Kv3Pu5bshJjZ2gBQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T23:02:08Z"
-    mac: ENC[AES256_GCM,data:Fg9WsV1LGCgCc9TQtxJ83rthGZCpi9Is/0ab7Udry90TxUHAnfhktP/V74lh8XQq+mVOjCT5ZAw1mpM93lj92/o3ZTb2LnGoaxD4Mj/3eL1T3oH6GQH9VRb7iq+aD5BkYZQd4jmxiIVET3K8a6a7Tt1hrWeKUYz1fcsC9IFIOJQ=,iv:sF8T/Q7+RBrU3dXBBDGS2j4SSiVIpE5wBlGgK7YKGTY=,tag:wqKm9p2SctnsS0jrk4jF/w==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2