From 9257525b3860f54824021a4f9d47746af067b5fa Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Tue, 11 Aug 2026 20:49:38 -0700 Subject: [PATCH] feat(cert-manager): add self-signed homelab-ca ClusterIssuer + trust bundle, fix grafana-oidc secret homelab-ca was referenced by 6 manifests (authentik, forgejo-runner, blackbox-exporter, management-service) as a CA trust ConfigMap but never existed anywhere - not in git, not live in cluster. Generated a new 10-year self-signed root CA, wired it as a ClusterIssuer (cert-manager namespace) and distributed the public cert as a ConfigMap to every consuming namespace (iam, cicd, monitoring, sqs). Private key lives only in the encrypted Secret. Widened cert-manager-issuers' directory include glob rather than creating a new Application - destination.namespace is just a fallback default on a plain directory source, not a transformer, so it doesn't fight with each ConfigMap's own explicit namespace. Also adds grafana-oidc secret (GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET), same pre-existing gap as grafana-admin - was meant to come from a deleted manual script, value already available in .env. --- k8s/argocd/apps/00-substrate.yaml | 2 +- .../cert-manager/homelab-ca-configmap.yaml | 149 ++++++++++++++++++ .../cert-manager/homelab-ca-issuer.yaml | 13 ++ .../cert-manager/homelab-ca-secrets.enc.yaml | 24 +++ .../logging/grafana-oidc-secrets.enc.yaml | 23 +++ 5 files changed, 210 insertions(+), 1 deletion(-) create mode 100644 k8s/bootstrap/cert-manager/homelab-ca-configmap.yaml create mode 100644 k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml create mode 100644 k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml create mode 100644 k8s/infra/logging/grafana-oidc-secrets.enc.yaml diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml index a3fd658..ddc8657 100644 --- a/k8s/argocd/apps/00-substrate.yaml +++ b/k8s/argocd/apps/00-substrate.yaml @@ -90,7 +90,7 @@ spec: targetRevision: main path: k8s/bootstrap/cert-manager directory: - include: "letsencrypt-issuer.yaml" + include: "{letsencrypt-issuer.yaml,homelab-ca-issuer.yaml,homelab-ca-configmap.yaml}" destination: server: https://kubernetes.default.svc namespace: cert-manager diff --git a/k8s/bootstrap/cert-manager/homelab-ca-configmap.yaml b/k8s/bootstrap/cert-manager/homelab-ca-configmap.yaml new file mode 100644 index 0000000..1daf815 --- /dev/null +++ b/k8s/bootstrap/cert-manager/homelab-ca-configmap.yaml @@ -0,0 +1,149 @@ +# Public root cert for the self-signed homelab-ca, distributed so internal +# services (Authentik, forgejo-runner, management-service, blackbox-exporter) +# can trust certs cert-manager issues off the homelab-ca ClusterIssuer. +# Not sensitive — public cert only, no private key. One copy per consuming +# namespace since ConfigMaps aren't cluster-scoped. +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: homelab-ca + namespace: iam +data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIE3DCCAsQCCQDSaKg3Y7DQkzANBgkqhkiG9w0BAQsFADAwMRMwEQYDVQQDDApo + b21lbGFiLWNhMRkwFwYDVQQKDBByaW90cGlhby5ob21lbGFiMB4XDTI2MDgxMjAy + NDQ0NloXDTM2MDgwOTAyNDQ0NlowMDETMBEGA1UEAwwKaG9tZWxhYi1jYTEZMBcG + A1UECgwQcmlvdHBpYW8uaG9tZWxhYjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC + AgoCggIBAJHgqiAV49ZPDxuAzLs9gcKfUlcVkD7rWaHUFVG95nvbJ8FOXh6tVwha + TN1scv/AeIAtTEmBgnP5Tcn+PpbsLRAVUjPqBc89jZnNNHBfpGiX5MgKdlQKgxI/ + SDx3sUbk4KfFU6WPv6b8pV2sAhs4a+kztt9UJYRTsCnVHNImuyOCJxEiiT1bm8Xw + vrJqpaYOJ2eNarfZXIxCypseejbD10khUwsTMk0KIA+ygG0yIOi5H9MOcCgDfd9h + uTNKCBexiUZuI6PdG7Vf2p+t+OKciKGS+3kHsoc1pU95sFtj+3uhPKmTRKQYHTY2 + N80IbnUfv8bHRmeTrwDWWQTCLkhceYw23V/uxTczRlD6k1Z8c7y60wSsOFlWpWjA + zQmzF5Ci87I/gzoSOYhOhzE4xZ6r3+xyt9X33xxDnWh7w/otM3CGw33YwzmH5HZm + j6/m521ts2PrUhbZ1lTJ+H8GSNVfpQzZ8VbO6WlWC5vohVBTub+q3a0BKYL0bHWG + 26NmHlxWLwGGaBA88KOLaaA+bQPA+8A46hUFJrpuejrWla/Pb9RVxphH97SYW3Jn + lzpvs5tbtPGV49UdPjVypE/abaRPQfq0b9mfmBSoedEGRiFmrNq7Kknzj35nWM3z + YFdjJ0zpMKrVgo/om0FpcAsndVzyaewwQsZCHiN9eIgRoJVLrc3TAgMBAAEwDQYJ + KoZIhvcNAQELBQADggIBACM5Tej+FUpluKvWWa7dBrlBcnjp2hRJX7Iu/vBoH/br + dh1Rm7n/JmXw5foWHAH/6Ijv2LlZeY7hiHeST0MNfqWuMPGII/QCqwIGat+A/p1T + ELOPeQPsyaDuZ5kbfxYrXQNamSPAPW+bsd4U14HbXpr+u3vhPLPuZ0Ptpy6w9PqY + Rgv6IHcdJJNGkBsNeTDjGwyyd6IsmeH/OkEjHEKBe/e9KDpYFdr7pHRU/8RYxwy7 + R3LF1J3f+9k4uwbP4A232AsIDJLKGnYwGiA9lhkbQ6pbl0CQawkfyUrAyRIG12uT + TGUk2gh6jNmR31EA5cPd6iHIaiMNsFxoHzGtCoO2xt8DYZzJC5WzNYYjlhXaFz23 + QPPueCUMsXZNB91UzV1llR+uGJMePqm7jIyeUxlKCOlwG0IZqE3wkZ43WV82iZuG + ybRbwyVSKTlY6gp6d2K/FYrIkc7gwb3Dp6N1xPUTjPetIQgBLJ7DqMS65HhM3lOU + PN5PgewgyWq7w2/M8PN9gmIBhToqKgQ+5ZjSGEx9LiSdK2edXko+Nmoqs+9jpxBj + G/s9mcdhNcf2zc4t38vF+YkWMJYDxUwZU3+CoO7IcdJar7WL6puJSjt47iimj69w + RMUbo95shNurlEB4i8T6SHexnc3IW6t2YBz0GZNLgmdZobQKhszuh4fWR3wCO9/T + -----END CERTIFICATE----- +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: homelab-ca + namespace: cicd +data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIE3DCCAsQCCQDSaKg3Y7DQkzANBgkqhkiG9w0BAQsFADAwMRMwEQYDVQQDDApo + b21lbGFiLWNhMRkwFwYDVQQKDBByaW90cGlhby5ob21lbGFiMB4XDTI2MDgxMjAy + NDQ0NloXDTM2MDgwOTAyNDQ0NlowMDETMBEGA1UEAwwKaG9tZWxhYi1jYTEZMBcG + A1UECgwQcmlvdHBpYW8uaG9tZWxhYjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC + AgoCggIBAJHgqiAV49ZPDxuAzLs9gcKfUlcVkD7rWaHUFVG95nvbJ8FOXh6tVwha + TN1scv/AeIAtTEmBgnP5Tcn+PpbsLRAVUjPqBc89jZnNNHBfpGiX5MgKdlQKgxI/ + SDx3sUbk4KfFU6WPv6b8pV2sAhs4a+kztt9UJYRTsCnVHNImuyOCJxEiiT1bm8Xw + vrJqpaYOJ2eNarfZXIxCypseejbD10khUwsTMk0KIA+ygG0yIOi5H9MOcCgDfd9h + uTNKCBexiUZuI6PdG7Vf2p+t+OKciKGS+3kHsoc1pU95sFtj+3uhPKmTRKQYHTY2 + N80IbnUfv8bHRmeTrwDWWQTCLkhceYw23V/uxTczRlD6k1Z8c7y60wSsOFlWpWjA + zQmzF5Ci87I/gzoSOYhOhzE4xZ6r3+xyt9X33xxDnWh7w/otM3CGw33YwzmH5HZm + j6/m521ts2PrUhbZ1lTJ+H8GSNVfpQzZ8VbO6WlWC5vohVBTub+q3a0BKYL0bHWG + 26NmHlxWLwGGaBA88KOLaaA+bQPA+8A46hUFJrpuejrWla/Pb9RVxphH97SYW3Jn + lzpvs5tbtPGV49UdPjVypE/abaRPQfq0b9mfmBSoedEGRiFmrNq7Kknzj35nWM3z + YFdjJ0zpMKrVgo/om0FpcAsndVzyaewwQsZCHiN9eIgRoJVLrc3TAgMBAAEwDQYJ + KoZIhvcNAQELBQADggIBACM5Tej+FUpluKvWWa7dBrlBcnjp2hRJX7Iu/vBoH/br + dh1Rm7n/JmXw5foWHAH/6Ijv2LlZeY7hiHeST0MNfqWuMPGII/QCqwIGat+A/p1T + ELOPeQPsyaDuZ5kbfxYrXQNamSPAPW+bsd4U14HbXpr+u3vhPLPuZ0Ptpy6w9PqY + Rgv6IHcdJJNGkBsNeTDjGwyyd6IsmeH/OkEjHEKBe/e9KDpYFdr7pHRU/8RYxwy7 + R3LF1J3f+9k4uwbP4A232AsIDJLKGnYwGiA9lhkbQ6pbl0CQawkfyUrAyRIG12uT + TGUk2gh6jNmR31EA5cPd6iHIaiMNsFxoHzGtCoO2xt8DYZzJC5WzNYYjlhXaFz23 + QPPueCUMsXZNB91UzV1llR+uGJMePqm7jIyeUxlKCOlwG0IZqE3wkZ43WV82iZuG + ybRbwyVSKTlY6gp6d2K/FYrIkc7gwb3Dp6N1xPUTjPetIQgBLJ7DqMS65HhM3lOU + PN5PgewgyWq7w2/M8PN9gmIBhToqKgQ+5ZjSGEx9LiSdK2edXko+Nmoqs+9jpxBj + G/s9mcdhNcf2zc4t38vF+YkWMJYDxUwZU3+CoO7IcdJar7WL6puJSjt47iimj69w + RMUbo95shNurlEB4i8T6SHexnc3IW6t2YBz0GZNLgmdZobQKhszuh4fWR3wCO9/T + -----END CERTIFICATE----- +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: homelab-ca + namespace: monitoring +data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIE3DCCAsQCCQDSaKg3Y7DQkzANBgkqhkiG9w0BAQsFADAwMRMwEQYDVQQDDApo + b21lbGFiLWNhMRkwFwYDVQQKDBByaW90cGlhby5ob21lbGFiMB4XDTI2MDgxMjAy + NDQ0NloXDTM2MDgwOTAyNDQ0NlowMDETMBEGA1UEAwwKaG9tZWxhYi1jYTEZMBcG + A1UECgwQcmlvdHBpYW8uaG9tZWxhYjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC + AgoCggIBAJHgqiAV49ZPDxuAzLs9gcKfUlcVkD7rWaHUFVG95nvbJ8FOXh6tVwha + TN1scv/AeIAtTEmBgnP5Tcn+PpbsLRAVUjPqBc89jZnNNHBfpGiX5MgKdlQKgxI/ + SDx3sUbk4KfFU6WPv6b8pV2sAhs4a+kztt9UJYRTsCnVHNImuyOCJxEiiT1bm8Xw + vrJqpaYOJ2eNarfZXIxCypseejbD10khUwsTMk0KIA+ygG0yIOi5H9MOcCgDfd9h + uTNKCBexiUZuI6PdG7Vf2p+t+OKciKGS+3kHsoc1pU95sFtj+3uhPKmTRKQYHTY2 + N80IbnUfv8bHRmeTrwDWWQTCLkhceYw23V/uxTczRlD6k1Z8c7y60wSsOFlWpWjA + zQmzF5Ci87I/gzoSOYhOhzE4xZ6r3+xyt9X33xxDnWh7w/otM3CGw33YwzmH5HZm + j6/m521ts2PrUhbZ1lTJ+H8GSNVfpQzZ8VbO6WlWC5vohVBTub+q3a0BKYL0bHWG + 26NmHlxWLwGGaBA88KOLaaA+bQPA+8A46hUFJrpuejrWla/Pb9RVxphH97SYW3Jn + lzpvs5tbtPGV49UdPjVypE/abaRPQfq0b9mfmBSoedEGRiFmrNq7Kknzj35nWM3z + YFdjJ0zpMKrVgo/om0FpcAsndVzyaewwQsZCHiN9eIgRoJVLrc3TAgMBAAEwDQYJ + KoZIhvcNAQELBQADggIBACM5Tej+FUpluKvWWa7dBrlBcnjp2hRJX7Iu/vBoH/br + dh1Rm7n/JmXw5foWHAH/6Ijv2LlZeY7hiHeST0MNfqWuMPGII/QCqwIGat+A/p1T + ELOPeQPsyaDuZ5kbfxYrXQNamSPAPW+bsd4U14HbXpr+u3vhPLPuZ0Ptpy6w9PqY + Rgv6IHcdJJNGkBsNeTDjGwyyd6IsmeH/OkEjHEKBe/e9KDpYFdr7pHRU/8RYxwy7 + R3LF1J3f+9k4uwbP4A232AsIDJLKGnYwGiA9lhkbQ6pbl0CQawkfyUrAyRIG12uT + TGUk2gh6jNmR31EA5cPd6iHIaiMNsFxoHzGtCoO2xt8DYZzJC5WzNYYjlhXaFz23 + QPPueCUMsXZNB91UzV1llR+uGJMePqm7jIyeUxlKCOlwG0IZqE3wkZ43WV82iZuG + ybRbwyVSKTlY6gp6d2K/FYrIkc7gwb3Dp6N1xPUTjPetIQgBLJ7DqMS65HhM3lOU + PN5PgewgyWq7w2/M8PN9gmIBhToqKgQ+5ZjSGEx9LiSdK2edXko+Nmoqs+9jpxBj + G/s9mcdhNcf2zc4t38vF+YkWMJYDxUwZU3+CoO7IcdJar7WL6puJSjt47iimj69w + RMUbo95shNurlEB4i8T6SHexnc3IW6t2YBz0GZNLgmdZobQKhszuh4fWR3wCO9/T + -----END CERTIFICATE----- +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: homelab-ca + namespace: sqs +data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIE3DCCAsQCCQDSaKg3Y7DQkzANBgkqhkiG9w0BAQsFADAwMRMwEQYDVQQDDApo + b21lbGFiLWNhMRkwFwYDVQQKDBByaW90cGlhby5ob21lbGFiMB4XDTI2MDgxMjAy + NDQ0NloXDTM2MDgwOTAyNDQ0NlowMDETMBEGA1UEAwwKaG9tZWxhYi1jYTEZMBcG + A1UECgwQcmlvdHBpYW8uaG9tZWxhYjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCC + AgoCggIBAJHgqiAV49ZPDxuAzLs9gcKfUlcVkD7rWaHUFVG95nvbJ8FOXh6tVwha + TN1scv/AeIAtTEmBgnP5Tcn+PpbsLRAVUjPqBc89jZnNNHBfpGiX5MgKdlQKgxI/ + SDx3sUbk4KfFU6WPv6b8pV2sAhs4a+kztt9UJYRTsCnVHNImuyOCJxEiiT1bm8Xw + vrJqpaYOJ2eNarfZXIxCypseejbD10khUwsTMk0KIA+ygG0yIOi5H9MOcCgDfd9h + uTNKCBexiUZuI6PdG7Vf2p+t+OKciKGS+3kHsoc1pU95sFtj+3uhPKmTRKQYHTY2 + N80IbnUfv8bHRmeTrwDWWQTCLkhceYw23V/uxTczRlD6k1Z8c7y60wSsOFlWpWjA + zQmzF5Ci87I/gzoSOYhOhzE4xZ6r3+xyt9X33xxDnWh7w/otM3CGw33YwzmH5HZm + j6/m521ts2PrUhbZ1lTJ+H8GSNVfpQzZ8VbO6WlWC5vohVBTub+q3a0BKYL0bHWG + 26NmHlxWLwGGaBA88KOLaaA+bQPA+8A46hUFJrpuejrWla/Pb9RVxphH97SYW3Jn + lzpvs5tbtPGV49UdPjVypE/abaRPQfq0b9mfmBSoedEGRiFmrNq7Kknzj35nWM3z + YFdjJ0zpMKrVgo/om0FpcAsndVzyaewwQsZCHiN9eIgRoJVLrc3TAgMBAAEwDQYJ + KoZIhvcNAQELBQADggIBACM5Tej+FUpluKvWWa7dBrlBcnjp2hRJX7Iu/vBoH/br + dh1Rm7n/JmXw5foWHAH/6Ijv2LlZeY7hiHeST0MNfqWuMPGII/QCqwIGat+A/p1T + ELOPeQPsyaDuZ5kbfxYrXQNamSPAPW+bsd4U14HbXpr+u3vhPLPuZ0Ptpy6w9PqY + Rgv6IHcdJJNGkBsNeTDjGwyyd6IsmeH/OkEjHEKBe/e9KDpYFdr7pHRU/8RYxwy7 + R3LF1J3f+9k4uwbP4A232AsIDJLKGnYwGiA9lhkbQ6pbl0CQawkfyUrAyRIG12uT + TGUk2gh6jNmR31EA5cPd6iHIaiMNsFxoHzGtCoO2xt8DYZzJC5WzNYYjlhXaFz23 + QPPueCUMsXZNB91UzV1llR+uGJMePqm7jIyeUxlKCOlwG0IZqE3wkZ43WV82iZuG + ybRbwyVSKTlY6gp6d2K/FYrIkc7gwb3Dp6N1xPUTjPetIQgBLJ7DqMS65HhM3lOU + PN5PgewgyWq7w2/M8PN9gmIBhToqKgQ+5ZjSGEx9LiSdK2edXko+Nmoqs+9jpxBj + G/s9mcdhNcf2zc4t38vF+YkWMJYDxUwZU3+CoO7IcdJar7WL6puJSjt47iimj69w + RMUbo95shNurlEB4i8T6SHexnc3IW6t2YBz0GZNLgmdZobQKhszuh4fWR3wCO9/T + -----END CERTIFICATE----- diff --git a/k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml b/k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml new file mode 100644 index 0000000..c7ff26b --- /dev/null +++ b/k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml @@ -0,0 +1,13 @@ +# k8s/bootstrap/cert-manager/homelab-ca-issuer.yaml +# Self-signed internal CA, for services that only need to trust each other +# on the homelab LAN (not exposed to the internet, no public ACME needed). +# Root cert+key live in homelab-ca-secrets.enc.yaml (cert-manager namespace). +# The public cert is separately distributed via homelab-ca-configmap.yaml so +# non-cert-manager pods (Authentik, forgejo-runner, etc.) can trust it too. +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: homelab-ca +spec: + ca: + secretName: homelab-ca-keypair diff --git a/k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml b/k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml new file mode 100644 index 0000000..c97d8f8 --- /dev/null +++ b/k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml @@ -0,0 +1,24 @@ +apiVersion: ENC[AES256_GCM,data:oU0=,iv:3EeP5hzIKy1MR7HAcN361qTju4CuiQGXM6aqmO6Wdj8=,tag:8X8DAsv3E4DePq1HsVtjUw==,type:str] +kind: ENC[AES256_GCM,data:QJLvTWAw,iv:PUdCdWZSB0T84G3lpMASZMGDMfcI6kOOEaFxMleQMM4=,tag:ZPCpk7VooHXX3EoJYHZGwg==,type:str] +metadata: + name: ENC[AES256_GCM,data:PD2sYpXC4OmEaxDc+kJiOjoM,iv:r7S5dVjCVofPZxr3k/QNKUJZ9r9I6bnlovHuczKTe1I=,tag:YfxMOfz2hkxaSexFcAIn4Q==,type:str] + namespace: ENC[AES256_GCM,data:spnMj7c3tTdxe3NG,iv:a9k4Dza2N3jDgW0P+mQFO0tnebqlFdgDz8VoxCBaKXw=,tag:DyicmVMjc2vs9O2VDV/g9Q==,type:str] +type: ENC[AES256_GCM,data:KFto63io+fvte6QKcbr3QiU=,iv:vgtvyP+ssOOD003IL4uPY3L/LjxCsWJXaVE4scCeB4E=,tag:naazs19L3BV0ndgGak/Slg==,type:str] +stringData: + tls.crt: ENC[AES256_GCM,data:0m4hJGFUiv8bRI7YPPSAuus/aD+x7NwZgdvhjbunUXNjC7sA8Tq0BPmsYCEHi/IeWEmaZECFrztIfrYhfLSbR+Q00rmBkxWeXNzDxk12/kEOiAFSSfKrC/wM3PuLf+0hgD7w0qRBHxrgfIK56Hn+U03hgkHYp3HaGBXDYgd2Ikb7RAY3Wk8LkWprD2N8uFBsoD86PYl6VdYcBK+fP8DeV49mxBTi2Jhy1e/s2QiNunaEP4ibX1n6E3uKMn5MQsXxNpjDdLnVkW6TsCVMjxTeTzGgzFCAeYcYj2XcT3AA0tLJHPEiXTI1uPBMKBm9h2MofKP4ROF8op2DN4EHtNJywqJRqJ2OmGPLkpEloyRn2howlS+xBDNPe/GCxFJieyT6q0Zb6Cv1QDdwC3Tzc/Y5g0IFnfOXUgepQEnG5Vo/qYoe69vfxA0Ti2zeRQQcrJZ5UIGasypIrrR/1ROsJWvkZIlzilA4UqJXx1FB7fXxTA8P2KeFPti+s7zYv8oAVi5VQsZ589ahQbuzMLrbodDPvqkbGua+w0BkuYeO1rqxhWwZxlwvZkBgOZD8aHnsWpvWed/tI0keGxUxhEaPFGyXotDKLCjJArPUQQxFwHovAH997LigZVytGUpiku5BcournPQCYRkPoMMvWa2kAF/BRcgsFpFcGzCEqZtNZvrveGhLtoKIRBoJDHUqwUGb4drV2i+zR+W19mJARzr+ZtnlbUvW6hUo0aRDVE5AsEUDOvDLlNrtHCdtw5JdsL2IxBrTbNKtTeokcpFDf8sOXbD97AWBiXxAjW4q0kKYRie1KrSJcnVnQfFC9xIQv3Vswmqce3ARI8qY6c7XRLO8gAhq+xja513FIhd3O7sn9iJUwdhaSUziIL8vU5OSCyJStHPq5VZRSoaOCj/dyK/p3WI//cxAyei+djKsAef76/B5V383QsIFQGGPKoHcKj0KlkHhJmfU1xYMRhgILFbwFpZhTtLzn/+FWGUKmErYd6Zdwm2hbBEZuLX5AVOYw9N5ZKBWpCkXwfSHrLeR1sytCtZHo0UCXWiw6u+NFVQs7/k5HatFpFKZnzdy/iA4R6cbaLoFqyNPW/jRP7W5TMFwoQAu3sJ2TmbOLrR7lPbEynaCua/veaCHO2wCKqNA4xVlnzDIUxncwWz3Ag6a7pwbFhysLH7DqHFe7FAzA/BHJRlKgScC2U9Iegn+761KmM5RQATsiXHQiCBqWWc5aGriL/YhA1Cx42is3Jn8w9qrs8M1tOff9kzAD504Md+wWT8/XYb3wR8fK+9LJSYjJsb8ZB2x2Vev6WmyElkHkop4JGYyG8P5lbCBMsy1SxDviFQWgoHuY5p86d4EMiLmkr5aV4WMNeIBcSEs6R3cG8QpXJdAXkpg6UWs28ioESh1cyf/IXA0hujVMZJpt1yUBS79pGFHyQzDgrrYnPcqX7d8CO6y3SUVDMSevj5AksaN6NRPOCg7gTkMMHs84csEleue73v/K8rFthBc1/N2L1XKd7ca60SA1262hOD98af/PSSSKduOgmFYYh/+5ary1Z0AqWjF9RoMf940T9KBf0KurZutBQlsFf1FFst6WyAzJJrMrmk9H1dimmpQHlVplu+TRRw7HgRi5cOVmZaogD3HfS4JIxzIOOrJgN5fFtVEMHeXQffIB4oFFDmkO7Hul3SLrAJ3GyXCIV4wg8LWtlL+i4UcKz5gppkcKEHrc3Dzz4oCPDSqnL5qZLJS2BUy2coK9ExtSpFipawLLjpVsn6Uiiun+/z+lKYaIkv4yljy3UqtOzQHG2McmNI9dxhOFBMBX5Ir8CwXz9elR7d4UZo30ny4ruNZQs4ZeFR8HAqSQLBz57v45EmY9qqeDM+fsKlvatyqIOafiNcqGJoE+U9cmRabs7LIZjsBlyxLXFjhGDCjBC/gZusbd58Vj1WaUHd5hK01pqEpwpJEhSBGKsz4q5gD9fvEnBSqwVCtBS20ghtTFVU8THzkxo4t+3IwmhRX5rkmsE9WDw+xrX/8l+Bl43ySIk3+9pIZL8DXJkflkrqpxoaVt29X3XW/mlRru5zZXbUqTHmq2F7Wqe8t2vV2U19L6mqeT6NPrfyET7w8PD6P6PzIt6fSLj6cayD5Ak28Xves6jZ2U/Jkoolc37m7pTil1HBi9/QdZiOd7tDCrVF7S3BbMNC0/L0Z6m0u+5d3H3Folc505gi2QSdcG0MmNgPpzXkA+uu9Ul7Lj5B6/ZQ3BKTwAmOk2eIKY4rA3dRm2XPicJvfb8lqOUInnBLSzECuSNBYpbm3lshgX56BsmixPF8f10TuOsedHuiEaMFXTTH+Lg==,iv:XF6gBHB/Bt+KMgSqjTnrE7OZNdsL19a0Eat35cXkmKI=,tag:F0qjYxb6zAD9RTf/1hvyBw==,type:str] + tls.key: ENC[AES256_GCM,data:pS231THhY0lKJqmlAfEJwWzH1SQX8kfqAARI0cd1tqkKlhpuN9Jn1XlEy1oGmhtxBh4tmgLZ9tv99EzOn46DsLPxdfrmhd7w+hiVEOn8as+9CnjbrluRO5ilTL1sVbDm+NGp3Pyvr+RQUDubSR6aJzx2dFzeQmLpjywAK/ZmN2YCeN1IyZGClbV9LoL7K9CZjmP0MVSNmTVxQwmm345khP5AOHyZPE8OIvGAGQKxXTrOAJTFXBEmGPIz0LdBUaWLb0Mc4yjhg6XY7bfHty8/DgGn21fHF4OUFgPOnQbnRFHJQewq23epYIPh8oa2GaPUgumLzUGfrAFpEX86LB6wb1BkcoYYuqG00J39RKkw34YKsNBsRGOQWsCPWKCDKHGVvsBsAYBXhtvgZ6O5MQSFEoqKtbIEtwYJnmext1ovWBx4KzDo90WPm5X6q5a4Ij+glj63K695PlRcux5b4OnJHzUvaPjJgyzlIUphQJ6p6iqNB05/TOIf2s2qOE0LlE9zlw6EGZkSgSdklxPS/4844FINkhMfXfceb8wSNcnucxNIQvRnfBC4siUBkN4ddC6e2pizmqeNcPSmPvW+ZaoRrbnp1VB/NR/PpyYAGkb6uTLdVdh6kl/nIEShCpjTiKUH8dlu+4yBENcrW7hCeOjWZZc7U4USWUvWWsNdghD5GeXY1K8PR23hg8SUGoFs2gK6gsAr9eQbHWH1340yOdODaKjqVMTXGeHpQ9R9QaIIa1svbsekD6m3f+23yP4ALJUpWdXGSYJ7NbNKjpf5v5lcfZfct+9OhTJlaxDdDGFGXr0qs9xVFgYC8tnobTUAfvjcNI7JIizPKSFNr9UgfOuHQYJP6whvJRJ1AUJ+/17zbtdB2Pawyg9Z6dUp+e/MxFNlGFKx5ydx1en8NTOZvH2zmzt7nlvtpRnbcfwljlJFzjFeFIum7+dxlotjFF22hQqXXm2LWArEXDIHzG2yJU4lDva7gQdcGBYdWqd/LTMCFDYFk08bNtf2wV2MaEw4kOcPYpmRzVL0r6ToBCSLKBRCzhE3FcSIIyvWda7OhWk4xEfIFD9ESK29qyr8KJxEPxwzdbCE7tYnPlx77vq1NtWSmbkOV1nlo0r2aQWVPt2ziSwo3UrwscH+tTUQOjTQeeqhx3euFhTZ8mS9nKzHay7Jx9DIYRQ7ozRpaL38qxyg/3eD7VnPItk4Nh+TosWY2CniVZEkXRrBniJ+gzr153mrbya8/fzcTE/xpA51WU1JR+q8xY5YkDm+8f1nrogPQN/Lez1H4sjI1qyQ0PPVhNBX+kHh1n43fjOGiH3DHYAda7GqxjHfq21aGWu8zN9O60yjJYf/TYHDZgCdOIbpMuqW8TBn3YMwZUdKNVAgnU2+zy5HepHZqj59ovLL2t0n5urewDkA/NJNygpnBBm1Wxt7oOP4fTkicg4kkHQOM+u0Qh4be3Ery3KrHCDjt9yrApg6fa3zmKNNQnL3TaprpRHJ6VGO15Gd7vc0Q3wzHP3qUOpL+XbkkhZo7PoVYninb4nYZnoKcP7cGIQjxlfiDWhKRW0kTdW0eUyV8B1KhiyJ9qkHvuQPxDfjlDQs6yxAkMr11KCoESqugDizIuqgBG4n53PdltrP3cEp4ntuZ17UvHDOuNI42gb+dEC6v5pd0PI0mOtY8n0kJsl928+mW999aZXL7dN2R7ik64n45+P9tqP32o89u2MZPShDpg9HkcHqdfSXb00mNnnKIUaXPfO5i5XeiBq7nl9KXUCK6hkYCFooiKsVl8e9LcKJQeS3EDTolDtbhw3iiBjJY3Ci68qlSnsKjv6Z8ZbzsmIzrcd5lTdkMJI3b880y4RTEkWML4K2I78l9VzLe4y2BPHCnWhzyxjzVgCzRdq6KAQLzpJtqCGr+vAKiIqwOxwR5J90QSeMM+c5zDnZOBzN879F1Zln+EL4OCfn24m/3ivShQHskdzsLO0KK7jNNrlh1K4m/4+Ey/BMNu6bDUuLTuvd6NziTCoQnWIXbnV1aQ2ZtBbbwPfDhHZcXpNTt2OqVBOk3jcGsJOF+iBjkhO9n4+uVJF/9sFDZmdpNhVoJ8knjCJE1RnSLaz3UWX0gyoBgeRzyDKOJjO66RMMYCiMYHwtuI4+8s27QB/xSEjzTdigSgxjcwz9oZkRSK41cKHj6ExWQO2VGLxkZNgjoURey+cE3IcLe+UOKKnqiB/64YJwO/RxtcvXKaG9TIVczCov3N2S5vuKoa1JSjs/X0BXMvrFZQw9oB1dCaae7pY8tG0BOHKKBBsmY+jLW0D0PWj+1hptU4Ua1sqPVq8xcOm40mgJkDNhGJnyhBkUKy7jDn5kXLswAxI3RzRWlP3Sa4ss18dd/xUkEigQX5KP2xu8vecgjws/LwE7LqSGrRP5KblDtSr/CVzZ58yGg/fjrwo3KN43sHefJkrC17FWxoyV4YXxoy9jlfWINOoXO1602UshHigXWXiHtEXVvUvwst5nsqqBBPJ6j9rgemQ1gVpsghNGcmHWcMuA0gWPfF91OxsLBGb4L4pcagfEy6+j9JhHfaNW5nMRHyDORZcmkL6FfedeYZhkxcPMT4BMuagf4L2GYkZbEH8QjwGLygDK8o8KqwJod0+/cO1xTbNzFMjYZm3SygMkMUNigGpRRefVHf3+MGg4E0+lmc8LuwCwZ6ZuFOrndj+mbT3VMDzq9QngWYtYK3YY4EYxSlvqTfCeGVVIhZyiVrBz7fnzXA131BB/nREKXzNVnUcjqxpu2wp9hffJ+BDkOGRbh3eXXhLZLpWMtlvpROoHNuizzgbD0+B6BR6SLuH31lp4ooJYCHCgZUXUg+Men1VD4bMEhxd3vSlJl0EFry390lYzDg1vpt2pSI+Nkvb5J4wDIJQ7e3MAy3hy37XOGRiKTTBa5hvaUnY4Dm8TYsI49E6Cx5pfmz/NTCrUjEdKybI5PbQFCLmtCB4aN03zMNWndZDw4mDexu43octUkke1m2+XvUxew5/uVGGZ6AmOT/OJEBs2eO1CEzR3+dlFEQCv3GOmVy/dd7/QqQmhf9iLlIavu16xd2ThfEfKulF+o5ccqLy36OVc82/5nRhJElGg6bW/hRpRI+GS6AkEED2cVNYWFd1YuTUT4VNvr2vEfTftFeTVNYkrtV1u5OaWFQWRDqt8vEOkkidxmAd4VKBnrRkd1mYtnzsGRqYVKMkGc8v2R8PqU1M5PJZIzqwQLiAnjILPz5DxbTuYvbrMRkhP1V5nnk/GrpeEd/tGJN9F0K9bSI9jQ7R/eKtqZe5EfOqH0RnNsLZC+Mdp3OZbgx9swYz5zLtwD2sx+U57v22zHPGL0pcMHWgxXG8JHk1NRzlLsi4ZvKsKBwx4ya9E9BZTbSXYTQh/MbSuvcr/OMdQ1FvaL6HtJa6+Pl26+sVYXYlTLQF/t2PYU9SxFOFt34ZH2qNNIPcx0NzSN3exX34ApDSUnF0IRBF9cauG0oB+fVjB4OWTLfxY6KhZRKJhFVdyYd58GGMWMs2RBvojTf1UX2Jr9tzTK6/itk4KiCnLOV1mgmwEpvmoto6mwHzYeSgwzYnQxQxnL+Xt5O9eya7TDXp75MMynjuEujeI27D3xvCHqCEPszgNJ+p113YqO4IOTMBhwhYWl9KOIl5HEhvcVl3lZ+qPeXXG7Xui84IIUx2BVtFySAx4CKktVFUef3Z9KHEbioRJDdZuBWeJuUYMWAhBM5Gxds/BGwOMpGoAQa9USWUs8WIWvJ3MzGQOB9B0lBb/JaW+tfs4zXardzmVoBNzeDpvWpIgYXjK8ah3duliIXxNGg8U/QYmL6EC3jWTdkINwEu4qDFyU7feNocqrs4uWFalyqzehwQQiRHcF8lzDHHA9d8+l9UTiaTxbNaqiO2Bwq4gPpzx/P1IR+Pkc+Tc0QwnwGueaJRaPVa53biUKb9oZktC8u7p4l2W5PTT8Di7uo7lnSYlZfMXwsK1h3Ht+8obXPkGjtE42MflI9ADFZLjehP+hKgXn8PpeGCZl5rP4BmofzjxVKaNKI3DUavdh5DrXBcz2AP9m8qliFmI2NOKjLx6WjLzEaWXKL4pZU7KJbA0+88LrSYc828tShne4Nmyv8KDdnQ4t1YXnhuuAiJDF+nh2ouLwKmR+ru1XcBpR+sdYnaKtm7N5pDC3Lr/htoiEl4J58AOLIkYo5er8vSrXyWFUOTiYWa72DhzupAhnJqZ2ACB7lRMDvjvSaTjNM+TNzT/id4zxa8Lu35J030vXNoMGBa+QlfQozZUidtODgu+b/07KsZTqz69kDFREgmN1xk5T/1lFzpSLhcp3kdlbj8RmZ/hncOaH327nZ3ouXiSAD+NIpg+uDFqtHXgknhG9kY=,iv:z03p38PcVSVeaQ/1SwCR+HGxfzBzSO9lBdToMHL3Jao=,tag:UBGwaOV/BsyxVnvrcDS+rg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaCtRMTBEcVI1TXl5S1NN + bDUyL0N3eDVRMmN4YzZOdkpUUitQL3kzd0h3Cnh1ek16OE1VUkR2bTdVNkk2Z29O + RWRraDRTclR4WVRSZnQzRnBjb3kyNlkKLS0tIHAxbWZNaWI0RU9qRmIrSWFqQ0Fw + Rjl0L1ZBQjNPbXJMZWNkUXJxOGFub28KQCTZP02Yk19EdkkiZ379eMNRGbExoMNy + JJ/4KCa1uFoUooRE3mudpBfc5xDAe/lkW60NUFrAFYZoVmRkYH9vSg== + -----END AGE ENCRYPTED FILE----- + recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh + lastmodified: "2026-08-12T02:49:29Z" + mac: ENC[AES256_GCM,data:QiBWiTUOTnyLUbQL1kcc5rjyEBVuGIaGCW7E7ln08bS94G1oworgbmShqBx2ygXg0VZaWBLcoe45i6CC49vCPB7JJdZcVOczHC72ekYBF4foq6eJP1zttEC5HrHlGIOW9LeahHmMF8Gbodx7HQ2aps/hZ03kxS75yCyFlVuEPrk=,iv:vf+h6fR1Tu1VUyl007HLzO9vuzACd3KVYsR77u8aB1A=,tag:9JMPHhvUACi1Q4mfZTp+qA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/infra/logging/grafana-oidc-secrets.enc.yaml b/k8s/infra/logging/grafana-oidc-secrets.enc.yaml new file mode 100644 index 0000000..d4d204f --- /dev/null +++ b/k8s/infra/logging/grafana-oidc-secrets.enc.yaml @@ -0,0 +1,23 @@ +apiVersion: ENC[AES256_GCM,data:oE0=,iv:w1yJeQvN0MPZlPx8VQZmC6zkRaHW4rtjjROea0Kx9X4=,tag:Q6/g6shLyarH7fq3213uWA==,type:str] +kind: ENC[AES256_GCM,data:x2QYj605,iv:C8c/jKh5pnBOtHqXsTEchGf9DACU/5hOJ0Mp/+Jk1kg=,tag:2tE/oKg6ma0F9/hzXSoZ+w==,type:str] +metadata: + name: ENC[AES256_GCM,data:BBXxuz8iuqdpE3W3,iv:bWEqo28kH3bxzfI3ipiY6dsqhIcl9wIxBjFu0mxVGLg=,tag:aKN13YwwVYl0813BaNW2Ng==,type:str] + namespace: ENC[AES256_GCM,data:0msz8sHCrQ==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:d8owVKUbOOmo/TJ8X00WdA==,type:str] +type: ENC[AES256_GCM,data:SS8WJgF3,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:x+cc6pIRCZNxbZRWyTvzUQ==,type:str] +stringData: + GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:+jGjNWkjUZKd3vzTwkbSurCfXix3xSX567Kfq+M1mp4JoBEvWB2FAcaaYgs8NxYuQHia0v3oV+lRyoo96IOCSw==,iv:NCeW/UfIl0RvHV39ubN2mDfFp7GTQNuFv8KiEF+7KOE=,tag:WiHvx83dlIR/xTfgDS7NoA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqOE5iODMzdUlGMzY5TS8x + UUhIUDJYenIxTTNNTC96WjB2NDl1cDl6QlhrCmxrMGlEa25EQkY3WDRGMUs5S0pq + NVVacUQyV3hYNHF4WGZ6a1dFbi9xbzgKLS0tIHBYVFpQRnZwTUJQYTdjWjNkVW1W + Nm81dWZpMFBYL003Y2NSOTJOWmozMjQKntzx0PHgydDFUDdUe5EMxmaGIL8rpUh4 + +3q8rxu6wdQQ6RmgiySbpS2Cfs17z2t6zkqdVbvuyqlSkjMrMk1+bw== + -----END AGE ENCRYPTED FILE----- + recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh + lastmodified: "2026-08-11T23:33:41Z" + mac: ENC[AES256_GCM,data:0bbUl3wQjuGOoKA1c13lNYRcyQI8iUlrHibN2rJReYMqzQ37hHquxZNS3GJC4xQiXwaqNgNQeOO3BRW7qzjQWb5QxB2axVdvEaWjJzS6cxzr8/ONPELZRHFBgNkWIMi4f3fi8BTJKE2p6rsepHH6JL5JYVl8DO/j68mKUObjAe8=,iv:ojFWfOMJ8cVcKLsJBl1HjCk6sJucxsEZMxl5f59tf78=,tag:zqBso7DGAkvoJuE0PZMq0Q==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2