From a816045d3ba1024b0eca07371daeaaadcb4fd378 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Thu, 13 Aug 2026 18:02:52 -0700 Subject: [PATCH] =?UTF-8?q?fix(argocd):=20clone=20the=20public=20GitHub=20?= =?UTF-8?q?seed=20anonymously=20over=20HTTPS=20and=20delete=20the=20SSH=20?= =?UTF-8?q?deploy-key=20Secret=20=E2=80=94=20its=20private=20half=20had=20?= =?UTF-8?q?been=20committed=20in=20plaintext=20to=20a=20public=20remote,?= =?UTF-8?q?=20and=20a=20public=20repo=20needs=20no=20credential=20at=20all?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bootstrap.sh | 17 ++++------- k8s/argocd/apps/00-secrets.yaml | 2 +- k8s/argocd/apps/00-substrate.yaml | 6 ++-- k8s/argocd/apps/10-storage-observability.yaml | 14 +++++----- k8s/argocd/apps/20-logging.yaml | 6 ++-- k8s/argocd/apps/30-security.yaml | 8 +++--- k8s/argocd/apps/40-data.yaml | 2 +- k8s/argocd/apps/50-messaging.yaml | 6 ++-- k8s/argocd/apps/55-api-gateway.yaml | 4 +-- k8s/argocd/apps/60-applications.yaml | 12 ++++---- k8s/argocd/projects/homelab-project.yaml | 2 +- k8s/argocd/root/homelab-root.yaml | 2 +- k8s/argocd/seed-repo-secret.yaml | 19 ------------- .../phase4-argocd/root-app-github.yaml | 6 ++-- .../seed-repo-secret.example.yaml | 28 ------------------- 15 files changed, 41 insertions(+), 93 deletions(-) delete mode 100644 k8s/argocd/seed-repo-secret.yaml delete mode 100644 k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml diff --git a/bootstrap.sh b/bootstrap.sh index 3c0f7dd..5fa961f 100755 --- a/bootstrap.sh +++ b/bootstrap.sh @@ -12,16 +12,15 @@ # - Talos cluster up; kubectl context points at it # - helm 3, kubectl # - SOPS age key at $SOPS_KEY (for the ArgoCD SOPS CMP plugin) -# - GitHub read-only deploy key private half at $DEPLOY_KEY (public half added -# to the GitHub repo's Deploy keys) +# +# The GitHub seed repo is public, so it is cloned anonymously over HTTPS — no +# deploy key, no repository Secret, one less thing to bootstrap before ArgoCD. # set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BOOT="$SCRIPT_DIR/k8s/bootstrap" SOPS_KEY="${SOPS_KEY:-$HOME/.sops/key.txt}" -DEPLOY_KEY="${DEPLOY_KEY:-$HOME/.ssh/argocd_seed}" -GITHUB_SSH="git@github.com:Riotpiaole/riotpiao.homelab.com.git" log() { echo "[$(date +%H:%M:%S)] $*"; } die() { echo "ERROR: $*" >&2; exit 1; } @@ -39,7 +38,6 @@ preflight() { kubectl cluster-info >/dev/null || die "kubectl not configured / cluster unreachable" command -v helm >/dev/null || die "helm 3 not found" [[ -f "$SOPS_KEY" ]] || die "SOPS age key missing at $SOPS_KEY" - [[ -f "$DEPLOY_KEY" ]] || die "GitHub deploy key missing at $DEPLOY_KEY (see phase4-argocd/seed-repo-secret.example.yaml)" log "✅ preflight ok" } @@ -194,13 +192,10 @@ p3_forgejo() { p4_argocd() { phase "PHASE 4: ArgoCD (seeded from GitHub)" - # Always ensure namespace + repository secret (idempotent) + # Always ensure namespace (idempotent). The seed repo is public — ArgoCD clones + # it anonymously over HTTPS, so there is no repository Secret to create. kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f - - kubectl -n argocd create secret generic seed-github-repo \ - --from-literal=type=git --from-literal=url="$GITHUB_SSH" \ - --from-file=sshPrivateKey="$DEPLOY_KEY" --dry-run=client -o yaml | kubectl apply -f - - kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository --overwrite 2>/dev/null || true - + # Decrypt and apply any encrypted secrets from bootstrap dir (local SOPS) if command -v sops &> /dev/null; then export SOPS_AGE_KEY_FILE="$SOPS_KEY" diff --git a/k8s/argocd/apps/00-secrets.yaml b/k8s/argocd/apps/00-secrets.yaml index 73343f0..78c9262 100644 --- a/k8s/argocd/apps/00-secrets.yaml +++ b/k8s/argocd/apps/00-secrets.yaml @@ -17,7 +17,7 @@ spec: syncOptions: - CreateNamespace=true source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main # ksops decrypts every *.enc.yaml here at kustomize-build time (repo-server # runs `kustomize build --enable-alpha-plugins --enable-exec`). Replaces the diff --git a/k8s/argocd/apps/00-substrate.yaml b/k8s/argocd/apps/00-substrate.yaml index d4900d4..f5cb800 100644 --- a/k8s/argocd/apps/00-substrate.yaml +++ b/k8s/argocd/apps/00-substrate.yaml @@ -21,7 +21,7 @@ spec: helm: valueFiles: - $values/k8s/bootstrap/cert-manager/cert-manager-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -93,7 +93,7 @@ spec: project: homelab revisionHistoryLimit: 3 source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main # A real kustomization.yaml (resources: the 3 issuer/CA files) renders these # deterministically. The previous directory.include with bare filenames @@ -127,7 +127,7 @@ spec: project: homelab revisionHistoryLimit: 3 source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/bootstrap/ingress destination: diff --git a/k8s/argocd/apps/10-storage-observability.yaml b/k8s/argocd/apps/10-storage-observability.yaml index 4e0e8ab..8e26140 100644 --- a/k8s/argocd/apps/10-storage-observability.yaml +++ b/k8s/argocd/apps/10-storage-observability.yaml @@ -17,7 +17,7 @@ spec: helm: valueFiles: - $values/k8s/infra/minio/minio-operator-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -41,7 +41,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/infra/minio destination: @@ -66,7 +66,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/infra/longhorn destination: @@ -94,7 +94,7 @@ spec: skipCrds: true valueFiles: - $values/k8s/infra/monitoring/prometheus-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -144,7 +144,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/infra/monitoring/crds destination: @@ -175,7 +175,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/infra/monitoring destination: @@ -205,7 +205,7 @@ spec: helm: valueFiles: - $values/k8s/infra/monitoring/blackbox-exporter-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: diff --git a/k8s/argocd/apps/20-logging.yaml b/k8s/argocd/apps/20-logging.yaml index 87249cb..c9c767e 100644 --- a/k8s/argocd/apps/20-logging.yaml +++ b/k8s/argocd/apps/20-logging.yaml @@ -19,7 +19,7 @@ spec: helm: valueFiles: - $values/k8s/infra/logging/loki-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -53,7 +53,7 @@ spec: helm: valueFiles: - $values/k8s/infra/logging/grafana-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -87,7 +87,7 @@ spec: helm: valueFiles: - $values/k8s/infra/logging/promtail-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: diff --git a/k8s/argocd/apps/30-security.yaml b/k8s/argocd/apps/30-security.yaml index 5a2e95a..1e78989 100644 --- a/k8s/argocd/apps/30-security.yaml +++ b/k8s/argocd/apps/30-security.yaml @@ -17,7 +17,7 @@ spec: helm: valueFiles: - $values/k8s/infra/iam/vault-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -46,7 +46,7 @@ spec: helm: valueFiles: - $values/k8s/infra/iam/authentik-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -68,7 +68,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/infra/iam destination: @@ -90,7 +90,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/infra/forgejo-runner destination: diff --git a/k8s/argocd/apps/40-data.yaml b/k8s/argocd/apps/40-data.yaml index c2e5e76..7dd5288 100644 --- a/k8s/argocd/apps/40-data.yaml +++ b/k8s/argocd/apps/40-data.yaml @@ -14,7 +14,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/infra/databases destination: diff --git a/k8s/argocd/apps/50-messaging.yaml b/k8s/argocd/apps/50-messaging.yaml index f42b86d..b71365d 100644 --- a/k8s/argocd/apps/50-messaging.yaml +++ b/k8s/argocd/apps/50-messaging.yaml @@ -68,7 +68,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/apps/messaging/kafka-cluster destination: @@ -89,7 +89,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/apps/messaging/queue-crd destination: @@ -110,7 +110,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/apps/messaging/management-service destination: diff --git a/k8s/argocd/apps/55-api-gateway.yaml b/k8s/argocd/apps/55-api-gateway.yaml index 5668e00..8da65c8 100644 --- a/k8s/argocd/apps/55-api-gateway.yaml +++ b/k8s/argocd/apps/55-api-gateway.yaml @@ -28,13 +28,13 @@ spec: helm: valueFiles: - $values/k8s/apps/api/kong-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values # The nginx Ingress for api.riotpiao.com. Kept in this Application rather # than the central k8s/bootstrap/ingress/ingress.yaml because that one syncs # in wave 1, before namespace `api` exists. - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/apps/api destination: diff --git a/k8s/argocd/apps/60-applications.yaml b/k8s/argocd/apps/60-applications.yaml index c9a61ed..2122e9b 100644 --- a/k8s/argocd/apps/60-applications.yaml +++ b/k8s/argocd/apps/60-applications.yaml @@ -19,7 +19,7 @@ spec: helm: valueFiles: - $values/k8s/apps/temporal/temporal-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -48,7 +48,7 @@ spec: helm: valueFiles: - $values/k8s/apps/portainer/portainer-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values destination: @@ -71,7 +71,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/apps/cloudflared destination: @@ -104,7 +104,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/apps/sms destination: @@ -133,10 +133,10 @@ spec: helm: valueFiles: - $values/k8s/apps/homarr/homarr-values.yaml - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main ref: values - - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/apps/homarr # PostSync hook: fix-probes-job.yaml destination: diff --git a/k8s/argocd/projects/homelab-project.yaml b/k8s/argocd/projects/homelab-project.yaml index 93b7683..bcee254 100644 --- a/k8s/argocd/projects/homelab-project.yaml +++ b/k8s/argocd/projects/homelab-project.yaml @@ -11,7 +11,7 @@ metadata: spec: description: Homelab GitOps — single-repo, in-cluster destinations only sourceRepos: - - git@github.com:Riotpiaole/riotpiao.homelab.com.git + - https://github.com/Riotpiaole/riotpiao.homelab.com.git # Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/* - https://cloudnative-pg.github.io/charts - https://dl.gitea.com/charts/ diff --git a/k8s/argocd/root/homelab-root.yaml b/k8s/argocd/root/homelab-root.yaml index 42954b4..0670bab 100644 --- a/k8s/argocd/root/homelab-root.yaml +++ b/k8s/argocd/root/homelab-root.yaml @@ -12,7 +12,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git targetRevision: main path: k8s/argocd/apps directory: diff --git a/k8s/argocd/seed-repo-secret.yaml b/k8s/argocd/seed-repo-secret.yaml deleted file mode 100644 index eb844fa..0000000 --- a/k8s/argocd/seed-repo-secret.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: github-repo-creds - namespace: argocd - labels: - argocd.argoproj.io/secret-type: repo-creds -stringData: - type: git - url: git@github.com:git@github.com:Riotpiaole/riotpiao.homelab.com.git - sshPrivateKey: | - -----BEGIN OPENSSH PRIVATE KEY----- - b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW - QyNTUxOQAAACAqZaKCvVj9z9JtQ8kyNpE42siEoEoUXTftc4zz+dAerQAAAKg5eEfbOXhH - 2wAAAAtzc2gtZWQyNTUxOQAAACAqZaKCvVj9z9JtQ8kyNpE42siEoEoUXTftc4zz+dAerQ - AAAECTvujulFODUs/5miSpkwqqovKyuK3TSOSXFR8tNYOYKyplooK9WP3P0m1DyTI2kTja - yISgShRdN+1zjPP50B6tAAAAIXJvY2tsaWFuZ0BSb2NrZGVNYWNCb29rLVByby5sb2NhbA - ECAwQ= - -----END OPENSSH PRIVATE KEY----- diff --git a/k8s/bootstrap/phase4-argocd/root-app-github.yaml b/k8s/bootstrap/phase4-argocd/root-app-github.yaml index f574a4f..29df435 100644 --- a/k8s/bootstrap/phase4-argocd/root-app-github.yaml +++ b/k8s/bootstrap/phase4-argocd/root-app-github.yaml @@ -3,8 +3,8 @@ # GitHub seed so ArgoCD can deploy everything after the control plane. After # Forgejo is healthy + mirroring GitHub, cut over with phase5-cutover/root-app-forgejo.yaml. # -# repoURL is the SSH form — must match the `url` in the seed-repo deploy-key Secret -# (see seed-repo-secret.example.yaml). Apply that Secret before this. +# repoURL is anonymous HTTPS — the seed repo is public, so no deploy key and no +# repository Secret are needed. Nothing to apply before this. --- apiVersion: v1 kind: Namespace @@ -44,7 +44,7 @@ metadata: spec: project: homelab source: - repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git # GitHub seed (SSH) + repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git # GitHub seed (SSH) targetRevision: main path: k8s/argocd/apps destination: diff --git a/k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml b/k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml deleted file mode 100644 index d71d3d9..0000000 --- a/k8s/bootstrap/phase4-argocd/seed-repo-secret.example.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# ArgoCD repo credential for the PRIVATE GitHub seed — deploy key (read-only). -# Apply at Phase 0 BEFORE root-app-github.yaml. This is a TEMPLATE: never commit -# the real private key. -# -# ssh-keygen -t ed25519 -C "argocd@homelab" -f argocd_seed -N "" -# # add argocd_seed.pub → GitHub repo → Settings → Deploy keys (Read-only, no write) -# kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f - -# kubectl -n argocd create secret generic seed-github-repo \ -# --from-literal=type=git \ -# --from-literal=url=git@github.com:Riotpiaole/riotpiao.homelab.com.git \ -# --from-file=sshPrivateKey=argocd_seed -# kubectl -n argocd label secret seed-github-repo argocd.argoproj.io/secret-type=repository -# -# url MUST match root-app-github.yaml's repoURL (SSH form). -apiVersion: v1 -kind: Secret -metadata: - name: seed-github-repo - namespace: argocd - labels: - argocd.argoproj.io/secret-type: repository -stringData: - type: git - url: git@github.com:Riotpiaole/riotpiao.homelab.com.git - sshPrivateKey: | - -----BEGIN OPENSSH PRIVATE KEY----- - REPLACE-WITH-READ-ONLY-DEPLOY-KEY-PRIVATE-HALF — DO NOT COMMIT THE REAL KEY - -----END OPENSSH PRIVATE KEY-----