From abaea8823b4f6d2412c96700de99e54bd74646c5 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:49:23 -0700
Subject: [PATCH] =?UTF-8?q?refactor(argocd):=20simplify=20secrets=20approa?=
 =?UTF-8?q?ch=20=E2=80=94=20use=20directory=20source,=20manual=20Secrets?=
 =?UTF-8?q?=20for=20Stage=200?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reverts complex CMP plugin setup (helm chart doesn't support repoServer.extraContainers).
Instead: sops-secrets Application uses directory source (no plugin), emits placeholder
README. Manually-created Secrets (grafana-admin) live in target namespaces.

Full CMP plugin work deferred to future stage. Grafana values still wired to
admin.existingSecret (no-op until Secret exists, which it now does).

This unblocks cluster deployment without waiting for ArgoCD CMP plumbing.
---
 k8s/argocd/apps/00-secrets.yaml        |  3 +--
 k8s/security/ci-cd/argocd-values.yaml  | 29 --------------------------
 k8s/security/sops-secrets/00-README.md |  6 ++++++
 3 files changed, 7 insertions(+), 31 deletions(-)
 create mode 100644 k8s/security/sops-secrets/00-README.md

diff --git a/k8s/argocd/apps/00-secrets.yaml b/k8s/argocd/apps/00-secrets.yaml
index 328fcc9..a56d0e7 100644
--- a/k8s/argocd/apps/00-secrets.yaml
+++ b/k8s/argocd/apps/00-secrets.yaml
@@ -20,7 +20,6 @@ spec:
     repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
     targetRevision: main
     path: k8s/security/sops-secrets
-    plugin: {}
+    directory: {}
   destination:
     server: https://kubernetes.default.svc
-  revisionHistoryLimit: 3
diff --git a/k8s/security/ci-cd/argocd-values.yaml b/k8s/security/ci-cd/argocd-values.yaml
index e1c6df5..95f5046 100644
--- a/k8s/security/ci-cd/argocd-values.yaml
+++ b/k8s/security/ci-cd/argocd-values.yaml
@@ -47,15 +47,6 @@ configs:
       g, homelab-admins, role:admin
     policy.default: role:readonly
 
-  cmp:
-    plugins:
-      sops-secrets:
-        generate:
-          command: sh
-          args:
-            - -c
-            - /var/run/argocd/plugins/sops-cmp-generate.sh
-
 server:
   replicas: 1
   deploymentStrategy:
@@ -99,26 +90,6 @@ repoServer:
     enabled: true
     serviceMonitor:
       enabled: true
-  extraContainers:
-    - name: sops-cmp
-      image: registry.gitlab.com/argoproj/argocd-helm-charts/argocd-cmp-server:v2.12.1
-      command: [/var/run/argocd/argocd-cmp-server]
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 999
-      volumeMounts:
-        - mountPath: /var/run/argocd
-          name: var-files
-        - mountPath: /home/argocd/cmp-server/plugins
-          name: plugins
-        - mountPath: /tmp
-          name: tmp
-        - mountPath: /sops-age
-          name: sops-age
-  volumes:
-    - name: sops-age
-      secret:
-        secretName: sops-age
 
 applicationSet:
   replicas: 1
diff --git a/k8s/security/sops-secrets/00-README.md b/k8s/security/sops-secrets/00-README.md
new file mode 100644
index 0000000..942cf5d
--- /dev/null
+++ b/k8s/security/sops-secrets/00-README.md
@@ -0,0 +1,6 @@
+# SOPS-Decrypted Secrets
+
+Placeholder for CMP-generated secrets (pending full CMP plugin setup).
+
+Currently, manually-created Secrets live in individual namespaces (e.g., grafana-admin in logging/).
+Once the CMP plugin is wired, this Application will decode *.enc.yaml and emit all Secrets here.