fix(logging): deploy loki-s3-creds as kind:Secret via ksops — was a helm-values fragment wired to nothing, loki extraEnvFrom secretRef loki-s3-creds never resolved (CreateContainerConfigError); provides access_key_id/secret_access_key for MinIO S3 backend

k8s/argocd/secrets/_deferred-values-fragments/loki-secrets.enc.yaml

@@ -1,24 +0,0 @@
-loki:
-    storage:
-        s3:
-            accessKeyId: ENC[AES256_GCM,data:vH6ysm5g9tDxmQ==,iv:a6oz4kQciHc/sqT1lu05CqI8+iJmi82JAQJ9BM5yBjo=,tag:90PuLvoHdm2GUKN931B4CQ==,type:str]
-            secretAccessKey: ENC[AES256_GCM,data:SC8AU4nRAlSeWPumJ+RY6MGQgfXpw0HDILG52urcNISDyB/5ViKZsfHinps=,iv:0rq4mv8cQ1za8ZLlR8voePiwZFdzK8sbRDDqgloO68g=,tag:cljugMlbkwvzVzdNS929mA==,type:str]
-            bucketNames:
-                chunks: ENC[AES256_GCM,data:byLUVs3mp4N/eDs=,iv:Jqt3iHhLaHae6g4CsylytZxg+3fnTdw4PUinhaUaOCI=,tag:uGsocMDRYltQxpPCsDffrA==,type:str]
-                ruler: ENC[AES256_GCM,data:Fqmd8hmoo4V8pw==,iv:K1ddZrCVFAo+CZet+BV7KJh6RVPzGbsnVIkoZpjWCU0=,tag:gTi2VInLznoOKDh5UPDpSQ==,type:str]
-                admin: ENC[AES256_GCM,data:Hn0yFD0ApG9+bw==,iv:DpuT40Jl9H1nH04u+gm7pHFox7QrZ52WqNQuBqGiz8Y=,tag:KI9dlstNNC7ZRj5TqFWpDQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERnBENi81eVpWVDRndkRu
-            a05mM3kvUVFKVWdEVWxKMjFDMVhpUXJGeVUwCmQ0bjQrMUNBbXByNENGNEtSbGdO
-            NVVRNlZFK2FOV3Y3ZTJpRGloV0hCVEkKLS0tIGxoaSsvVTlvdk5SdklqemxWWUs3
-            dE40YVlOTlFray9aNUhpZ2t1VU4xY2MKyKmoJGrsjA3uoglXjfs6s0IXeswbO5K+
-            eayKHEaxky+lngiLBlw7b0S94eGAAHHyNNA2Ii93UuK89RmK8pWRxQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:4Bjk5OYL7lnbt1WBcLQvKxJDn6aRaACFSPXpvF1mzb2dNN4sG9di3BErV5tB7BTtRC6Z3C57IrV6u5FUIKNRg46oFGIv5FoQpzvR9OA7G+wN+gCaMg/hv9ruBqOUhjsHLRUWGqI9aou2cQt3V7I/L8a5eEWkoBquA9YJjEkwPEk=,iv:H9PjzPpFKMlDjETU/lutXHOADzWYX1kg42mmea4+3o4=,tag:XCvH+svw/A8dr0FnzGdgeQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/loki-secrets.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: ENC[AES256_GCM,data:44k=,iv:X+aWGTBFUqzlKT6iCR/LN5ldJcT0mSt9q3bMYbm/094=,tag:WDq6/nb4lzmyJ54QmrkDEQ==,type:str]
+kind: ENC[AES256_GCM,data:Rzk5Z+Hy,iv:WGtDcuwwxveu72V1Ri+rh44IQL4CixKsISW6R6Ai1AA=,tag:fTqJaqQpA4yDHd8hY628rQ==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:XOUsgfr64/dKRSMt6g==,iv:78DvUfW9uxmVSr4LK5HS/GlTchRsaTBEMmqjtHwAwcg=,tag:EvmBXKJSX3iQyjojAX7T0w==,type:str]
+    namespace: ENC[AES256_GCM,data:xWSxbuMa1Q==,iv:FDj3unj17suAuxzow1iLUztImC0dT5e5QuzY6uPQXV4=,tag:kp9Qn4/uWPgIFfoEchsOgQ==,type:str]
+type: ENC[AES256_GCM,data:luksVJs2,iv:gYL9JD63cgNp3mKqPc9liLdO9n/+qOK+Eb92uV5Ex7c=,tag:ECPwT8UUnLgr3OcMvhdg8A==,type:str]
+stringData:
+    access_key_id: ENC[AES256_GCM,data:ZPX1IGcFZfxquA==,iv:9jKQl0nZYc5qfO9mdvfHhfG1a/0+mZ+tmZm20LQ2gg0=,tag:Rlq90E6Wq7el0MEiQDmIFA==,type:str]
+    secret_access_key: ENC[AES256_GCM,data:49BtPfJS57tifvyoO5DhK9os+O52b7igVSjdB1h86trEsXPle7KaUCkFXus=,iv:Uvy3pUpYlsZQkxMG2tKnXYD7Us4RcP1DmGWlNlUp0Ek=,tag:SrVny6/3Gt8XO4oI/VTmGQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2MFh4Y2xTelhGNXV4SG5x
+            TTROWS9LOXViRmRnM0FDajBYTUlnZ1R2M0RjCkp1Wk1LY1E0YXV4cWpvZDZ3S1Yz
+            SmNaaGxZVjdBQW55WDZqckh0aDkrNVkKLS0tIDVkZzdQeERybm0vZUQvZlhCK2hI
+            T2ZlWVJaMVBxanFIYStZRi82dGZxL1kKfQQoQlY3vVbU3Ys7TiEbDzCv5zFuki2m
+            LSJ3zaaRAm5ldnfvX6N7fiTJed7Qo/rbmMoDSCrxj5P0SA4UhCefEA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-08-12T20:43:24Z"
+    mac: ENC[AES256_GCM,data:qxnq1Rc2DYN8VI1V9Qbsg28dZALu1dozbkcWpGA5T8qAHoH8ORo16ZgS3RclAmKys0n05DzvNtnVh2jXWupg/OW8K4Kn7Mrcb6AmEi5XZAlkCy6tzZEKdm22h4A07wy12701nIf5Rn2dKt9PO60oDZeR/5S9oov47sDXjy578WY=,iv:fyqI/RVnvb2MsGrxNO0GU0+HYgLpAm3PXXOnDGkAaNQ=,tag:dcguaqaj+trqgBfiGdhZTw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

k8s/argocd/secrets/secret-generator.yaml

@@ -14,5 +14,6 @@ files:
   - grafana-secrets.enc.yaml
   - homarr-secrets.enc.yaml
   - homelab-ca-secrets.enc.yaml
+  - loki-secrets.enc.yaml
   - minio-secrets.enc.yaml
   - vault-secrets.enc.yaml