From beb3cb21a097aedec7bba869b94d565e3a068e1b Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Wed, 12 Aug 2026 13:16:15 -0700 Subject: [PATCH] =?UTF-8?q?refactor(argocd):=20replace=20SOPS=20CMP=20with?= =?UTF-8?q?=20ksops=20kustomize=20generator,=20rotate=20age=20key=20?= =?UTF-8?q?=E2=80=94=20CMP=20discover=20glob=20silently=20shadowed=20kusto?= =?UTF-8?q?mize=20rendering=20of=20any=20app=20whose=20path=20held=20a=20.?= =?UTF-8?q?enc.yaml=20(MinIO=20Tenant/cloudflared/authentik=20jobs=20never?= =?UTF-8?q?=20applied);=20centralize=208=20Secret=20manifests=20under=20k8?= =?UTF-8?q?s/argocd/secrets,=20defer=204=20helm-values=20fragments?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .sops.yaml | 2 +- .../cloudflared/cloudflared-secrets.enc.yaml | 17 ----- k8s/apps/homarr/homarr-secrets.enc.yaml | 23 ------ k8s/apps/temporal/temporal-secrets.enc.yaml | 18 ----- k8s/argocd/apps/00-secrets.yaml | 8 +- .../authentik-secrets.enc.yaml | 20 +++++ .../cloudflared-secrets.enc.yaml | 17 +++++ .../loki-secrets.enc.yaml | 24 ++++++ .../temporal-secrets.enc.yaml | 18 +++++ .../secrets/cloudflare-secrets.enc.yaml | 23 ++++++ k8s/argocd/secrets/forgejo-secrets.enc.yaml | 26 +++++++ .../secrets/grafana-oidc-secrets.enc.yaml | 23 ++++++ k8s/argocd/secrets/grafana-secrets.enc.yaml | 24 ++++++ k8s/argocd/secrets/homarr-secrets.enc.yaml | 23 ++++++ .../secrets/homelab-ca-secrets.enc.yaml | 24 ++++++ k8s/argocd/secrets/kustomization.yaml | 8 ++ k8s/argocd/secrets/minio-secrets.enc.yaml | 72 ++++++++++++++++++ k8s/argocd/secrets/secret-generator.yaml | 17 +++++ k8s/argocd/secrets/vault-secrets.enc.yaml | 24 ++++++ .../cert-manager/cloudflare-secrets.enc.yaml | 23 ------ .../cert-manager/homelab-ca-secrets.enc.yaml | 24 ------ .../phase3-forgejo/forgejo-secrets.enc.yaml | 26 ------- .../phase4-argocd/argocd-cmp-cm.yaml | 30 -------- .../phase4-argocd/argocd-values.yaml | 75 +++++++++---------- k8s/infra/iam/authentik-secrets.enc.yaml | 20 ----- k8s/infra/iam/vault-secrets.enc.yaml | 24 ------ .../logging/grafana-oidc-secrets.enc.yaml | 23 ------ k8s/infra/logging/grafana-secrets.enc.yaml | 24 ------ k8s/infra/logging/loki-secrets.enc.yaml | 24 ------ .../logging/loki-values-secrets.enc.yaml | 0 k8s/infra/minio/minio-secrets.enc.yaml | 72 ------------------ 31 files changed, 383 insertions(+), 393 deletions(-) delete mode 100644 k8s/apps/cloudflared/cloudflared-secrets.enc.yaml delete mode 100644 k8s/apps/homarr/homarr-secrets.enc.yaml delete mode 100644 k8s/apps/temporal/temporal-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/_deferred-values-fragments/cloudflared-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/_deferred-values-fragments/loki-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/_deferred-values-fragments/temporal-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/cloudflare-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/forgejo-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/grafana-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/homarr-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/homelab-ca-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/kustomization.yaml create mode 100644 k8s/argocd/secrets/minio-secrets.enc.yaml create mode 100644 k8s/argocd/secrets/secret-generator.yaml create mode 100644 k8s/argocd/secrets/vault-secrets.enc.yaml delete mode 100644 k8s/bootstrap/cert-manager/cloudflare-secrets.enc.yaml delete mode 100644 k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml delete mode 100644 k8s/bootstrap/phase3-forgejo/forgejo-secrets.enc.yaml delete mode 100644 k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml delete mode 100644 k8s/infra/iam/authentik-secrets.enc.yaml delete mode 100644 k8s/infra/iam/vault-secrets.enc.yaml delete mode 100644 k8s/infra/logging/grafana-oidc-secrets.enc.yaml delete mode 100644 k8s/infra/logging/grafana-secrets.enc.yaml delete mode 100644 k8s/infra/logging/loki-secrets.enc.yaml delete mode 100644 k8s/infra/logging/loki-values-secrets.enc.yaml delete mode 100644 k8s/infra/minio/minio-secrets.enc.yaml diff --git a/.sops.yaml b/.sops.yaml index 45b7544..b377c7f 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -1,3 +1,3 @@ creation_rules: - path_regex: k8s/.*secrets.*\.ya?ml - age: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh + age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla diff --git a/k8s/apps/cloudflared/cloudflared-secrets.enc.yaml b/k8s/apps/cloudflared/cloudflared-secrets.enc.yaml deleted file mode 100644 index 690cb43..0000000 --- a/k8s/apps/cloudflared/cloudflared-secrets.enc.yaml +++ /dev/null @@ -1,17 +0,0 @@ -cloudflared: - tunnelToken: ENC[AES256_GCM,data:GrZNC75M1T304m+MBbgcL9Wa6VD3Cc+joERjUWD7PsI5NlqFpVuorzub4OTaiE/F0sqDXtXdSwQP9jGTkgUnNbviUVEIBDb+zuiyzCfzuhc53oMvoUYRkRNeH5DR9TBEszspj8+mjQMDAKQFKtTmyDodgh8DdPg8LE8YTCqyx6CcpkGZ8yWY06VoKpZfFSOan/gHwRwG2500P8U+rzI676EKVUhWjBFP0iTbwDQR7spI7oz8Gon/0Q==,iv:O3i0v+M5L3i9O7SbBtDAJe5IsQDgw+alI0Y9arZNojs=,tag:/T63FivzvbLFaXEaBsn5FA==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpU2tjOGpJNk9leE9LSnlx - b2tVbFFMMkZ3OHZuU0VhcUp5Tjl4ZDh2R1U4CjFFMURDWFJtN1lETUNpSmEwbU9u - aEIxUW5qWTJGTnlobjV0emlpY00rM28KLS0tIFd0cllZeXFodFhJNTJMNkRLNyt1 - cXVyNnM4Y2pXeUFTYzU1OXlaOXR2RWcKp7/M/YFfpJg4L6a0AcYTV3Rza+bzaOeD - OUIwyns8ZsPtU8ILbRYUUdD2EJFiOPnWP4yX70Ak10v12gfB7vRJ6A== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T17:49:35Z" - mac: ENC[AES256_GCM,data:MhuuuInJjGbzoftxVqMZUov1tJpOt5Vb8GwTr0R12hRCVHwdV+cuC1YeXTQidYaduO7neGnYe0p8ESLEpyY06j4nSpCvGRPPaxTeSeA8IcIk71xNtA1X0FVPv51s59rpvVSjiMDCqrcOv1aJybfQnBZoc/9bfmCYGqhDkD6sg1U=,iv:ThTjUGYE9GiyIgXS+0KDLYS20RPJjMG9DKyMSoKGk/4=,tag:KqZYps5qSuKPUI4U3Iabmw==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/apps/homarr/homarr-secrets.enc.yaml b/k8s/apps/homarr/homarr-secrets.enc.yaml deleted file mode 100644 index 108e209..0000000 --- a/k8s/apps/homarr/homarr-secrets.enc.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:XZc=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:U2DPsVJ1gCoZw1YcgmT7UA==,type:str] -kind: ENC[AES256_GCM,data:SRkjGwsv,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:113xdFELRoJiU4Kn8BmvPA==,type:str] -metadata: - name: ENC[AES256_GCM,data:stIxzQqOUvpbEANL4aQ=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:2XRGRbPQLNUGbA1dZI9xEQ==,type:str] - namespace: ENC[AES256_GCM,data:wIhhcrQi3cDF,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:xnqvCtUdFPB5D9meJb36GA==,type:str] -type: ENC[AES256_GCM,data:1qUDnlHH,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:u9PcCfvA2BydFNQQKws1Og==,type:str] -stringData: - SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:b0h8ekf7RIbQ9YTpaXPmR3aeNonk60lgltPmnRe7lVk9wlAdaXkNChINcAsarw9YhfYvfCZfS8U33/QxLGjaYA==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:JphkeY49bQLm6cPjT6g8LA==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiUW1BVmEvTnJqa3RuQ3NG - UFg3SE1SclpWd01TZnFOK0trQ1c2YThUQmpRCkdGc3FJSmRCcFIycWcvZXJCbDdj - T1M2cFFUakpOa2FST1k2UHc0a1hCRWMKLS0tIDk0UVdYRUkvTEM4TEVWRElrY3dN - SFU2bkZxUGlDL0JNSnY3UU54Z3BhbFUKnJYwwQkUveNjTF9CveVUBF8RO7QjDnYA - 1+COKzvXuCIupvPcS87AtkrOfbfTu3IK78pfxZn04FmMOuAyj0ynzA== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-22T15:59:29Z" - mac: ENC[AES256_GCM,data:uMmKD4fvu39KZc2lDoDD25g/p/eIGW/CYFIwYXcRFPdbLLLi+iW9ks/2l5tHqzlwHEtlL1RH4HLOQr25k3GAJA2FhVnyVmyZ4N2EnJfic/9XTfef9E8tKVo2cXEgYMCPbpH8sVu2OoaQ9BFw8dTM9ZxuTdGKksGOtGp56I4R8hA=,iv:QFhVAZ1jykTNLPDzqjYf9jkg5PuqYA8+s0Hn57ND3KA=,tag:Zz2qYANQP33izwg+3Ap16A==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/apps/temporal/temporal-secrets.enc.yaml b/k8s/apps/temporal/temporal-secrets.enc.yaml deleted file mode 100644 index 08443d4..0000000 --- a/k8s/apps/temporal/temporal-secrets.enc.yaml +++ /dev/null @@ -1,18 +0,0 @@ -temporal: - oidc_client_id: ENC[AES256_GCM,data:y6eSNJpCNCg=,iv:4n5fIeiVG2JZOCD4yZ4Asm/gWvRl0QNFiRGTR1bs8ws=,tag:liLSr9sadR82UPq6d3gqGA==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:ebk0FVtSfq7JbIT+84cigdLg8zfN+4HTfGxlgqLw6hs1H92SFRHQFXO1l3U=,iv:qxa8aqUVoN31PpzAhs6bNMDCM6yPvOT27urIrM1rfo0=,tag:Vo25X8Znw7eh5DNq1eIJEw==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArZ1pyMXZ0Y3RFQVZkcTg5 - aENyemRueXpIM0FaUVhMc2ZyVDRyWWlzK1JzCjA0OTZ0aGJDNVVSM29CY1RzQWJL - eVNiSCtMSXdmbEtKeGt1L3NYMy9ibUEKLS0tIGJnU3A4MjVnZ1pCa1lPMnVoM0xo - dWs1cVM5ZCszbXp6eFltRVhGbFc0ajQKyCc8lClnSqWUxhNOr1FDCwn5V7nvjxPN - 7kjQpldseaRbsy+TM5sFQ1w6Acmun9uYjzs8PtmTNaayc/AFfspufA== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T23:22:55Z" - mac: ENC[AES256_GCM,data:0YuRxQHfdeKbjJzxHI4iBc7I2KnalNJmybB6bVQxvdRutsxKXW/bu99yqHkD4y/nI66Pi6d7LhrPhhGat3x2c6Drs7QRYVWnZ75thil6yWsOcpH7H1esxEWTP3cpoMzGdS0aF6zwU9H+WDvfm/t1wpeDpJly3eczcPvfbK1joDU=,iv:TgwfpI+ZVLyd2c/PKWsJbCI9yKkADpPPafJ5No0fLks=,tag:nqwQHtZ263CI+fY9iTUAzQ==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/argocd/apps/00-secrets.yaml b/k8s/argocd/apps/00-secrets.yaml index cca9728..73343f0 100644 --- a/k8s/argocd/apps/00-secrets.yaml +++ b/k8s/argocd/apps/00-secrets.yaml @@ -19,8 +19,10 @@ spec: source: repoURL: git@github.com:Riotpiaole/riotpiao.homelab.com.git targetRevision: main - path: . - plugin: - name: sops-secrets-v1.0 + # ksops decrypts every *.enc.yaml here at kustomize-build time (repo-server + # runs `kustomize build --enable-alpha-plugins --enable-exec`). Replaces the + # old sops-secrets-v1.0 CMP whose discover glob silently hijacked kustomize + # rendering of any app whose path contained a *.enc.yaml. + path: k8s/argocd/secrets destination: server: https://kubernetes.default.svc diff --git a/k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml b/k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml new file mode 100644 index 0000000..eab1f6f --- /dev/null +++ b/k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml @@ -0,0 +1,20 @@ +authentik: + secret_key: ENC[AES256_GCM,data:/7NF9khX7mCjwB7WI5BgbPQtLdqqrwkNuH9BoSCY5pAT2HdU5fVFxdsGguEo4UUmSSvrJ32AmaRgG2Xf3sJweKctyGsuNLauOzQXrYdqa2k=,iv:ZkDp4gOHY1eH44cDhGaZILi8dFDTNuYf1CVE+qrapzE=,tag:G2r3uuiixADJ/qQh/mT7Mw==,type:str] + bootstrap_password: ENC[AES256_GCM,data:4uNAXv1uuqiYO1j5CKntjHPWAX4+ek8v1zIrAFHJF+U=,iv:ccA703HMomR58cD2/6wK1W0IKJb7U1hNws6fmwG15E8=,tag:eO9zZ0TwUuXZ/vdHkSeO7w==,type:str] + bootstrap_token: ENC[AES256_GCM,data:OYRsLR+hzoKof7rZzzTu5eST6ByqRq+U+LWlhEC4qkLKVChhXi+mdIuK6RO5RHmHtgCBTyIikvwbFMLPSXAIEw==,iv:EJCetXnkNe+UuhWk4f3vr3kIEbCuVplVKHPne3aVIQ8=,tag:Rv/oDbf5afG7QHwSm/8SBg==,type:str] + postgresql_password: ENC[AES256_GCM,data:FG07lU+lJMm268FmpgZ4XaEk98ANWMiJ0zExLTl4Rkw=,iv:VSJ3d8p4f5SQM2lVdhSLY5dqdQTKwcfzOCATIM5M/cw=,tag:E5917Q6ofdSrrS9Pe8uMIg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFcStlcXdQb1AvZmxFT2U0 + N05yYi9WQkc3WWsrMHc3VXBPQllnLzZEd2dFCnhuUENiWTg5OVV4MXBBd29rSVdN + MUdyZURiUHFXZlNld2NEOHkwa1RGZEEKLS0tIGRjUkFHL1lNcnErZ21UOE9TUTE4 + RTNEMW5xbDJHYitTSjQ2cnRtSG9iQXMKXlHsfHV4EOoesW89I4McQdpKLfrcP1Cu + B3RhKbwPVVTx4RkSJ/Y02mV4C/MtHH8q1j4DgBvoBxU04efmD7u0VQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:w+RVU9gs7BaW8BOHISBhqGI3rj7gHwDgz71cAwpxemhJvM2D7to3ntGrae+W7jIvy/jie2Bnf40XfCOlgbuJGbAOZpyEodO80UhGNAr2XJH8mu1E4yJrq1Il+obTvDQU+cs4c78Ix/Mr+MzLnCLP/N3U0Qw5qJhxAGaDhH0g0AA=,iv:BgjCQM88VTInwvAbtudWkiuureT7wSM7QmCwlSGMycw=,tag:u4Z0lgXMJ9q4UE1hv/yl1A==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/_deferred-values-fragments/cloudflared-secrets.enc.yaml b/k8s/argocd/secrets/_deferred-values-fragments/cloudflared-secrets.enc.yaml new file mode 100644 index 0000000..e29e0f9 --- /dev/null +++ b/k8s/argocd/secrets/_deferred-values-fragments/cloudflared-secrets.enc.yaml @@ -0,0 +1,17 @@ +cloudflared: + tunnelToken: ENC[AES256_GCM,data:mFqJUuK8bzKnPAk4ZwBSLP7p6IiUCldmFNKSS5P75rKBgrrTrRB24Vqf6W7UwM2w+/CNzkQ0QByNw4/TzjHDgNH1UJAYXlVvm4H8/NPp4WPWlv5YO67l/mAmPVnBEmJzU0KgivCQm3psEYiEfbgiIbujqr0isgtkU856BimYHqtEdBmYRuJ5c73noaV6NWB1aTnEiCOmmNs+NCkN2GswgSi/zJLbd0HJPQT8h8+3rI8L7nC0/HJvYw==,iv:O3i0v+M5L3i9O7SbBtDAJe5IsQDgw+alI0Y9arZNojs=,tag:Tl9f0oVsBi68AyK3QwlHfg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBWlk3V1d1cjFXV3VrMUVN + LzA3NlVKbllHYkdEb2pESEJkQ2RyU3UzOVZnCk1NdGVUSVpHMHNYUGhOdEhoTi81 + YVlvU2Q2WmRUdC9KTGlBaUVnU01rbzgKLS0tIEhLNzl2UmpwYjQwNTl1YllnQ09X + Y0ZwR1N3Y2VNQ3VkbkJvRG56RWE3UWMK5tv5dgjKlbHq1Rh4NC0+3b9n1yTE/7vW + TehGG7k18zclBiZD2y5l4/CeDPM/yi5kfbPuxG1kURffw1xUeac+Ig== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:DshqXuhhJo0eLMTJ+HeAEk6JOtzGQ6OyUd7fSIGWHL/rGfDPliDBdTqpWw1899kgF0LRxY87rTTod65KvINp2HHc8KBQKa5MiAoTXQBThlFYIHFDOL2XQve9p6TKzsVDsQrBsl0lGt9V+Ou+YWUGh9kx63me1wAl8aZ9ltwWvZ0=,iv:4exYbWC7f7WGUncT1KcjrTy0r8Ox3YCctShyMiiaw+4=,tag:YMYOvwm2844LC76n3QvEdQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/_deferred-values-fragments/loki-secrets.enc.yaml b/k8s/argocd/secrets/_deferred-values-fragments/loki-secrets.enc.yaml new file mode 100644 index 0000000..2a958f4 --- /dev/null +++ b/k8s/argocd/secrets/_deferred-values-fragments/loki-secrets.enc.yaml @@ -0,0 +1,24 @@ +loki: + storage: + s3: + accessKeyId: ENC[AES256_GCM,data:vH6ysm5g9tDxmQ==,iv:a6oz4kQciHc/sqT1lu05CqI8+iJmi82JAQJ9BM5yBjo=,tag:90PuLvoHdm2GUKN931B4CQ==,type:str] + secretAccessKey: ENC[AES256_GCM,data:SC8AU4nRAlSeWPumJ+RY6MGQgfXpw0HDILG52urcNISDyB/5ViKZsfHinps=,iv:0rq4mv8cQ1za8ZLlR8voePiwZFdzK8sbRDDqgloO68g=,tag:cljugMlbkwvzVzdNS929mA==,type:str] + bucketNames: + chunks: ENC[AES256_GCM,data:byLUVs3mp4N/eDs=,iv:Jqt3iHhLaHae6g4CsylytZxg+3fnTdw4PUinhaUaOCI=,tag:uGsocMDRYltQxpPCsDffrA==,type:str] + ruler: ENC[AES256_GCM,data:Fqmd8hmoo4V8pw==,iv:K1ddZrCVFAo+CZet+BV7KJh6RVPzGbsnVIkoZpjWCU0=,tag:gTi2VInLznoOKDh5UPDpSQ==,type:str] + admin: ENC[AES256_GCM,data:Hn0yFD0ApG9+bw==,iv:DpuT40Jl9H1nH04u+gm7pHFox7QrZ52WqNQuBqGiz8Y=,tag:KI9dlstNNC7ZRj5TqFWpDQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERnBENi81eVpWVDRndkRu + a05mM3kvUVFKVWdEVWxKMjFDMVhpUXJGeVUwCmQ0bjQrMUNBbXByNENGNEtSbGdO + NVVRNlZFK2FOV3Y3ZTJpRGloV0hCVEkKLS0tIGxoaSsvVTlvdk5SdklqemxWWUs3 + dE40YVlOTlFray9aNUhpZ2t1VU4xY2MKyKmoJGrsjA3uoglXjfs6s0IXeswbO5K+ + eayKHEaxky+lngiLBlw7b0S94eGAAHHyNNA2Ii93UuK89RmK8pWRxQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:4Bjk5OYL7lnbt1WBcLQvKxJDn6aRaACFSPXpvF1mzb2dNN4sG9di3BErV5tB7BTtRC6Z3C57IrV6u5FUIKNRg46oFGIv5FoQpzvR9OA7G+wN+gCaMg/hv9ruBqOUhjsHLRUWGqI9aou2cQt3V7I/L8a5eEWkoBquA9YJjEkwPEk=,iv:H9PjzPpFKMlDjETU/lutXHOADzWYX1kg42mmea4+3o4=,tag:XCvH+svw/A8dr0FnzGdgeQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/_deferred-values-fragments/temporal-secrets.enc.yaml b/k8s/argocd/secrets/_deferred-values-fragments/temporal-secrets.enc.yaml new file mode 100644 index 0000000..4cd4ec1 --- /dev/null +++ b/k8s/argocd/secrets/_deferred-values-fragments/temporal-secrets.enc.yaml @@ -0,0 +1,18 @@ +temporal: + oidc_client_id: ENC[AES256_GCM,data:gyzO+wMlDrg=,iv:4n5fIeiVG2JZOCD4yZ4Asm/gWvRl0QNFiRGTR1bs8ws=,tag:MV1b/F5OOihe+K5qlkZnTA==,type:str] + oidc_client_secret: ENC[AES256_GCM,data:ND7XhSln6AVq6Qy465M6x5Hupjp+xZQKnqT+OW1U+bR7CAmsnZNom1wVpm0=,iv:qxa8aqUVoN31PpzAhs6bNMDCM6yPvOT27urIrM1rfo0=,tag:SRoQ7q7Nqn8TZGxmLxKXKg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1MEVQSkE2WmpOanp2cXY4 + M3NVNmd0U056bE52dXk5YUNBcE04c0V2SW04Cm1KTDIyc08xRHR4bnU2N1ptbHFM + UXRuOVQzaU1vQStZMG9yRzYyd09Idm8KLS0tIERTNjl1Q1ZtTDlGcGFpdlAwVjhQ + U0VxMTJBRkc1bGlXZkFxZDQ4OWlwYlEKF35/ZOxDMvxhXV4rIhtNdaE7+vQ9JOs4 + +ou88d2WnLD9U50fa1RC3+zS/5CwzIAOetfHeVSjPLkO9oVXuGhU3g== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:Gf9u8t515vhogURw7sOb5cAMKeEBEzuX3V6mDP4OtT6bPinyLRwvgp/j5E5lB0ANYggFHXiv4FL8Nb/pAQXxNe0v8rxwuWiTSspJrM2l2JzZ/nLDAfQiyOVUsoYY15HsGzjbmRT5VEQf/9ceSVqS2tAliZj7hH/hDsncc46vWHI=,iv:gOuSf898MMtzW6L2K+Z/yObn+9Bg42JvT0IlhGK+HSs=,tag:2MEPiaSqdedUibMuO/2RSg==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/cloudflare-secrets.enc.yaml b/k8s/argocd/secrets/cloudflare-secrets.enc.yaml new file mode 100644 index 0000000..4ac7698 --- /dev/null +++ b/k8s/argocd/secrets/cloudflare-secrets.enc.yaml @@ -0,0 +1,23 @@ +apiVersion: ENC[AES256_GCM,data:qhU=,iv:/1G8RSCBaiQ6msQEPPOO4LzlbYOzEbNvT9OwnY0E1JQ=,tag:xO1Nw12oNk6wFCmw0YldEA==,type:str] +kind: ENC[AES256_GCM,data:U/sQsZyV,iv:KMW7WL9ZjTmUz3NOQRhjsuAH2EZFXGk1P4hhl7cp8c0=,tag:0WiWyaaT1hmmVk837dFQfg==,type:str] +metadata: + name: ENC[AES256_GCM,data:tQIaIJGaBzzLqa9vjPVlyhEymNupmKl6yyhx,iv:1qXckUq4RTBZ06YNLXsuMW1UWRK9cgymDdVnmwLZles=,tag:J2e9k7fmTYhhUFzRfkNYuA==,type:str] + namespace: ENC[AES256_GCM,data:bWQZWAI3UY04rdp2,iv:YCv7jIXpkzTx9iu9ScwHme8Nc8iqJr1xn8yXK/OsHk8=,tag:Xq9mX/EUHIOClV/YUm2suw==,type:str] +type: ENC[AES256_GCM,data:lQUZvLVW,iv:iseIGnyGeVE76BORrjX/TnvrfzaRMOFrQ7oWT0jIS9M=,tag:JMGEqkIwlrB25m5E1hBH7g==,type:str] +stringData: + api-token: ENC[AES256_GCM,data:i2P1Qm062lGubNILbbpzX/AWga7s+RhZ3ODsue4oWKZ7xMHvhYaLUG3/t7YEOmu2qxvvdjQ=,iv:uFvlesWdZUbiuh8WTq1uLBRtuptV2tXxGJ6PVgu7vCI=,tag:PXpdMfGR5Yui/e3PGRUWZQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3OE5SY1Q4OFdsSkJ2Q0NK + TmJmdk1RUEZHbS9qa2hPQm1hRzg5UTFKMGpNClRNRlZ6a0hjdDU2UkRHaDJKbmdW + MlZhTFBubm1HcS9MZTltQnNOLzBmNUEKLS0tIDZaSko0VGZOSm9EcFZ2L3V6cHVU + RFJ1bFY4OGJYb3pnMTFTZ1c1NjdoazgKhwqR2KeygYCpTR8u+pmMYzjNj3XyuhKZ + EBXYOrD3nR4JSoULAUHnZto1HwVVf6/SaR9rbg5OunOlCkUdopLNig== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:loYaADf5M4WMJCruMwcBHuF+MtQGYXrYv+MTNjtYRuk0yx4DGoTh2xiHMIZF7S52OCUoX4bn9qKqKR5sZK+XOWxD2hHovf/guo94HDklRqJ7ifDRshTz5wIlav3Zl5GgxUdxea3MmebghPEEm0uHVnvKxVbKBEw5WivCJd8JOyM=,iv:rYFOxaz/Lb0loPNVmXL06BPAl8NzYHn+3Zeoh1YjB+g=,tag:N+qbLLR0YhqJ5xbgTVvLdw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/forgejo-secrets.enc.yaml b/k8s/argocd/secrets/forgejo-secrets.enc.yaml new file mode 100644 index 0000000..e1ebc41 --- /dev/null +++ b/k8s/argocd/secrets/forgejo-secrets.enc.yaml @@ -0,0 +1,26 @@ +#ENC[AES256_GCM,data:/JYNMOHrdMY2jobx67MjbJ7Eg8kHrNrkJcU535NRYLvY5nnSryk+asK8nQ==,iv:lM1jBHIxFkQriZ6BjGRXAlymUs5nX4Kvt1WNxUeZlkU=,tag:4pttiLNnIagcN4jTZ7BTwQ==,type:comment] +apiVersion: ENC[AES256_GCM,data:oRQ=,iv:0TzPcIoozs2MXJNXkzgcVtjjBUgfOHaSXQZiD37fb+Q=,tag:I1jwXteT9m2Pvdxq8zNtzg==,type:str] +kind: ENC[AES256_GCM,data:zSxoKLqf,iv:Mf2s3h8++Vxqb4JoymHXY4/WAknDZ2GGrVVtKK51JxI=,tag:MrBrvl/FjIzS/AVoIa1rBQ==,type:str] +metadata: + name: ENC[AES256_GCM,data:zKg/8UiwWslwTcesAQ==,iv:jxbj7Qtv+DRbhzTdvtv+eJuTQPNIf497NZPYA6ld4s0=,tag:HihBcoDLi8j9PB+uC265Sw==,type:str] + namespace: ENC[AES256_GCM,data:885ZKA==,iv:4PfWZu5qVGXP3ZzRHMrh5N9dzJ3SoUPPo58ppcDTnpk=,tag:gvBc+uYOmERckrb4KG2Hkw==,type:str] +type: ENC[AES256_GCM,data:eqT421de,iv:EZHnf1h1L29G1HOBYBSBeydNe4nC8XiBOw8YEL3kxrY=,tag:ypD8X9pa/9dbyChAMSIS6g==,type:str] +stringData: + username: ENC[AES256_GCM,data:Oc6vLw==,iv:1+tLTAxrDitXJwCAEccaVQzc9I9lNRgT3FsxO2NPDDc=,tag:r8lNDb42iewK8Soo9gbPwg==,type:str] + password: ENC[AES256_GCM,data:Ckc4PBc9tqigmcXl97iFUIqcjPzuJivT0tSmGunIDszFLU3u4UqAnA==,iv:jAwDFvJfQ1GkeU/qpEVUAQ6cWqxYE8nrgs+/RouyUxg=,tag:mP6AoUJP0T78+O9krL/eCA==,type:str] + email: ENC[AES256_GCM,data:qt+Sj2rs6l+L4x+kLUSaxlrN,iv:mfkMj3u8W2ZX4N4IH39mZXfEp+xphS4shaJcFOD/LEE=,tag:dD1jpIvTvPNOTer5gsfUqA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0S3hzMFVxK3M4WVZzYWZF + a3krRjcwZlMrNDZ6d0FnZWZpdXNFc2tIYnk0CkVzZ0JBbGREUU0wL3dtSTBFTTNL + YTMya0duY1dlTWVadHAwUTB4cUJlSzQKLS0tIGFrWm9VRURmKzh1SXJPb05mSEdt + NmVUSVk5SnJGOTRhdHFKclhPMi9tSUUKCNhKWvUOExgirvRg3KaeEE+mRUPI3epI + xIYaTsiHvffmjc5mbo2sD6H2/L0h1IkLb78FJQdnTG8zl6yyFzKlUw== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:q46TmZXbALBGfexqqVtLn1YGp0GfWDzq6SqtEC0OujrCExHUyGG6Tb7BtkQDKCl68vkq0HkEwt9tKopGBJhUyC7gPNkXKZ+YmEEEdY84C3ePyvwWCAQ24R6o4Rpg8QURHSf9JA5RmoJOu77OcVMHkOB9Lan2K2dQVb+79WDx5L0=,iv:uQE/b1A1ZTgSCnk+wvwbHo7eWRW/IiKrqG1wlq1aA0I=,tag:WWXtlUi0jagSl/gKTIflqw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml b/k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml new file mode 100644 index 0000000..e768d9f --- /dev/null +++ b/k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml @@ -0,0 +1,23 @@ +apiVersion: ENC[AES256_GCM,data:rGU=,iv:w1yJeQvN0MPZlPx8VQZmC6zkRaHW4rtjjROea0Kx9X4=,tag:qgYgVUGMQ2BtN0RZ0nZYjQ==,type:str] +kind: ENC[AES256_GCM,data:wp2QP1he,iv:C8c/jKh5pnBOtHqXsTEchGf9DACU/5hOJ0Mp/+Jk1kg=,tag:QUZNeguRXdi3JO6Ov6GMDg==,type:str] +metadata: + name: ENC[AES256_GCM,data:jVsnAcFTlRiKxDoU,iv:bWEqo28kH3bxzfI3ipiY6dsqhIcl9wIxBjFu0mxVGLg=,tag:PVWTveI8xhvLxvXPldhimQ==,type:str] + namespace: ENC[AES256_GCM,data:ZHnVZyd3wA==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:+9kp+VRu1ksroDTbTGmGPA==,type:str] +type: ENC[AES256_GCM,data:bHX+Bu9o,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:P7QGUXo9Io2Y19YqlWv5sQ==,type:str] +stringData: + GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:qW2SQSsGD0YupU2SMzRaYwkLRjXAwV1OJBnhATpCJrOHWbEytw6IphOmPPd3VZKfHncekA4agXi4K3rUPHIx0Q==,iv:NCeW/UfIl0RvHV39ubN2mDfFp7GTQNuFv8KiEF+7KOE=,tag:lisx4h4PqUfLwBX8ca9Siw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUkxLMEV3aEpILytic0Ux + V2VEV2EvcENJVnNNRUtBbGkwT0d6eUxYeEFvCjZPSkU2MG5qME5jZ01mRVJwTUFL + M3M0V3c3QXBoRml1Vm9NWW5JTlNRSG8KLS0tIEJnNlFmdFJXb1BPaVJzTmo1RDQv + VXZOVHRHUEZJRUZ4eGZGM1RxSURyWXcK3ZyYCPhRUvpvT/pjPQGJoLIwaktZY6Tg + LS0cIDUhjPFbeu7qUATOrat6vMUi0UREbXSFZ1KyAjNAwJZaUusPMA== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:yUBBV7dLEPld9yJacn+YaOT8M1NJ2ploGIxV66aVOH5x4tDAsskcUQJlzApWCQmORuCuMKg6qfpGgLTojfD5msha+ufVVJXHl7ua+STar1/FPJXaHm+z7YyZdsD5j6f3AH8q18DuLy2DYLjXELmPBsp50g7MDJEm3xLhCUXygjQ=,iv:xl0OtA/2umz0YH5b+6QjlAByZWbvfGOmHqomziNjlkw=,tag:xwkQDZx19Lf6QSwU2zPYTQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/grafana-secrets.enc.yaml b/k8s/argocd/secrets/grafana-secrets.enc.yaml new file mode 100644 index 0000000..be40a45 --- /dev/null +++ b/k8s/argocd/secrets/grafana-secrets.enc.yaml @@ -0,0 +1,24 @@ +apiVersion: ENC[AES256_GCM,data:x1g=,iv:ImbG3BggYpU11BV84Kwt1NrwoSZIrsoiZovqPM2ziWQ=,tag:V5clyseKFF/jEUX/Z/6Vmw==,type:str] +kind: ENC[AES256_GCM,data:9NYfGQuq,iv:6ICJnhTiMP0QFX2xQxqE59AkbtFXQ3UJwH/v/2KaQdw=,tag:wHeJCUeTz4CkqDE/3sDpJA==,type:str] +metadata: + name: ENC[AES256_GCM,data:vvZxPCX3S+jdtrkSZA==,iv:Aw9oxB0x3eLODe/XVGKd5A4UdKoW1ChbRM7Un0kkwFQ=,tag:1EdRix+CoNztbtXILUlHJw==,type:str] + namespace: ENC[AES256_GCM,data:ZVI3KHMJ9w==,iv:mf2ySxEaRrsPLgkwUUjmJuzklo74t8UTeCsUean2nx0=,tag:tOloglgAJIDNT1xNr//L9A==,type:str] +type: ENC[AES256_GCM,data:A3/oiYOS,iv:OMjn8JxX8g/jJSsIL911FX4autWEQDk1UGzfnnfKSjQ=,tag:p/8Rc6o7gfxoX5Lv8lhWvA==,type:str] +stringData: + admin-user: ENC[AES256_GCM,data:rjpH7gQ=,iv:UwIdUTnI2soFYGjZz6xj8boacSMYHxTg0Bl1xFLllsU=,tag:h2nX82mM2iT3tZu9SV9R5g==,type:str] + admin-password: ENC[AES256_GCM,data:hN1bHBVi9SfVzZ1uWA==,iv:4V3wlpMMfakInQoqD6gxk+0A6lWCm3aPw31gpa0sKss=,tag:na4lAI7SzbWTUB0lQ4uATg==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eVI0b0pIZC83Nm53dEwz + TlV0alJCL2duOEFkSlV0bXp4Vmp5V0pwWVZFClNGSDNFeVluV2R2NUpEcEdYc0t5 + R0xsalVTd2F5c1EvOXJPdHJ3Rjc0N1kKLS0tIGg4c1RBVlpwdEFQd1l3Z0RQYTBY + N2t3MVRTdFlPS3BvY1FJQmZlVG5ZVmsKEZx9fdx+p9UpzLGhN8D58KlPAOtyLtVs + ldAPmMThTIWQ5GgJjLwmag2NlMyO8NmQY+dd4a//Grx/4bep9lhjTg== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:YHngoakearZDcLH7ACS6Nw2hcf19XvVkthLxoM7KrWIAsa+Izkr/kr3PGgfeuwmQL0lux2P+GPlvLE4VeovAyPOiEBVl2tQK9/pXameqynswRn5wnl/kUMPJblNBtPpKR3jHlKsSD/o1MtQofm2mFLsa0bJ+C9JomAIYMFMKpms=,iv:M20AveeOFJs9Jj0jECODihC/nxIe/rPBU5QjfSQvuvs=,tag:dIDq+yaz6u87a1BLQCw0eA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/homarr-secrets.enc.yaml b/k8s/argocd/secrets/homarr-secrets.enc.yaml new file mode 100644 index 0000000..4c0a1f5 --- /dev/null +++ b/k8s/argocd/secrets/homarr-secrets.enc.yaml @@ -0,0 +1,23 @@ +apiVersion: ENC[AES256_GCM,data:4OY=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:uL7vlreaHjcLJjV7e5I7PQ==,type:str] +kind: ENC[AES256_GCM,data:x/ltkind,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:UuTbe213hDfK/WUtKS/doQ==,type:str] +metadata: + name: ENC[AES256_GCM,data:LpOEecTJBuGy5PqNSFM=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:E2wrig4lRXGDvSCHec5clQ==,type:str] + namespace: ENC[AES256_GCM,data:6kMVCXaF68NO,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:0VdeySsuhUr2heXyGXZwBg==,type:str] +type: ENC[AES256_GCM,data:6muC3Zqh,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:v6NYyhAKAwovluHAXNaOVA==,type:str] +stringData: + SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:jX9ULlaBYTSTFGRMplSder5rMrsz7THU3kgJSGef0r5rZvtoaAG9NVYU2QUEuD0sZgfqRooeMOkDCAqFc8qsuw==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:Dmbu6m3+UZa1w0UR0LRh9g==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TDVyNGRtYWgzMDYwdjdr + NXJWcGJZNUx6YzBGWm1nWlp0SlN3WXhaR0VBCjZ3bDBmUTFCUjg3U21wak90eHZK + NlRCTUZQSHhoS0ZSUGZ4UHhST01KNmMKLS0tIGUxcGo0NmJ2bmJ6eGJ3QWxzYVM5 + c2Z6UkFjQmZ4ejIvK1JQQkZ0VFFIZ3cKA8UzmGsX+s3yOermOHqbnnEtekHCTqmC + R3Jyzf6OolZMJpNwbetcsOfgO61aM7LHl/Xb/hFLbLjZ+eECrt8VpA== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:HTrEEVDm8JqnVBFaY/FJknxma0nI95tRiwVc0K76k+2R4jgKCBA3EUAzPVS+gA4rTAeKHPSHrT2eidlkseT2WQUjqMRrpHcUsbSjNfpTEY2g/U0PIiOXZMRGfwmsQVgmu2fqeMOyzDSyya0scdWJXPraRPNZ+OpEkNVlm4rWcgs=,iv:KY3dnnmooJgsu66wc7gbzeIGUXZNgVrxAhpAwxoG+G8=,tag:7r6d41oTD136N57rtY7auA==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/homelab-ca-secrets.enc.yaml b/k8s/argocd/secrets/homelab-ca-secrets.enc.yaml new file mode 100644 index 0000000..7aaebec --- /dev/null +++ b/k8s/argocd/secrets/homelab-ca-secrets.enc.yaml @@ -0,0 +1,24 @@ +apiVersion: ENC[AES256_GCM,data:uXc=,iv:3EeP5hzIKy1MR7HAcN361qTju4CuiQGXM6aqmO6Wdj8=,tag:uYyXfWL22mjvas2ZJFhU+w==,type:str] +kind: ENC[AES256_GCM,data:hUO6As0B,iv:PUdCdWZSB0T84G3lpMASZMGDMfcI6kOOEaFxMleQMM4=,tag:By5NYpJcst6Z9o3q+X0Mhw==,type:str] +metadata: + name: ENC[AES256_GCM,data:0Mv7X6WZptcURsRFtPQl+50d,iv:r7S5dVjCVofPZxr3k/QNKUJZ9r9I6bnlovHuczKTe1I=,tag:i9/aS8zii9RSFvOu9uT9hg==,type:str] + namespace: ENC[AES256_GCM,data:Hiu7GvRvEgzjOwlk,iv:a9k4Dza2N3jDgW0P+mQFO0tnebqlFdgDz8VoxCBaKXw=,tag:mdpj/9p2w2Naj2qqskgJLw==,type:str] +type: ENC[AES256_GCM,data:tT/yme90SyCR+l1JfweKJrc=,iv:vgtvyP+ssOOD003IL4uPY3L/LjxCsWJXaVE4scCeB4E=,tag:C26aKBoXlAluF8x2QoqbFQ==,type:str] +stringData: + tls.crt: ENC[AES256_GCM,data:0oOHigr5XJ12OFR5r/j1R1pUmjdfcGSXmjv8c+HDrqZj6v5jnmFHXQYsvKet0eKlMk6epUJnkArZsGGvoOBGjaJNmi0MzvzcneiJ6L3tIYa6dMOVVm37qD6wiIIl1HaoUiNgvSJqXpnKj25vL2VuxaAqaS1VmZYgGMPxRTexKqY+Vh0vkZYWiPdmNAJxfWSPSFH2Tiqd2PDCnv0tuqg/spQf5ayqzdvfojv8d9DGUblRvDJvTg+rTj0kZoE/TlEk7aG0ICTgZPGHWPgBUIa9mBCf9jUZ1y+90ZcgA10oMVhwp70FijwODQKwB+5kCW0Ux5kyjVaJ196YG3Noa3D6PsPixaWMR55f4LMSZaOaNWasp3sumCA+w7cRzMi4GjvIlp2BAEju51xmwjx69EmXXNO9gQ8E7M43FxkmCX9aH8dJefihDQNSzHoA80t6/GoByycNRFr7ElVj1lszNSew2dsnRclol2oovSRDZ3LVVtv3f/7F/LuZFHIqhHdEYTP3UHl57/xWnWW8LY4dL35YrVzKtMwqI7quj0DC/TDVu5IHEJKBd/A3pRfVHe6q+fFSPRiesAxOBRckMVy0E1rbcfkjfAkBNBMbFjtEis7t1RyacT1tfDdm3WyazDykae8T23E9hQJiUDTifLJ89UOMWcR5xE6GoKgfgXB3pAuSyFsV3ivAZikvK0cegb4jelmrZ0nh76wo6Wa4AOBAZGNkIZtySaPTR3FRnQqo45BpOXThMF5dKx94pFRL75SsN/F6MJYBbbQJ5BhrwxCVenjbM7AUddVpJOi2gxrwoqD/23w/eWiLp72dolXGA4qkRKD6opkXZWGcUwC9ps1SjjWVveysPfxsRBSFzZfgaM0j0cJSIz0GUhi5iaxCucTQw0vO2FTr7S4HJoSi1VTYndCPHL82RlrQ8OOmKlVNXudfebrPJEsUDijqU9s39FlgctOeh7l90I7m5qW6G6LHEWV64YsxdWs2tUmsQfyiLierkGVNhsvSDGKV2RQcIo3fYDhQ/ABexTOMmXjbs+Jk2Kb4HAXu0r9Mbv44bmBeHIrqQu/VtAlVimnjNeGXKOXI/UwsfIF7hk/armFMxT0UbKd3KTpPgT+lfN6Yy6Zebryki80JaOkUz+4vL/OgGDA4oaJUR6f8W46MsR5/wV6KL0XFJzPtgltkSyulWVMUOsC0eYhU2K7n1O9QOQCh9wL1KVSbDSyWO9OOCUDNEOWQGjhvyHWLclmlTnNlbom6LqEQONJ+59huT2JHVs9K6o+2h4IrXn4I1BXBlrpdzv5ZrYjpOMMkck1VtaHeIAoTppnnOmrhFS5dwNyWzv51/h3EitBMIpckQgDHaOoRsnBkFX09bYgnS4z11YqRAsMrA7zKlkGK3Xv4VQYyFUMyOOVK6V8csN8/nubkKkdR8xKu8cqR0y5ZQLu9ZbnPVmG31M5l0jYr4ThR0jCFveG/gNJyHaOtVCsiM90d/ZsctcQBjjYv77YvHC6QvcMG8jbjTEWZwLMkDxJPtce0Z+X3k2ORNMbpggzgy3p3LT+pvCySh5GxsuHXXvD6junZP+jRu6fk4iIZQ2Uv5HzpMD1yZYQ/LvF1bu4UZAfo0EQ+hzBDF1+AwoNsAsNIuQeT1AiKY1WX5YTNq/4o5nLKWJkF2J7fh+ivfS7tj7se52z99YAiSoqj/d7uQ8EIVYU1A2v4N3vCnBcUCMsDdFcbj/LbfvXSe9IBwqhpsQ7x82S9D5pDWjJjhnvAQpsYBXSVPIaBqHP+iLy+XyF4ZgKb+pNwtQ8SWZVc+RbDSBe1xzy9GPQ+3lCcy9YlDYm9PUZgIqL4LmnrzcGmV072QMcAbWWtjEr1+bejDo40gIIwTzQYlLBX4Lu4NKO5dxpSMJ9aj3cL3ZPZwGriOD0m0f4k2cGNh9aYceUD19Q1IeAdm6Y1yrCkosig1OLTtrzviD9d5FDvf2NaueSMiy+w56g29pYpZgKLekil3uyqazynLJ5hebiRvtIBsu8kRtYw1g08wLms5fiSfB2G9IV7AG3lUe/mlk9789grc62wJ4Z1sY5+Gzlwz1atDajXaJ1l9+tI+NTkMIfrTW0X3pdUy6njLSY7RMU5k73UP9jqjRs2WDhdUbogRXqBPA71RTZqmyfjkyz5fsZjHBOi3mmkX/35sX0x+a83VQdaKPg6w6GH6FxgVLnwZibG9BMh6O3q0ipRshNrecYp+NJNMPMZdiTKuoOcFmYHlFkjIF4iNtwPXybPcAbekg+Nit29yoKHp04C5GIWEr4ZCLClnhzWnSxvjP+uILhnhKDfm8W4Q3Lu0OsMk58TyAZqwQ==,iv:XF6gBHB/Bt+KMgSqjTnrE7OZNdsL19a0Eat35cXkmKI=,tag:0VprN5n4UNxo09nmJxI6pA==,type:str] + tls.key: ENC[AES256_GCM,data:cr5MDAnBb3rA1PipHPygx1HDbnvcR7u8UNTAVDgNxcu/rTENHw1EI8ADRDk8aAjUqJLfpo9U0DLaXEKjByrvsBfpu+JXAOWwXI0nOtzd1JAOayLL4nmJiji6uJ+sH9NHC5UmhWM4RHtBmPo4uAsoXT5kKTSLEH/zKKSmutLvRdo9GaoKDU75ythOVM5uOvtc0fQ7gAepzd+f84uq757ifRN28yZCqGZG2+pqkdJZZ83K2cU3UtMPHwjPJHoG2ePuE2KsJbIj6dArgBMnMkUh6auC/ZafHak1htlqva4BxemDEkK4fkHPtTkCNOi49RDfY2yeCfPwRKAoUG6XVgiU/MZXqgf+mIbUasHZtSbmxPErkdzJ1FgJsCgw+wcIvh4pM4X6VlnXJUkS6NrgM0Hx1YcCdsTDInAh9f19l0X8oBLd5fqnoljJq66jgMXJg0oUo9zFDrSJgjL9RAOuBZ8PmLwi/uM2hgtRCFDgJo1DMqmleNZQyacKqEeRbcc/FjB0Yd/32SpZmYPlg4rV/ELATkl+GpsjYGm9XhyMhmNcVDnSwvfn3a9DsIX7Oj1BbQ3aRB/yjJpdd8HxBfYrm9UVhlNMxmzp+hl+ZVcvYeWqcnRo2bu0bO+AiSWR/sSVk0gJq7mE7cT28vcyEYlo4NW5gAdN5P04HzuO3u46Dkg03cCMmHrpre0FVQadiaY7Jgr41xI/8/qR4U3YZi9zT62kFmUTc4q0RybYCpzAn0PeHpZHY+t8pSlA3uHajVBe4AzqITZb5Mm4A2FRkdnfpDlkXlr7sgAmwez6HALs3jLtNo5HWk1FS8tRwwTBRKa9LTZF/myCZhGlVTA5q7xJqERqRBlyU4Z49PeyAFHsBbcA3POcWf7VFYJN3uxiIqdYE75rE7spu78CR60Rn44YCaUdMEnOZLILT++rvW2qZTk3+APzD6mwDHZHYHcVvgBEgp50CKwyaFIsi2KZWR1CQYZ4ReSWCohI1xa747h3QeI/aHInijmBuv2pCnfYEcKxm+sca3KVbDLh41lfxA3XNen6uQn6Ndwuh8oSw6X59m489ODkfloyHZNyyWMNawIaDT33CvFgDLHA3+leUlfShl1W8Z9WpxuJ8fSD92OfAPY2MI1MdiccdrOZOKAkDqoVUx0jBMIgabxa5zXTCGsAlrvH8BxD4Y04pZvgsOdESRptCfgDJQkFuHCM94Odg08wh/4ebb2GJs/BWPJN6sQzn7yQQeGGnmss68dXNTg6Xgrr52Cajr24DwFJAEBazFNIOo/NelDI9lBmgltULcJveZm3Fft5Z4+tCvSpH9Ly7Tjag5j7ACIkXkexBBKV/9dOT8bfz0uKEjROnHdxocqwdpNN48J66C4FrkNgUTGayicBvlRk6JgsvAHv5ZiXPnUTj3Rc/j3PcRJfXpU88a9ngZw+MrqwEyPbFcgeHLebRlLU2HE7Duwei2fdSv+XZxARGwCLjAJTCrndMl/BK0qK/8kLkK6t0OHS8ANplXyyegcRgDyPFwUA/rDq06KkJDipaPeCabQlDSO+ah6U1409P25HuRGXGUMyE1UDgSRwJHXJogdtTpg0A+r2C0qwK/gr9Sxfq0ViNM/Xp10lmoVEXKWfmwxDep0fyuhAzPp8E76RJcpJ/TKDBiSwFtiP/rUkG6b5TQcYRidjHq1G89bmzH+4NbReSRvu0tFWZh7L2ypC7ChAZHbw2jNtdA6vD3hxbp78co3bCtXjuK7HnomXjKTvK105HYWAcNL4h7Xgj1YrLLgIrTr+5hkO8BmCAAf97pa81mWF3sYmOzO0qUjleOi0UGa9MGKuZ/n9jwFXBbtcLLYRu1iabfKXYjzWNaV3kLenwxe5u+Z6S+GtzNou+XQb6nDVpcuBt9FAGHN+ChgRpifbpb/H9ANwrLyrx0wQXv+QbhsK5VJSue8/vCQ8uyq6w/T2nCk1um/MZTt7L0pniWBFaI/+xYPJoaMAbl/nwaRLgWji9qzFvAaaUJztlsEDgjcmHJbtbjWgJNrVljcX1w5J+WxHplvtazLlkfriNSgFughVkeRjZVvkIHR72JOGUPosYEK1flmoMzJOubn0+AzxDjtfitGeD91pQJ2xDQCcAStyYPsHwMRXZb30kmsSK3bl9oPFvLjuWxZXgttrRWO/z81NZxjXPuzxVgs4zp3GmHWJKDteO47OEdTuEg0GE44O1UbPfADbufkFeer9NeZFKCKCC8VerpPoqS2dtPrsP75zATpuUz+8au+mVI4VqRmM1sYOxXPkBCAH1Gp3kN8b9VDaghgcCmYa16p5mHddry0ETqNAbWFjoRiLzDqX4Et/fZAqjJkYkpTms3B+79s5ttSNxdrBxZTbkVgrREy8E1NG5RCdJ+OS09BmaaL6FdfTNgo2XyfByzW4JYwTRI8Y3TF6d52ZmCh2vT7IYnpRLDpcx4rmYOSIWBrO5w5SORv3n1GV/fqHV7u35z3z1vUpJLvAkZMGX6UCu/1vV0cF4KdeGfndTHpgkMueTw3Z2TawNRyEZ4sSEPMf93w7PbDwzpKmggTuKJJjO60gem+Tpeek+Dx0AoACsqAbfNY41vv8+dN0jEPCYeBBZxBMTwDL61YNzb3hOzugBLRHVzi0g3aCJHLnQaD+GS3v1b731yBzZjWntUi7GITSLhz5JCBZZ7hOo5StNvj0qGfOyD9ZURN+wNKK0dzezv4F5WgjNtkKCBKB7Bjrk/46IygmOrJXbo+2hr0tzWDT1Dk6X76hcOzZlpjvDGfgekkUegD8oUAB2fA/qKK7QfCqb26h3GUT54yhVG59rKbnMWcZ7hjojxosCvDGauZYXC1JfXGfKHrYSufwBrHMISg/kDEPtUnfDr9ZRecH/PfMFlRbd8TySTJdiuDkMi21eAELhPOvXmQ58Mo2Fn6Hz2d2uTKHVqxqXzaw+VKxV6oIXrO+fiVEnQGol1QTsUDmB5syFzGQvTr2jnB0oKiH8JE5NUzn2jO/EUL/YO1Aix/7hXJezN4SkRD2USEYp05fKbZ94qw2maUn9Suz5sJJ6EV1AfVBuxnGpRwBoj8IF8O6oRUcPorac0LhrOIJjbV4FfmxBomoH8VhmrhlhmydaYo+vfarbuKeKqP3hdSnnfoQuXG7vzEbNKPNwQgivc0I7okkoSgwfB0mKJ5BEvHcEe6DLU35C44qNXTYRmE8GAEgab82ZpGDMbtVHP3KOp6YcgT88kwPQ2kd9SpPvWLUDyWO8lCdQznrQjXl/pQSDLIEJ4Bg5V1dA4WiRuGPwoYMvHQqJzFkfMmj+9vn+qhXCAcAYhq8YthLZzqTAY+nGqYWv04krYD6Yb6o/NsFSD189IBT0V33cLZtqi+o+eixOcpKdqnc2iFLnCjqRKRmTbrQw56/kIpi1bwVumkhdnfWsi4DI6s0x4V1/wzXd3Mum305cK1MXQG7j17wmNO6eOPYPOCEW9bcW3ZRhaeEuWRR2eSC1p0ULCpzIYVtAkKee0WTUGlFPMlt6zhF20pclVWAIGOVtW5rKhX1B3hptNLmPtpjn3+aBwI6U3W0vS00xyBArUbGOKp2rv0OzNjMX01NN5Sh+dErypSWP71GTHOoTUCpuRhsyc5x4wXdsbabieYEGTw5VldE7OI3jARnYeKcgqCf8QgSEs43KYTG+cSCD6tp7bUnxtIhBPw2h34a5iQ2yv4twr1iOpc5lByXa8UUasON4ugKoUjlqvOPHsm+XrvvnhR9EoyPxU9UtnN4snP4zeCpiV7E2jmc9o/DX9iigSo6sMUG9B9fbns/QfC2reuafWO4C73egDzZT3lGOGMVrLaC6EmoHupy5VNHtvBv9az2QjS3MGbKY0FEmIrxXgVMgPjlSTMnqfM5xTTIqbPMDukXTITmmqebVxXAZKWVA4NHeYTkjEIk1zfMqVz5ILj4htc1r/nYxW9K6Hsdx5TzmDB50odk/WfXYent8+cEUBkWOT4zRX/2R5ct6CI12x5+Gz3qbuHIqelIKJJRfRaPXxjzObgE7cHFJGrnn6XOoVHSk+Cjjxxnu5Iy0DvfWfLBDfwZpp+9exw8KvihJBVFogQnFRa4Y4sDatjif17ShGAVlQoxLdk22LcX0AdR6Kmo6wMYQ9ECtO9uiwKvH7147bAu/xIlFCmfZhVAkXndHrCz2GOT2tjSQ4i66uHbpCYfypOc/RCMjM8yr0AE8tYiyIFxfY88sKzgbjvg4/+HJ2aRX3KXb6JmL2pLXV3TXcrDenqFoXrjTCg8OBu8kJgZHigYvo93ZVAJgKPfey5TqAaiQ7DqhJ8rrsqx5CFqdKSKLlN+NdO3SSZwR3pspxVa61dKDirwucGKjMXXeBEydoZjz3QC4cL2f+FpVOA=,iv:z03p38PcVSVeaQ/1SwCR+HGxfzBzSO9lBdToMHL3Jao=,tag:XqJOxKbpV40TTe5yFftyqQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhZUV4OHZXMXlrWkhoNHBC + TjJXZ0NUR2RjaGtpbndPRnZsM05aY1JTdG1RCnhtSEQ0bndQSEd0bTZqN2FuaUZD + VEw5bXJyNm80SnNzdndpMTVlT3J5WFkKLS0tIElIL29oYmdieXkzV2t4TGNPdndB + SmxENFJqSTNJbGNPOXBoMFZDSUdvdzQKrGQ5lgtYG/+xEVXP/Psv9lMTjigSrgtt + 8VrLRiNfmAiGh0xnDf6utnYID2fW2W2wge44LCwyBmEzA5hrxmBvYg== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:JO+y7pahW1f/GZ4u/NUMmMHO652bCtubc3qM8pgRJYjcxLcD+tYlwkDEzbwW4wnTjrU0t6CJzql4vo7jJNzARuVO1gSCri4Lyfs4o9Ejwoth57npjD/eHeptciMrrZ3l0aaRX01vXGV3oV9cgVvcuX33/a0xz7A/1grNdjUBh74=,iv:T8dYqDhfHsoGb975FdghI5HLxHGXOhY/ZZrIWBW2q48=,tag:9U10qwnGfcxshMEExpT3Dw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/kustomization.yaml b/k8s/argocd/secrets/kustomization.yaml new file mode 100644 index 0000000..e8246b8 --- /dev/null +++ b/k8s/argocd/secrets/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +# All homelab SOPS-encrypted Secrets, decrypted in-line via the ksops generator. +# Each *.enc.yaml carries its own metadata.namespace, so no namespace transformer +# here (that would rewrite every Secret into one namespace). Renders exactly the +# Secret objects — replaces the old argocd-cmp-cm SOPS plugin. +generators: + - secret-generator.yaml diff --git a/k8s/argocd/secrets/minio-secrets.enc.yaml b/k8s/argocd/secrets/minio-secrets.enc.yaml new file mode 100644 index 0000000..76898fb --- /dev/null +++ b/k8s/argocd/secrets/minio-secrets.enc.yaml @@ -0,0 +1,72 @@ +apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str] +kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str] +metadata: + name: ENC[AES256_GCM,data:xs1k//nWy1iJ52Q=,iv:NDGvM319FCypxFLWwONcF12osaU/EL0IwD0c2xtqYnU=,tag:6IhfISF08WQbxrUmT49d7g==,type:str] + namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str] +type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str] +stringData: + config.env: ENC[AES256_GCM,data:3RIQ1i6NtY1Tv2eJY8JXSgfBEqi9px/9TJVNrPf9+brtGy9Mx3SwjKVnjGXUcA2cYcNZb1JR7temXmznXQdsRfZ9yohe4oc1vL3yPGPY9YfP7AHGYj9E7tghu/rgkHOf93RmfdKv0Rrq6miBcA==,iv:0RQVMi2mMHBRTJ1OX6IDFvq9Qr7zpqgQzt+MPPgBIHA=,tag:HNXLKf5X4P3E+hc7YbDtNQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t + L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16 + eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP + azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX + oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 +--- +apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str] +kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str] +metadata: + name: ENC[AES256_GCM,data:XEQHsQqTgwukYw==,iv:wTw2eoooDA9EfB2df3jzb0IWUdtLSwcuKzx8yDBaihQ=,tag:oncXt2gM1k6Qppafpu/D1w==,type:str] + namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str] +type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str] +stringData: + MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:IYBfNW19cTo8WkCGT4zuCljzi2bkbYWJ8DY/yedR2MJNqEO+bMVvjx0OqSqbPp6rnwGyMQOhBN0gXPbEVRDBGg==,iv:I1aGIikbHTKvh//4Inhp7UoNfhjlIXSpcyP4RqljvqM=,tag:Zh3Vh5DQYAsTtiW59D0/QA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t + L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16 + eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP + azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX + oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 +--- +apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str] +kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str] +metadata: + name: ENC[AES256_GCM,data:rYX7nN6SYoG5HycaNNrprDM=,iv:4uX7+Sl1UzgsImBH+qm9p8DlOfJu0i0W3bpoE7cFxXg=,tag:RROCnYBVKVwPBNSGgV30FQ==,type:str] + namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str] +type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str] +stringData: + CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:FhXl6yqTIzHsbJO6P96KQrA=,iv:gGTaSKxk721GwMQWWyymqUPZlGLidrBzWCWdRtnlOr0=,tag:IaVl8GQqPstBuUjD4N6JTQ==,type:str] + CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:s22GOXY4B/m+S7tgDw8P2gU2F15vdn1tqAp53FWzFTI=,iv:GXBhHQ8YiaVjRRMw2yG4FxdulVOuOurkLXXC0u/SFRA=,tag:pvHcD9+4qaxnvhOSkNxoHA==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t + L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16 + eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP + azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX + oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/argocd/secrets/secret-generator.yaml b/k8s/argocd/secrets/secret-generator.yaml new file mode 100644 index 0000000..11aa3c4 --- /dev/null +++ b/k8s/argocd/secrets/secret-generator.yaml @@ -0,0 +1,17 @@ +apiVersion: viaduct.ai/v1 +kind: ksops +metadata: + name: sops-secret-generator + annotations: + config.kubernetes.io/function: | + exec: + path: ksops +files: + - cloudflare-secrets.enc.yaml + - forgejo-secrets.enc.yaml + - grafana-oidc-secrets.enc.yaml + - grafana-secrets.enc.yaml + - homarr-secrets.enc.yaml + - homelab-ca-secrets.enc.yaml + - minio-secrets.enc.yaml + - vault-secrets.enc.yaml diff --git a/k8s/argocd/secrets/vault-secrets.enc.yaml b/k8s/argocd/secrets/vault-secrets.enc.yaml new file mode 100644 index 0000000..d9f50e8 --- /dev/null +++ b/k8s/argocd/secrets/vault-secrets.enc.yaml @@ -0,0 +1,24 @@ +apiVersion: ENC[AES256_GCM,data:cM0=,iv:KFms9ElUhHn+w9flx5nzLfwvfJsMN0u8+YDMqFgB6V8=,tag:7Ve53FzTefhTYFVwnkT/iA==,type:str] +kind: ENC[AES256_GCM,data:khv7iEsd,iv:rzn3Pt2pJcbDj55NYafUamNLTBrtluUPeLKorzpskGA=,tag:0PbEGGlxwz8ixBfwdOPi0w==,type:str] +metadata: + name: ENC[AES256_GCM,data:jgWuWAVI4nQMy8dkJXZI5L4=,iv:f9pwyirRf/mLqr8LhuNPE53guP5mlZmPftNhtFKSbFA=,tag:YWX+qDU1z82FGSw/Wc3nJA==,type:str] + namespace: ENC[AES256_GCM,data:j77p,iv:rkU3kw12xPeVkVRn3w8WIZlc0+11jGeg1jZBX3kRfaQ=,tag:c2MrHHI4N8CeEQYDAr5wZg==,type:str] +type: ENC[AES256_GCM,data:F4hK9q+O,iv:7gmqUtqcYzDHp99fYdinL4yYSTvjoyHlTnhHbEynGQY=,tag:Yuw+B+h81bbZbWcd1zMSsA==,type:str] +stringData: + access_key: ENC[AES256_GCM,data:SFP7ZsrqSJXbaA==,iv:QuGF69veC8FWOSAbwzv7vhKYkF0yOp0ty/U0hdmroAA=,tag:5VNvfVONHySMbYcYnwSajw==,type:str] + secret_key: ENC[AES256_GCM,data:WxvqVZJWTckEb3paILxUJ51hkg0aNzRJzziuopsCpY/Amita3zXl91VJtGE=,iv:dyKnNC8255FCmOd61xczuk0Ww9MYZmHCDc+JY60AjIQ=,tag:rzem3XDOj7VGaYuhk0dc2g==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkaFFHVDhicUVPWEZHaXJn + eGc3WmdUYk9mdHp4RFExazRhWHBDa3VLN3gwCmZCUFBJaHRaSmtPRGhsQkRHSFJt + U2NUMUh4azR3NllLWDg5ek94ZlFSYU0KLS0tIE1BOU1IMVAveWtKaEE3QWhFeXp6 + ZGd0TVZxbldTLzhHK1YrQUNCWUJVZlkKzK/aF0+qohgujyKHiRpQ+YYsnfVkvzDr + +3VnWcU1dPH63wqtf10LeYnBq8ewesfkibOVlJx0v1z6nQ9ZTMXwqQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + lastmodified: "2026-08-12T18:02:01Z" + mac: ENC[AES256_GCM,data:7JKz0tx066VLgwnpgA2/aUK/A7KD5y2PZJUqRNPMfEmEFqpkvm3Z5Ejj/kxmqYHwsXL+P92SrvMnbqq0v5I6PolR3fPW5fT/xcLibBmvoh8HF4wrRoaElK4ojTNDYJHginy/NE34FwL6sgDCbtT8QAJl9k8HEwxHlfBeyzzryaw=,iv:oTuLhckDQlvLHhGYNrpU0CSQB4Bunv2XvSsD53Z+yZQ=,tag:7CEOFC5t7vbFUQvencL/sQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.2 diff --git a/k8s/bootstrap/cert-manager/cloudflare-secrets.enc.yaml b/k8s/bootstrap/cert-manager/cloudflare-secrets.enc.yaml deleted file mode 100644 index 3a7157c..0000000 --- a/k8s/bootstrap/cert-manager/cloudflare-secrets.enc.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:AYk=,iv:/1G8RSCBaiQ6msQEPPOO4LzlbYOzEbNvT9OwnY0E1JQ=,tag:Gq2I92mI3c1FFsbv2ZE+BQ==,type:str] -kind: ENC[AES256_GCM,data:PbHIh8xS,iv:KMW7WL9ZjTmUz3NOQRhjsuAH2EZFXGk1P4hhl7cp8c0=,tag:9vJiqOtV3EhVfXWjJr4ZhA==,type:str] -metadata: - name: ENC[AES256_GCM,data:mF7O9mz8+KGfU6DJ8ifP974at95QOPH7yIaC,iv:1qXckUq4RTBZ06YNLXsuMW1UWRK9cgymDdVnmwLZles=,tag:v2dzEB+J23h4MxxkcJThIg==,type:str] - namespace: ENC[AES256_GCM,data:7omPsuwSfF1IwvCN,iv:YCv7jIXpkzTx9iu9ScwHme8Nc8iqJr1xn8yXK/OsHk8=,tag:5zslu/jpTpMHi2XvCP92Ig==,type:str] -type: ENC[AES256_GCM,data:nF1pv2+3,iv:iseIGnyGeVE76BORrjX/TnvrfzaRMOFrQ7oWT0jIS9M=,tag:qTpF2hYVmnCwL8EQA9Ot8w==,type:str] -stringData: - api-token: ENC[AES256_GCM,data:Evzvkz7ywKLsTXA0/ZF09Y+uKWDQ16SbAsogo4t9aAd+zsvFAnsyVifQc0SUNxzjSv8FXws=,iv:uFvlesWdZUbiuh8WTq1uLBRtuptV2tXxGJ6PVgu7vCI=,tag:thpyhOHtKWNn0bi1Xi1q6w==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwM0ovVUZmZVFmbjlwOXgx - U2h6aDNVVmV6NC8xckZtN3lwVytneHZvQ0VFCld3YjlhTFU5aVd0T3NpOUU3NW16 - ak10VVFiMnNsNG9GS0tIN1ViZjRrcG8KLS0tIFNScE5ibkYvQWszeDl2UkF2VHpG - Rzd2NlNSYlRYY0pkaDY1YklGS1NaWFUKTmYqAOF+iPbgl8Qv1qEyGLSDn3Yqw3Sd - iYpwVUPMrrLG9FiaSTUavmkv96DCEnof3GStaYsd62MXFWHW9eFAtA== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T19:49:33Z" - mac: ENC[AES256_GCM,data:6d8l+mal0zlwSyK1zkvpE8Y2cknXM+deaiIdzc2nySEm2pkC2ryY6exmPOsiyjDFrH9vnvwpvWxUqOZc1GPJ7/Pe6lDsdgT7ZPKrzJwfG07lXCZTNMTKruQ745mPgMzoJ82OjC8dXrXRXAqbFMw7SJeCajlfwL2Odmqr0reTnYs=,iv:FEcmRP5KYbI6QBZDLvcgF4ko4g5j2I8+eFrzPay80fw=,tag:cdUfwl+8Zwjyvu/p8htS1w==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml b/k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml deleted file mode 100644 index c97d8f8..0000000 --- a/k8s/bootstrap/cert-manager/homelab-ca-secrets.enc.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:oU0=,iv:3EeP5hzIKy1MR7HAcN361qTju4CuiQGXM6aqmO6Wdj8=,tag:8X8DAsv3E4DePq1HsVtjUw==,type:str] -kind: ENC[AES256_GCM,data:QJLvTWAw,iv:PUdCdWZSB0T84G3lpMASZMGDMfcI6kOOEaFxMleQMM4=,tag:ZPCpk7VooHXX3EoJYHZGwg==,type:str] -metadata: - name: ENC[AES256_GCM,data:PD2sYpXC4OmEaxDc+kJiOjoM,iv:r7S5dVjCVofPZxr3k/QNKUJZ9r9I6bnlovHuczKTe1I=,tag:YfxMOfz2hkxaSexFcAIn4Q==,type:str] - namespace: ENC[AES256_GCM,data:spnMj7c3tTdxe3NG,iv:a9k4Dza2N3jDgW0P+mQFO0tnebqlFdgDz8VoxCBaKXw=,tag:DyicmVMjc2vs9O2VDV/g9Q==,type:str] -type: ENC[AES256_GCM,data:KFto63io+fvte6QKcbr3QiU=,iv:vgtvyP+ssOOD003IL4uPY3L/LjxCsWJXaVE4scCeB4E=,tag:naazs19L3BV0ndgGak/Slg==,type:str] -stringData: - tls.crt: ENC[AES256_GCM,data:0m4hJGFUiv8bRI7YPPSAuus/aD+x7NwZgdvhjbunUXNjC7sA8Tq0BPmsYCEHi/IeWEmaZECFrztIfrYhfLSbR+Q00rmBkxWeXNzDxk12/kEOiAFSSfKrC/wM3PuLf+0hgD7w0qRBHxrgfIK56Hn+U03hgkHYp3HaGBXDYgd2Ikb7RAY3Wk8LkWprD2N8uFBsoD86PYl6VdYcBK+fP8DeV49mxBTi2Jhy1e/s2QiNunaEP4ibX1n6E3uKMn5MQsXxNpjDdLnVkW6TsCVMjxTeTzGgzFCAeYcYj2XcT3AA0tLJHPEiXTI1uPBMKBm9h2MofKP4ROF8op2DN4EHtNJywqJRqJ2OmGPLkpEloyRn2howlS+xBDNPe/GCxFJieyT6q0Zb6Cv1QDdwC3Tzc/Y5g0IFnfOXUgepQEnG5Vo/qYoe69vfxA0Ti2zeRQQcrJZ5UIGasypIrrR/1ROsJWvkZIlzilA4UqJXx1FB7fXxTA8P2KeFPti+s7zYv8oAVi5VQsZ589ahQbuzMLrbodDPvqkbGua+w0BkuYeO1rqxhWwZxlwvZkBgOZD8aHnsWpvWed/tI0keGxUxhEaPFGyXotDKLCjJArPUQQxFwHovAH997LigZVytGUpiku5BcournPQCYRkPoMMvWa2kAF/BRcgsFpFcGzCEqZtNZvrveGhLtoKIRBoJDHUqwUGb4drV2i+zR+W19mJARzr+ZtnlbUvW6hUo0aRDVE5AsEUDOvDLlNrtHCdtw5JdsL2IxBrTbNKtTeokcpFDf8sOXbD97AWBiXxAjW4q0kKYRie1KrSJcnVnQfFC9xIQv3Vswmqce3ARI8qY6c7XRLO8gAhq+xja513FIhd3O7sn9iJUwdhaSUziIL8vU5OSCyJStHPq5VZRSoaOCj/dyK/p3WI//cxAyei+djKsAef76/B5V383QsIFQGGPKoHcKj0KlkHhJmfU1xYMRhgILFbwFpZhTtLzn/+FWGUKmErYd6Zdwm2hbBEZuLX5AVOYw9N5ZKBWpCkXwfSHrLeR1sytCtZHo0UCXWiw6u+NFVQs7/k5HatFpFKZnzdy/iA4R6cbaLoFqyNPW/jRP7W5TMFwoQAu3sJ2TmbOLrR7lPbEynaCua/veaCHO2wCKqNA4xVlnzDIUxncwWz3Ag6a7pwbFhysLH7DqHFe7FAzA/BHJRlKgScC2U9Iegn+761KmM5RQATsiXHQiCBqWWc5aGriL/YhA1Cx42is3Jn8w9qrs8M1tOff9kzAD504Md+wWT8/XYb3wR8fK+9LJSYjJsb8ZB2x2Vev6WmyElkHkop4JGYyG8P5lbCBMsy1SxDviFQWgoHuY5p86d4EMiLmkr5aV4WMNeIBcSEs6R3cG8QpXJdAXkpg6UWs28ioESh1cyf/IXA0hujVMZJpt1yUBS79pGFHyQzDgrrYnPcqX7d8CO6y3SUVDMSevj5AksaN6NRPOCg7gTkMMHs84csEleue73v/K8rFthBc1/N2L1XKd7ca60SA1262hOD98af/PSSSKduOgmFYYh/+5ary1Z0AqWjF9RoMf940T9KBf0KurZutBQlsFf1FFst6WyAzJJrMrmk9H1dimmpQHlVplu+TRRw7HgRi5cOVmZaogD3HfS4JIxzIOOrJgN5fFtVEMHeXQffIB4oFFDmkO7Hul3SLrAJ3GyXCIV4wg8LWtlL+i4UcKz5gppkcKEHrc3Dzz4oCPDSqnL5qZLJS2BUy2coK9ExtSpFipawLLjpVsn6Uiiun+/z+lKYaIkv4yljy3UqtOzQHG2McmNI9dxhOFBMBX5Ir8CwXz9elR7d4UZo30ny4ruNZQs4ZeFR8HAqSQLBz57v45EmY9qqeDM+fsKlvatyqIOafiNcqGJoE+U9cmRabs7LIZjsBlyxLXFjhGDCjBC/gZusbd58Vj1WaUHd5hK01pqEpwpJEhSBGKsz4q5gD9fvEnBSqwVCtBS20ghtTFVU8THzkxo4t+3IwmhRX5rkmsE9WDw+xrX/8l+Bl43ySIk3+9pIZL8DXJkflkrqpxoaVt29X3XW/mlRru5zZXbUqTHmq2F7Wqe8t2vV2U19L6mqeT6NPrfyET7w8PD6P6PzIt6fSLj6cayD5Ak28Xves6jZ2U/Jkoolc37m7pTil1HBi9/QdZiOd7tDCrVF7S3BbMNC0/L0Z6m0u+5d3H3Folc505gi2QSdcG0MmNgPpzXkA+uu9Ul7Lj5B6/ZQ3BKTwAmOk2eIKY4rA3dRm2XPicJvfb8lqOUInnBLSzECuSNBYpbm3lshgX56BsmixPF8f10TuOsedHuiEaMFXTTH+Lg==,iv:XF6gBHB/Bt+KMgSqjTnrE7OZNdsL19a0Eat35cXkmKI=,tag:F0qjYxb6zAD9RTf/1hvyBw==,type:str] - tls.key: ENC[AES256_GCM,data:pS231THhY0lKJqmlAfEJwWzH1SQX8kfqAARI0cd1tqkKlhpuN9Jn1XlEy1oGmhtxBh4tmgLZ9tv99EzOn46DsLPxdfrmhd7w+hiVEOn8as+9CnjbrluRO5ilTL1sVbDm+NGp3Pyvr+RQUDubSR6aJzx2dFzeQmLpjywAK/ZmN2YCeN1IyZGClbV9LoL7K9CZjmP0MVSNmTVxQwmm345khP5AOHyZPE8OIvGAGQKxXTrOAJTFXBEmGPIz0LdBUaWLb0Mc4yjhg6XY7bfHty8/DgGn21fHF4OUFgPOnQbnRFHJQewq23epYIPh8oa2GaPUgumLzUGfrAFpEX86LB6wb1BkcoYYuqG00J39RKkw34YKsNBsRGOQWsCPWKCDKHGVvsBsAYBXhtvgZ6O5MQSFEoqKtbIEtwYJnmext1ovWBx4KzDo90WPm5X6q5a4Ij+glj63K695PlRcux5b4OnJHzUvaPjJgyzlIUphQJ6p6iqNB05/TOIf2s2qOE0LlE9zlw6EGZkSgSdklxPS/4844FINkhMfXfceb8wSNcnucxNIQvRnfBC4siUBkN4ddC6e2pizmqeNcPSmPvW+ZaoRrbnp1VB/NR/PpyYAGkb6uTLdVdh6kl/nIEShCpjTiKUH8dlu+4yBENcrW7hCeOjWZZc7U4USWUvWWsNdghD5GeXY1K8PR23hg8SUGoFs2gK6gsAr9eQbHWH1340yOdODaKjqVMTXGeHpQ9R9QaIIa1svbsekD6m3f+23yP4ALJUpWdXGSYJ7NbNKjpf5v5lcfZfct+9OhTJlaxDdDGFGXr0qs9xVFgYC8tnobTUAfvjcNI7JIizPKSFNr9UgfOuHQYJP6whvJRJ1AUJ+/17zbtdB2Pawyg9Z6dUp+e/MxFNlGFKx5ydx1en8NTOZvH2zmzt7nlvtpRnbcfwljlJFzjFeFIum7+dxlotjFF22hQqXXm2LWArEXDIHzG2yJU4lDva7gQdcGBYdWqd/LTMCFDYFk08bNtf2wV2MaEw4kOcPYpmRzVL0r6ToBCSLKBRCzhE3FcSIIyvWda7OhWk4xEfIFD9ESK29qyr8KJxEPxwzdbCE7tYnPlx77vq1NtWSmbkOV1nlo0r2aQWVPt2ziSwo3UrwscH+tTUQOjTQeeqhx3euFhTZ8mS9nKzHay7Jx9DIYRQ7ozRpaL38qxyg/3eD7VnPItk4Nh+TosWY2CniVZEkXRrBniJ+gzr153mrbya8/fzcTE/xpA51WU1JR+q8xY5YkDm+8f1nrogPQN/Lez1H4sjI1qyQ0PPVhNBX+kHh1n43fjOGiH3DHYAda7GqxjHfq21aGWu8zN9O60yjJYf/TYHDZgCdOIbpMuqW8TBn3YMwZUdKNVAgnU2+zy5HepHZqj59ovLL2t0n5urewDkA/NJNygpnBBm1Wxt7oOP4fTkicg4kkHQOM+u0Qh4be3Ery3KrHCDjt9yrApg6fa3zmKNNQnL3TaprpRHJ6VGO15Gd7vc0Q3wzHP3qUOpL+XbkkhZo7PoVYninb4nYZnoKcP7cGIQjxlfiDWhKRW0kTdW0eUyV8B1KhiyJ9qkHvuQPxDfjlDQs6yxAkMr11KCoESqugDizIuqgBG4n53PdltrP3cEp4ntuZ17UvHDOuNI42gb+dEC6v5pd0PI0mOtY8n0kJsl928+mW999aZXL7dN2R7ik64n45+P9tqP32o89u2MZPShDpg9HkcHqdfSXb00mNnnKIUaXPfO5i5XeiBq7nl9KXUCK6hkYCFooiKsVl8e9LcKJQeS3EDTolDtbhw3iiBjJY3Ci68qlSnsKjv6Z8ZbzsmIzrcd5lTdkMJI3b880y4RTEkWML4K2I78l9VzLe4y2BPHCnWhzyxjzVgCzRdq6KAQLzpJtqCGr+vAKiIqwOxwR5J90QSeMM+c5zDnZOBzN879F1Zln+EL4OCfn24m/3ivShQHskdzsLO0KK7jNNrlh1K4m/4+Ey/BMNu6bDUuLTuvd6NziTCoQnWIXbnV1aQ2ZtBbbwPfDhHZcXpNTt2OqVBOk3jcGsJOF+iBjkhO9n4+uVJF/9sFDZmdpNhVoJ8knjCJE1RnSLaz3UWX0gyoBgeRzyDKOJjO66RMMYCiMYHwtuI4+8s27QB/xSEjzTdigSgxjcwz9oZkRSK41cKHj6ExWQO2VGLxkZNgjoURey+cE3IcLe+UOKKnqiB/64YJwO/RxtcvXKaG9TIVczCov3N2S5vuKoa1JSjs/X0BXMvrFZQw9oB1dCaae7pY8tG0BOHKKBBsmY+jLW0D0PWj+1hptU4Ua1sqPVq8xcOm40mgJkDNhGJnyhBkUKy7jDn5kXLswAxI3RzRWlP3Sa4ss18dd/xUkEigQX5KP2xu8vecgjws/LwE7LqSGrRP5KblDtSr/CVzZ58yGg/fjrwo3KN43sHefJkrC17FWxoyV4YXxoy9jlfWINOoXO1602UshHigXWXiHtEXVvUvwst5nsqqBBPJ6j9rgemQ1gVpsghNGcmHWcMuA0gWPfF91OxsLBGb4L4pcagfEy6+j9JhHfaNW5nMRHyDORZcmkL6FfedeYZhkxcPMT4BMuagf4L2GYkZbEH8QjwGLygDK8o8KqwJod0+/cO1xTbNzFMjYZm3SygMkMUNigGpRRefVHf3+MGg4E0+lmc8LuwCwZ6ZuFOrndj+mbT3VMDzq9QngWYtYK3YY4EYxSlvqTfCeGVVIhZyiVrBz7fnzXA131BB/nREKXzNVnUcjqxpu2wp9hffJ+BDkOGRbh3eXXhLZLpWMtlvpROoHNuizzgbD0+B6BR6SLuH31lp4ooJYCHCgZUXUg+Men1VD4bMEhxd3vSlJl0EFry390lYzDg1vpt2pSI+Nkvb5J4wDIJQ7e3MAy3hy37XOGRiKTTBa5hvaUnY4Dm8TYsI49E6Cx5pfmz/NTCrUjEdKybI5PbQFCLmtCB4aN03zMNWndZDw4mDexu43octUkke1m2+XvUxew5/uVGGZ6AmOT/OJEBs2eO1CEzR3+dlFEQCv3GOmVy/dd7/QqQmhf9iLlIavu16xd2ThfEfKulF+o5ccqLy36OVc82/5nRhJElGg6bW/hRpRI+GS6AkEED2cVNYWFd1YuTUT4VNvr2vEfTftFeTVNYkrtV1u5OaWFQWRDqt8vEOkkidxmAd4VKBnrRkd1mYtnzsGRqYVKMkGc8v2R8PqU1M5PJZIzqwQLiAnjILPz5DxbTuYvbrMRkhP1V5nnk/GrpeEd/tGJN9F0K9bSI9jQ7R/eKtqZe5EfOqH0RnNsLZC+Mdp3OZbgx9swYz5zLtwD2sx+U57v22zHPGL0pcMHWgxXG8JHk1NRzlLsi4ZvKsKBwx4ya9E9BZTbSXYTQh/MbSuvcr/OMdQ1FvaL6HtJa6+Pl26+sVYXYlTLQF/t2PYU9SxFOFt34ZH2qNNIPcx0NzSN3exX34ApDSUnF0IRBF9cauG0oB+fVjB4OWTLfxY6KhZRKJhFVdyYd58GGMWMs2RBvojTf1UX2Jr9tzTK6/itk4KiCnLOV1mgmwEpvmoto6mwHzYeSgwzYnQxQxnL+Xt5O9eya7TDXp75MMynjuEujeI27D3xvCHqCEPszgNJ+p113YqO4IOTMBhwhYWl9KOIl5HEhvcVl3lZ+qPeXXG7Xui84IIUx2BVtFySAx4CKktVFUef3Z9KHEbioRJDdZuBWeJuUYMWAhBM5Gxds/BGwOMpGoAQa9USWUs8WIWvJ3MzGQOB9B0lBb/JaW+tfs4zXardzmVoBNzeDpvWpIgYXjK8ah3duliIXxNGg8U/QYmL6EC3jWTdkINwEu4qDFyU7feNocqrs4uWFalyqzehwQQiRHcF8lzDHHA9d8+l9UTiaTxbNaqiO2Bwq4gPpzx/P1IR+Pkc+Tc0QwnwGueaJRaPVa53biUKb9oZktC8u7p4l2W5PTT8Di7uo7lnSYlZfMXwsK1h3Ht+8obXPkGjtE42MflI9ADFZLjehP+hKgXn8PpeGCZl5rP4BmofzjxVKaNKI3DUavdh5DrXBcz2AP9m8qliFmI2NOKjLx6WjLzEaWXKL4pZU7KJbA0+88LrSYc828tShne4Nmyv8KDdnQ4t1YXnhuuAiJDF+nh2ouLwKmR+ru1XcBpR+sdYnaKtm7N5pDC3Lr/htoiEl4J58AOLIkYo5er8vSrXyWFUOTiYWa72DhzupAhnJqZ2ACB7lRMDvjvSaTjNM+TNzT/id4zxa8Lu35J030vXNoMGBa+QlfQozZUidtODgu+b/07KsZTqz69kDFREgmN1xk5T/1lFzpSLhcp3kdlbj8RmZ/hncOaH327nZ3ouXiSAD+NIpg+uDFqtHXgknhG9kY=,iv:z03p38PcVSVeaQ/1SwCR+HGxfzBzSO9lBdToMHL3Jao=,tag:UBGwaOV/BsyxVnvrcDS+rg==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMaCtRMTBEcVI1TXl5S1NN - bDUyL0N3eDVRMmN4YzZOdkpUUitQL3kzd0h3Cnh1ek16OE1VUkR2bTdVNkk2Z29O - RWRraDRTclR4WVRSZnQzRnBjb3kyNlkKLS0tIHAxbWZNaWI0RU9qRmIrSWFqQ0Fw - Rjl0L1ZBQjNPbXJMZWNkUXJxOGFub28KQCTZP02Yk19EdkkiZ379eMNRGbExoMNy - JJ/4KCa1uFoUooRE3mudpBfc5xDAe/lkW60NUFrAFYZoVmRkYH9vSg== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-08-12T02:49:29Z" - mac: ENC[AES256_GCM,data:QiBWiTUOTnyLUbQL1kcc5rjyEBVuGIaGCW7E7ln08bS94G1oworgbmShqBx2ygXg0VZaWBLcoe45i6CC49vCPB7JJdZcVOczHC72ekYBF4foq6eJP1zttEC5HrHlGIOW9LeahHmMF8Gbodx7HQ2aps/hZ03kxS75yCyFlVuEPrk=,iv:vf+h6fR1Tu1VUyl007HLzO9vuzACd3KVYsR77u8aB1A=,tag:9JMPHhvUACi1Q4mfZTp+qA==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/bootstrap/phase3-forgejo/forgejo-secrets.enc.yaml b/k8s/bootstrap/phase3-forgejo/forgejo-secrets.enc.yaml deleted file mode 100644 index 623068e..0000000 --- a/k8s/bootstrap/phase3-forgejo/forgejo-secrets.enc.yaml +++ /dev/null @@ -1,26 +0,0 @@ -#ENC[AES256_GCM,data:85lNBL02TeroUW8dissgxEwjnOZnb0fg7jndGim3/QSi3/hFEF8FQa9nrQ==,iv:lM1jBHIxFkQriZ6BjGRXAlymUs5nX4Kvt1WNxUeZlkU=,tag:wm/D5qVcrcu3VXcZkEj70A==,type:comment] -apiVersion: ENC[AES256_GCM,data:Vrs=,iv:0TzPcIoozs2MXJNXkzgcVtjjBUgfOHaSXQZiD37fb+Q=,tag:CabTlLwtz6RcBF/gr4Ri4g==,type:str] -kind: ENC[AES256_GCM,data:22Y5w+Df,iv:Mf2s3h8++Vxqb4JoymHXY4/WAknDZ2GGrVVtKK51JxI=,tag:k5DHUqWGMBPpLkQXADaMlw==,type:str] -metadata: - name: ENC[AES256_GCM,data:ItXKquY5a7gu8CJZog==,iv:jxbj7Qtv+DRbhzTdvtv+eJuTQPNIf497NZPYA6ld4s0=,tag:XdaaSavFBxOjvxna2kr/Tg==,type:str] - namespace: ENC[AES256_GCM,data:VH6NMg==,iv:4PfWZu5qVGXP3ZzRHMrh5N9dzJ3SoUPPo58ppcDTnpk=,tag:Vr8E+WF0Z9ym3GyTGbdi2g==,type:str] -type: ENC[AES256_GCM,data:DmbHZRIk,iv:EZHnf1h1L29G1HOBYBSBeydNe4nC8XiBOw8YEL3kxrY=,tag:pFhUSMAIEqJET3NmaajO1g==,type:str] -stringData: - username: ENC[AES256_GCM,data:ZTrmFA==,iv:1+tLTAxrDitXJwCAEccaVQzc9I9lNRgT3FsxO2NPDDc=,tag:69Wn4a8pjhdUycc/MXsn3Q==,type:str] - password: ENC[AES256_GCM,data:w7Vn8XaC1ykNrwPpJjVYg8J5KXkUbaPspu0CoceqHVdai6BFNW5rtA==,iv:jAwDFvJfQ1GkeU/qpEVUAQ6cWqxYE8nrgs+/RouyUxg=,tag:foGmYika/9uNBdsKVrspEA==,type:str] - email: ENC[AES256_GCM,data:pIOq80OjVERFCXJmx8+qTJEw,iv:mfkMj3u8W2ZX4N4IH39mZXfEp+xphS4shaJcFOD/LEE=,tag:FOSq0E7VzzOM69Bn77v2Dw==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSi84U3FQZXJrYzA0WCtS - c1g1Sm04eFhha2huSEVCd2x3OGVUT08yejFjCmpPV0NsTVRyWTRVUkx6WktKaU1k - Vk12VGRIejRWbjQxeDZxdFUxWkgzaVUKLS0tIDRZdFNxY1AvcFhOREMxU01zTzhX - RzFmMjdjOFd4ZkxscnBIa1E2NWtRaVEK7qZXtq2VwZBwsLAulRh93TpCXCos0Vu7 - fX+/oMEN6gF5VxDJ/e5C644EKUY+tSLAoh75xA5DAytOxEVdhe2ozA== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-25T17:45:22Z" - mac: ENC[AES256_GCM,data:gi8smimG00EQbF492BVzsWOEubGdT0zSG39D+r3fgLL/wgtDqF2mgtFA0iDiy1pInt1Viu8yYpu1l/eBSD8BNW4bfrglIHOJdb1I5+19u8SMebhWCwbEcbiHaXNmVUKKapGsNjbApCApq00NXoOZuOUSUzZlh19JPvg/vd7nl2M=,iv:n8Kni4RQhj/VgIruqptVa6m0YwFJF6v2+p2boJsLT5c=,tag:Tc4gkhH7hSrJKEOJ3X3SjQ==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml b/k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml deleted file mode 100644 index 2967780..0000000 --- a/k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml +++ /dev/null @@ -1,30 +0,0 @@ -# ArgoCD CMP plugin for SOPS secret decryption -apiVersion: v1 -kind: ConfigMap -metadata: - name: argocd-cmp-cm - namespace: argocd -data: - sops-secrets-v1.0.yaml: | - apiVersion: argoproj.io/v1alpha1 - kind: ConfigManagementPlugin - metadata: - name: sops-secrets-v1.0 - spec: - generate: - command: [sh, -c] - args: - - | - # Find all .enc.yaml files and decrypt them, separating multi-doc output. - # Skip files that aren't full K8s manifests (no top-level "kind:") — some - # .enc.yaml files hold raw Helm values, not standalone Secret objects. - find . -name '*.enc.yaml' -type f | while read -r file; do - decrypted=$(sops -d "$file") - if echo "$decrypted" | grep -q '^kind:'; then - echo "---" - echo "$decrypted" - fi - done - discover: - find: - glob: "**/*.enc.yaml" diff --git a/k8s/bootstrap/phase4-argocd/argocd-values.yaml b/k8s/bootstrap/phase4-argocd/argocd-values.yaml index 13dec33..ea13c86 100644 --- a/k8s/bootstrap/phase4-argocd/argocd-values.yaml +++ b/k8s/bootstrap/phase4-argocd/argocd-values.yaml @@ -42,57 +42,48 @@ repoServer: operator: Exists effect: NoSchedule - # Fetch sops binary into shared emptyDir (runs as root; main containers can't write /usr/local/bin) + # SOPS decryption is now done natively inside kustomize via the ksops exec + # generator (see k8s/argocd/secrets/), not a CMP sidecar. The repo-server's + # own `kustomize build --enable-alpha-plugins --enable-exec` runs ksops, which + # shells out to sops using the age key at SOPS_AGE_KEY_FILE. Install sops + + # ksops into a shared emptyDir on PATH; the repo-server container mounts them. + env: + - name: SOPS_AGE_KEY_FILE + value: /sops-age/key.txt + - name: XDG_CONFIG_HOME + value: /.config initContainers: - - name: install-sops + - name: install-sops-ksops image: alpine:3.20 command: [sh, -c] args: - | - wget -qO /sops-bin/sops https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 - chmod +x /sops-bin/sops + set -e + apk add --no-cache curl tar + curl -sSL -o /custom-tools/sops \ + https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 + chmod +x /custom-tools/sops + curl -sSL https://github.com/viaduct-ai/kustomize-sops/releases/download/v4.5.1/ksops_4.5.1_Linux_x86_64.tar.gz \ + | tar -xz -C /custom-tools ksops + chmod +x /custom-tools/ksops volumeMounts: - - mountPath: /sops-bin - name: sops-bin + - mountPath: /custom-tools + name: custom-tools - # SOPS CMP sidecar (decrypts *.enc.yaml via argocd-cmp-cm ConfigMap plugin) - extraContainers: - - name: sops-secrets-v1 - command: [/var/run/argocd/argocd-cmp-server] - image: quay.io/argoproj/argocd:v3.4.5 - env: - - name: SOPS_AGE_KEY_FILE - value: /sops-age/key.txt - - name: PATH - value: /sops-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin - volumeMounts: - - mountPath: /var/run/argocd - name: var-files - - mountPath: /home/argocd/cmp-server/plugins - name: plugins - - mountPath: /tmp - name: cmp-tmp - - mountPath: /home/argocd/cmp-server/config/plugin.yaml - subPath: sops-secrets-v1.0.yaml - name: argocd-cmp-cm - - mountPath: /sops-age - name: sops-age - readOnly: true - - mountPath: /sops-bin - name: sops-bin - readOnly: true - securityContext: - runAsNonRoot: true - runAsUser: 999 + volumeMounts: + - mountPath: /usr/local/bin/sops + name: custom-tools + subPath: sops + - mountPath: /usr/local/bin/ksops + name: custom-tools + subPath: ksops + - mountPath: /sops-age + name: sops-age + readOnly: true volumes: - - name: sops-bin + - name: custom-tools emptyDir: {} - - name: cmp-tmp - emptyDir: {} - - name: argocd-cmp-cm - configMap: - name: argocd-cmp-cm - name: sops-age secret: secretName: sops-age @@ -138,6 +129,8 @@ configs: cm: admin.enabled: "true" application.instanceLabelKey: argocd.argoproj.io/instance + # Let every kustomize build run the ksops exec generator. + kustomize.buildOptions: --enable-alpha-plugins --enable-exec params: server.insecure: false diff --git a/k8s/infra/iam/authentik-secrets.enc.yaml b/k8s/infra/iam/authentik-secrets.enc.yaml deleted file mode 100644 index cbee749..0000000 --- a/k8s/infra/iam/authentik-secrets.enc.yaml +++ /dev/null @@ -1,20 +0,0 @@ -authentik: - secret_key: ENC[AES256_GCM,data:55ne/khf01ZD3FP2Zek+0Ar9C+GP/GPf33PwOwgXdnOXF4kLrEwwJ/E7yrH0nkBKGO221ClGBjlo7kb5vGMmmmg8TVBa1upQbk8b0s723n8=,iv:ZkDp4gOHY1eH44cDhGaZILi8dFDTNuYf1CVE+qrapzE=,tag:JTE4tfMJSowsn9YZ0xKFng==,type:str] - bootstrap_password: ENC[AES256_GCM,data:vBk/ivCG4x2TlvURrDxHAiaZlxrF+PeHBAuoZR6muWw=,iv:ccA703HMomR58cD2/6wK1W0IKJb7U1hNws6fmwG15E8=,tag:MdhTx9ebXLjRCnDpUxpJ0g==,type:str] - bootstrap_token: ENC[AES256_GCM,data:NwGZzaL8JufXYp6sjeeN1etdgaHT8IuaZFLZJegzs+fPXMvVCGPKKlStythIOa3gwgCXkhA+kV8+jyxYKr1UMw==,iv:EJCetXnkNe+UuhWk4f3vr3kIEbCuVplVKHPne3aVIQ8=,tag:kwlE+9O6DczO+mn9Rqx+Rw==,type:str] - postgresql_password: ENC[AES256_GCM,data:+WeZKo+24awwWfTAt5q6KJRkqaHD7YmlnKm4oGaUNvw=,iv:VSJ3d8p4f5SQM2lVdhSLY5dqdQTKwcfzOCATIM5M/cw=,tag:6K8mQmyLEg7KJi3bg+zPig==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSDJSYmRQNDdjWjlORmJX - Zm9yd2xRNi9XKy95Y2NQWUMyTGxjb1NjRTNzCnlNbko5NVJVSitiaE1DQ2QvMVoy - czRya01EaFZmZzAzcjRESG5NY1JIVTAKLS0tIFZ1UkREaGc4VUczMjFITWR6N0Ez - NStJZmpuWEw1dlRFcExZUlFLWkpBSFkK9r0NG3IKV7+AU00VXVCuHu+aBOOLydD0 - ncioyDrJWgkyDxn9+BNZh4vX8vEERANYh+1/3P99Ubz28tifhmi2vg== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T23:22:55Z" - mac: ENC[AES256_GCM,data:+MqbhlVnhriigDEj/AMJj4yLjcIjxkQc4QANcVeAXefcljHS4yOVtrwh2js3l9WVyIgVdl0MdlW+ycykBU4Pi3u4sdJoiJd945wZDsHvFCREYZIZdsVW/EHmKjIroqxQfeEtbWDStkaE+WTF/yGrZ2HLLztrXIafxZq7KhbXlo0=,iv:PCzhd8j539BxvpQQCds1vMXm3gfmlvSnrbtfOpFaKrY=,tag:NiHwSfQRvf//lpjFAKA1Jg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/infra/iam/vault-secrets.enc.yaml b/k8s/infra/iam/vault-secrets.enc.yaml deleted file mode 100644 index cbe81dd..0000000 --- a/k8s/infra/iam/vault-secrets.enc.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:6rk=,iv:KFms9ElUhHn+w9flx5nzLfwvfJsMN0u8+YDMqFgB6V8=,tag:bT1/FnwegVzqMmnYvLgiQg==,type:str] -kind: ENC[AES256_GCM,data:9nKNMjB+,iv:rzn3Pt2pJcbDj55NYafUamNLTBrtluUPeLKorzpskGA=,tag:RNP8/lD/8yBGLNxsti+OXw==,type:str] -metadata: - name: ENC[AES256_GCM,data:yNadKj5FHjMNYtpHwwoPolM=,iv:f9pwyirRf/mLqr8LhuNPE53guP5mlZmPftNhtFKSbFA=,tag:ch5+QHuzDqV0b1sJ/yZp7A==,type:str] - namespace: ENC[AES256_GCM,data:6Qia,iv:rkU3kw12xPeVkVRn3w8WIZlc0+11jGeg1jZBX3kRfaQ=,tag:S0tx0vf3cYb9rKW0puKClQ==,type:str] -type: ENC[AES256_GCM,data:482sksR1,iv:7gmqUtqcYzDHp99fYdinL4yYSTvjoyHlTnhHbEynGQY=,tag:zTY3HrpCS/GH8FZiskA+ng==,type:str] -stringData: - access_key: ENC[AES256_GCM,data:j1D85IgXb7IMAA==,iv:QuGF69veC8FWOSAbwzv7vhKYkF0yOp0ty/U0hdmroAA=,tag:oNfKovQ7wY3tSBWMEJ2QiA==,type:str] - secret_key: ENC[AES256_GCM,data:ptw+7ykLtHYzzFWWofRCVuo0wlW+NvaJEvbZJUU0VWM5DJ0xC6bnbvKKOvc=,iv:dyKnNC8255FCmOd61xczuk0Ww9MYZmHCDc+JY60AjIQ=,tag:2j8ogpKxElsI3En+NDL2Hw==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSQkVqdUUwY1BJbk10b1J0 - aVBoTjIvelpGNldGRlQrdDJPdHRieXVkSFRjCkhSajhVSDJqSmNBMm90SGM3Z3Nm - eDFYVnl5dEtySjZJY01lamFDdHBSUGsKLS0tIDlSZTRJbkRxTXdXb0plWkVVelQ2 - a1FWbm9Xd05tM0hoNkRQTHRleC9yZGsKWZnhsPX4bWrF5SGRncN566mywyYCL+EW - AEiIoIRhaue1bzamEAa1qj3Weg7IR4ORDAyNqW8BKdDyzYf+S8U0qg== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-08-11T22:57:06Z" - mac: ENC[AES256_GCM,data:M09M9xNROHSkUfmNZgZ5SF08249AnGGEFbLPsQwgYpHSNt49lEXBtUYKoFDeITfh//orACF/qk7NXwNIr3x2i/6NGEipbRGXl9JcOrT8Df5Z64CRT365Y5agomagOZHJcb5cw238ejaaSfErZ9R8ZmAtK5kbnW8PvELPdovaMTU=,iv:TcMdAX2dx4M8jSahkLE7/vxmLM/hzbYOyDv5tyPWllk=,tag:0JnakV3PwwG0jq+hcghgiw==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/infra/logging/grafana-oidc-secrets.enc.yaml b/k8s/infra/logging/grafana-oidc-secrets.enc.yaml deleted file mode 100644 index d4d204f..0000000 --- a/k8s/infra/logging/grafana-oidc-secrets.enc.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:oE0=,iv:w1yJeQvN0MPZlPx8VQZmC6zkRaHW4rtjjROea0Kx9X4=,tag:Q6/g6shLyarH7fq3213uWA==,type:str] -kind: ENC[AES256_GCM,data:x2QYj605,iv:C8c/jKh5pnBOtHqXsTEchGf9DACU/5hOJ0Mp/+Jk1kg=,tag:2tE/oKg6ma0F9/hzXSoZ+w==,type:str] -metadata: - name: ENC[AES256_GCM,data:BBXxuz8iuqdpE3W3,iv:bWEqo28kH3bxzfI3ipiY6dsqhIcl9wIxBjFu0mxVGLg=,tag:aKN13YwwVYl0813BaNW2Ng==,type:str] - namespace: ENC[AES256_GCM,data:0msz8sHCrQ==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:d8owVKUbOOmo/TJ8X00WdA==,type:str] -type: ENC[AES256_GCM,data:SS8WJgF3,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:x+cc6pIRCZNxbZRWyTvzUQ==,type:str] -stringData: - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:+jGjNWkjUZKd3vzTwkbSurCfXix3xSX567Kfq+M1mp4JoBEvWB2FAcaaYgs8NxYuQHia0v3oV+lRyoo96IOCSw==,iv:NCeW/UfIl0RvHV39ubN2mDfFp7GTQNuFv8KiEF+7KOE=,tag:WiHvx83dlIR/xTfgDS7NoA==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqOE5iODMzdUlGMzY5TS8x - UUhIUDJYenIxTTNNTC96WjB2NDl1cDl6QlhrCmxrMGlEa25EQkY3WDRGMUs5S0pq - NVVacUQyV3hYNHF4WGZ6a1dFbi9xbzgKLS0tIHBYVFpQRnZwTUJQYTdjWjNkVW1W - Nm81dWZpMFBYL003Y2NSOTJOWmozMjQKntzx0PHgydDFUDdUe5EMxmaGIL8rpUh4 - +3q8rxu6wdQQ6RmgiySbpS2Cfs17z2t6zkqdVbvuyqlSkjMrMk1+bw== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-08-11T23:33:41Z" - mac: ENC[AES256_GCM,data:0bbUl3wQjuGOoKA1c13lNYRcyQI8iUlrHibN2rJReYMqzQ37hHquxZNS3GJC4xQiXwaqNgNQeOO3BRW7qzjQWb5QxB2axVdvEaWjJzS6cxzr8/ONPELZRHFBgNkWIMi4f3fi8BTJKE2p6rsepHH6JL5JYVl8DO/j68mKUObjAe8=,iv:ojFWfOMJ8cVcKLsJBl1HjCk6sJucxsEZMxl5f59tf78=,tag:zqBso7DGAkvoJuE0PZMq0Q==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/infra/logging/grafana-secrets.enc.yaml b/k8s/infra/logging/grafana-secrets.enc.yaml deleted file mode 100644 index f6fc25e..0000000 --- a/k8s/infra/logging/grafana-secrets.enc.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:TMY=,iv:ImbG3BggYpU11BV84Kwt1NrwoSZIrsoiZovqPM2ziWQ=,tag:xbld3DauQbVC7LrOyDgU+w==,type:str] -kind: ENC[AES256_GCM,data:PrsNgt4i,iv:6ICJnhTiMP0QFX2xQxqE59AkbtFXQ3UJwH/v/2KaQdw=,tag:wyWWV21lB+Oy23AoXDdFJQ==,type:str] -metadata: - name: ENC[AES256_GCM,data:yceBbeA92I2IMgwPww==,iv:Aw9oxB0x3eLODe/XVGKd5A4UdKoW1ChbRM7Un0kkwFQ=,tag:wTQfMQlO+ecU0epYGh32zA==,type:str] - namespace: ENC[AES256_GCM,data:MNtEckGs1Q==,iv:mf2ySxEaRrsPLgkwUUjmJuzklo74t8UTeCsUean2nx0=,tag:xvhxXljTD/uKCfwS6I4IZw==,type:str] -type: ENC[AES256_GCM,data:ykoXlXwe,iv:OMjn8JxX8g/jJSsIL911FX4autWEQDk1UGzfnnfKSjQ=,tag:8xhWjuq1jIhS9LxIGCa/PA==,type:str] -stringData: - admin-user: ENC[AES256_GCM,data:TJBiqjs=,iv:UwIdUTnI2soFYGjZz6xj8boacSMYHxTg0Bl1xFLllsU=,tag:zavbhAUpsjOChoGZ17cPRQ==,type:str] - admin-password: ENC[AES256_GCM,data:t+vGIzaybTrLzY001A==,iv:4V3wlpMMfakInQoqD6gxk+0A6lWCm3aPw31gpa0sKss=,tag:cbduSqiUnJFj0uOCjfKDSg==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZlZiOWt3SFNiYzhNL252 - Vlh1WkNHZXYxV1ZsNG90YXhydlpJTURmS1ZBCmJYOTBvKzUvS3cvRGZRcDlQRFRS - c3pZNjZnbUw1Tml6eVBETnBRQ2xNK3MKLS0tIHU5UFdBSk1TUnBjdlZaODBNRkVy - azBhbjN6a1BRNVh0cUtMU24zK29jMlEK4Y8+P1L/O80xG+qtdF1I8fvfURX/IvtF - dFIn1EF7YRqMy4KWKx6QSewjo8Vx7JuBDZtRDPCGNJKIKJU3R9NK3w== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-08-11T21:40:58Z" - mac: ENC[AES256_GCM,data:761EqFteOI+BuznsTV8+wIOoOJAnCYvIPYy9gpdHSkDf+QbW6k3HUCjvPN/sNXfAEtbjIf28W6iW+zhljAbe3lpOXrY2Fy4O9i/e1ltXvsBUND6FWB3TkdSaweycRGoAPTsR9vb74INqecR4O0LITcGHL+Yl3TLPzwSJhxiqpiU=,iv:ug2qqUEhlXharDqegsiPSrlmqV7z0qQBv8Ha96qH+Lo=,tag:JY+xjJgX7o6o83tSvng7eQ==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/infra/logging/loki-secrets.enc.yaml b/k8s/infra/logging/loki-secrets.enc.yaml deleted file mode 100644 index 3453761..0000000 --- a/k8s/infra/logging/loki-secrets.enc.yaml +++ /dev/null @@ -1,24 +0,0 @@ -loki: - storage: - s3: - accessKeyId: ENC[AES256_GCM,data:rUe9BzMuNEk7Lg==,iv:a6oz4kQciHc/sqT1lu05CqI8+iJmi82JAQJ9BM5yBjo=,tag:M1CJmBQlbz/H08S2Y7eUCA==,type:str] - secretAccessKey: ENC[AES256_GCM,data:WEvUewgbriABBYllwMtyKsQw850Eb0J6CHc/MEY/NlsolWp9+eq6wKChknI=,iv:0rq4mv8cQ1za8ZLlR8voePiwZFdzK8sbRDDqgloO68g=,tag:r4GNYDa2fL1+d0gY5ndG1Q==,type:str] - bucketNames: - chunks: ENC[AES256_GCM,data:cAwa5qibAOvuhCk=,iv:Jqt3iHhLaHae6g4CsylytZxg+3fnTdw4PUinhaUaOCI=,tag:jVduzj+ggN9vQSD62qZ0jw==,type:str] - ruler: ENC[AES256_GCM,data:G1r90YhXWGkUOw==,iv:K1ddZrCVFAo+CZet+BV7KJh6RVPzGbsnVIkoZpjWCU0=,tag:o1xK1XLVtOqehTBIn9cNHg==,type:str] - admin: ENC[AES256_GCM,data:LhWklk60wExptQ==,iv:DpuT40Jl9H1nH04u+gm7pHFox7QrZ52WqNQuBqGiz8Y=,tag:ylGjb9J5CGXq/CxHtq732g==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRVW4vV0xvaGw4VUlGL1Fa - Tjh4V3RUV2d5L1padVZRVkE1V3BTRjg4bzNzCndjSHowU0s5a3I4NGsxNlBUVXFo - M1kwQjh3Rkw0VnlDWnh4Q3NSMmdUcXMKLS0tIGl4RWNvVzVyMHo5TC93SXJyWU1G - QzBJK0RrSnFiaTgxNnNiZWthM1J4TnMKPb3uoQLHPSTW0+6Kgsapa5/u6cN7aJa1 - NcQIhd/PPibvvGb47OgLrh8djg7uGpVDMMn3v0Kv3Pu5bshJjZ2gBQ== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T23:02:08Z" - mac: ENC[AES256_GCM,data:Fg9WsV1LGCgCc9TQtxJ83rthGZCpi9Is/0ab7Udry90TxUHAnfhktP/V74lh8XQq+mVOjCT5ZAw1mpM93lj92/o3ZTb2LnGoaxD4Mj/3eL1T3oH6GQH9VRb7iq+aD5BkYZQd4jmxiIVET3K8a6a7Tt1hrWeKUYz1fcsC9IFIOJQ=,iv:sF8T/Q7+RBrU3dXBBDGS2j4SSiVIpE5wBlGgK7YKGTY=,tag:wqKm9p2SctnsS0jrk4jF/w==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/infra/logging/loki-values-secrets.enc.yaml b/k8s/infra/logging/loki-values-secrets.enc.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/k8s/infra/minio/minio-secrets.enc.yaml b/k8s/infra/minio/minio-secrets.enc.yaml deleted file mode 100644 index a907849..0000000 --- a/k8s/infra/minio/minio-secrets.enc.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: ENC[AES256_GCM,data:nd0=,iv:fORqNsg82i9+5WRQkHi698q/qHI4A1JP+YEkOvMxEGw=,tag:bLdfd21vJn6Mn2k/ghx1iA==,type:str] -kind: ENC[AES256_GCM,data:aPTyakwz,iv:0Fviiz5ngsaBD5IRn30p6Z93cELcuLNCWILJJQSn19M=,tag:0n0f69t4ZC5WULd9VBI9sg==,type:str] -metadata: - name: ENC[AES256_GCM,data:UQ0lTL18hb7bZR4=,iv:NDGvM319FCypxFLWwONcF12osaU/EL0IwD0c2xtqYnU=,tag:JYu3EMyW7Pc4HTCmU8IiTw==,type:str] - namespace: ENC[AES256_GCM,data:H49h6xTVAQ==,iv:EgTi3jFfn+EYYxMTC1GCQmt1fuGGtVSD3fhytp+CiaM=,tag:ynf4iSonvnnaO5/Ujno3+A==,type:str] -type: ENC[AES256_GCM,data:xDlXeb2q,iv:0pe80oQG0ZIerOLvqbiorJ76JlCPu6wIjt4lQfbsXjU=,tag:rmaLgRUr/ERPzIXeUD9qMA==,type:str] -stringData: - config.env: ENC[AES256_GCM,data:rM2sfC9apy4Bnlw609d+BXAenZzUcBxceQmyzlbrvgasp37JfS6hIAWOf5Qq62ZF+/fN7nXSB5oEeajAIV3YJoP8wKlqm3765zOkUVhFkX2YmhJH4CkoJa6XzX9CowCQtTW9h+7F5PwaGnLptQ==,iv:0RQVMi2mMHBRTJ1OX6IDFvq9Qr7zpqgQzt+MPPgBIHA=,tag:zu45S2b29SM9JjqxsKQHow==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr - NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV - V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK - Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm - vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T19:41:57Z" - mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 ---- -apiVersion: ENC[AES256_GCM,data:Utg=,iv:SqcUMt/REXm9qIppTVP8PQ6tnVrgt2gc5aghD7S8KHI=,tag:zeSno+VCPn9EXDE1Uxs8Hg==,type:str] -kind: ENC[AES256_GCM,data:nDUp5Fyy,iv:RVtkV8l4JvqOSUR/MlZHZxnR75+fAAR8gKPNbpOLWVk=,tag:AoNBqT3MVudiA56sIIqpnQ==,type:str] -metadata: - name: ENC[AES256_GCM,data:74hhzAFMvD+DuQ==,iv:wTw2eoooDA9EfB2df3jzb0IWUdtLSwcuKzx8yDBaihQ=,tag:mnnkksSy69Gtg4LyYYnjmg==,type:str] - namespace: ENC[AES256_GCM,data:z8dPkzIQkg==,iv:zoH4ZWOtD3tF6pkAuQDrL2rSfuRp+9Nu8IJq2q0eqsY=,tag:/39AaFYlXKxKkCuZpeHZlg==,type:str] -type: ENC[AES256_GCM,data:J7ALXn/x,iv:GUfgjXF1/z0jGCFdz5/ARVRQUBwrEAdpzfATiFNPVLs=,tag:HZem0E53fAykijNrthbs8Q==,type:str] -stringData: - MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:w3SZTsxn59UfoS4rej78RToiQP3jzMOwUmNwjEFoPjkZAhHpKYX7Y4tYv5znt9h1cd2jGrorBVLf9YgIOihJxw==,iv:I1aGIikbHTKvh//4Inhp7UoNfhjlIXSpcyP4RqljvqM=,tag:mL3ayxC3PuvbgQosazgTow==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr - NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV - V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK - Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm - vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T19:41:57Z" - mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 ---- -apiVersion: ENC[AES256_GCM,data:Mv4=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:J4W7uyf3iYImPh2OSVWvNA==,type:str] -kind: ENC[AES256_GCM,data:VPEKGVDy,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:xqIUhSu4RSxameNPoFZVNQ==,type:str] -metadata: - name: ENC[AES256_GCM,data:bckq1pAY9UIMm3FUyGgafvQ=,iv:4uX7+Sl1UzgsImBH+qm9p8DlOfJu0i0W3bpoE7cFxXg=,tag:wvrBClQahE2OeVzeiubOEg==,type:str] - namespace: ENC[AES256_GCM,data:5GotV/mD9g==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:fCupPaa2X/ztuoHbtr/HEQ==,type:str] -type: ENC[AES256_GCM,data:q8D3YEZZ,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:lxOx4u4LGcXCyK32BCD1XQ==,type:str] -stringData: - CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:XJCgReZf/FVli+lfA9ynF+s=,iv:gGTaSKxk721GwMQWWyymqUPZlGLidrBzWCWdRtnlOr0=,tag:Ts1P68sbBrYAS9gdI8XaHw==,type:str] - CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:WQKvfXroupl4R2oUuRXDSgLthsd/ZaEedsy8lAHAu40=,iv:GXBhHQ8YiaVjRRMw2yG4FxdulVOuOurkLXXC0u/SFRA=,tag:kyxRviddcYUc0DcPEphKIg==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZCtYcC9kanVtdFNSeksr - NDhXVHBpWjhKaWJSVnR1Rk9QV3BVU25mRldjCitEOVNCNnZVVjNLQWhFejdGelJV - V3Bhb3JTMU9xdEhOck00TGt4UFVaWTAKLS0tIEZ1VnFrVmkyTWZWR2hCc2hpWGVK - Z0NuYjVIdXJYRlVkY3JSUWUzZzd1bkkK0jm57duPu+u2qwjhKaO/fTtH1+Gt8fSm - vnLQsQZlkYZBYxHHwtBPC4JztYvmuKnPNYAPqRPfVB+9IEOpQEetkA== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-20T19:41:57Z" - mac: ENC[AES256_GCM,data:fFoW//RJnlx0jQ3aMsEtx/qy70LrnocVc4UfPUIFNJG377NG7GnDxs+JIQGXSNNzRoKH06U3AFmBl2BvIi6D67A1VbOS0/+zmSGcNxdmL3apauOmn34jgJ/ipyakuawUi1+CGgSy8eMqgLM9QCpBkGx6qTtjjnGVWHYbN1WG3iE=,iv:8MD02ysiRL3nxSQvhQ6e0ek9gVLHwcfUCGzX+Tmtdp4=,tag:X/SdhJes1rJLHy6S278ztg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2