refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00
parent 9e84fb3386
commit beb3cb21a0
31 changed files with 383 additions and 393 deletions
@@ -1,17 +0,0 @@
-cloudflared:
-    tunnelToken: ENC[AES256_GCM,data:GrZNC75M1T304m+MBbgcL9Wa6VD3Cc+joERjUWD7PsI5NlqFpVuorzub4OTaiE/F0sqDXtXdSwQP9jGTkgUnNbviUVEIBDb+zuiyzCfzuhc53oMvoUYRkRNeH5DR9TBEszspj8+mjQMDAKQFKtTmyDodgh8DdPg8LE8YTCqyx6CcpkGZ8yWY06VoKpZfFSOan/gHwRwG2500P8U+rzI676EKVUhWjBFP0iTbwDQR7spI7oz8Gon/0Q==,iv:O3i0v+M5L3i9O7SbBtDAJe5IsQDgw+alI0Y9arZNojs=,tag:/T63FivzvbLFaXEaBsn5FA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpU2tjOGpJNk9leE9LSnlx
-            b2tVbFFMMkZ3OHZuU0VhcUp5Tjl4ZDh2R1U4CjFFMURDWFJtN1lETUNpSmEwbU9u
-            aEIxUW5qWTJGTnlobjV0emlpY00rM28KLS0tIFd0cllZeXFodFhJNTJMNkRLNyt1
-            cXVyNnM4Y2pXeUFTYzU1OXlaOXR2RWcKp7/M/YFfpJg4L6a0AcYTV3Rza+bzaOeD
-            OUIwyns8ZsPtU8ILbRYUUdD2EJFiOPnWP4yX70Ak10v12gfB7vRJ6A==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-20T17:49:35Z"
-    mac: ENC[AES256_GCM,data:MhuuuInJjGbzoftxVqMZUov1tJpOt5Vb8GwTr0R12hRCVHwdV+cuC1YeXTQidYaduO7neGnYe0p8ESLEpyY06j4nSpCvGRPPaxTeSeA8IcIk71xNtA1X0FVPv51s59rpvVSjiMDCqrcOv1aJybfQnBZoc/9bfmCYGqhDkD6sg1U=,iv:ThTjUGYE9GiyIgXS+0KDLYS20RPJjMG9DKyMSoKGk/4=,tag:KqZYps5qSuKPUI4U3Iabmw==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:XZc=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:U2DPsVJ1gCoZw1YcgmT7UA==,type:str]
-kind: ENC[AES256_GCM,data:SRkjGwsv,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:113xdFELRoJiU4Kn8BmvPA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:stIxzQqOUvpbEANL4aQ=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:2XRGRbPQLNUGbA1dZI9xEQ==,type:str]
-    namespace: ENC[AES256_GCM,data:wIhhcrQi3cDF,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:xnqvCtUdFPB5D9meJb36GA==,type:str]
-type: ENC[AES256_GCM,data:1qUDnlHH,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:u9PcCfvA2BydFNQQKws1Og==,type:str]
-stringData:
-    SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:b0h8ekf7RIbQ9YTpaXPmR3aeNonk60lgltPmnRe7lVk9wlAdaXkNChINcAsarw9YhfYvfCZfS8U33/QxLGjaYA==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:JphkeY49bQLm6cPjT6g8LA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiUW1BVmEvTnJqa3RuQ3NG
-            UFg3SE1SclpWd01TZnFOK0trQ1c2YThUQmpRCkdGc3FJSmRCcFIycWcvZXJCbDdj
-            T1M2cFFUakpOa2FST1k2UHc0a1hCRWMKLS0tIDk0UVdYRUkvTEM4TEVWRElrY3dN
-            SFU2bkZxUGlDL0JNSnY3UU54Z3BhbFUKnJYwwQkUveNjTF9CveVUBF8RO7QjDnYA
-            1+COKzvXuCIupvPcS87AtkrOfbfTu3IK78pfxZn04FmMOuAyj0ynzA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-22T15:59:29Z"
-    mac: ENC[AES256_GCM,data:uMmKD4fvu39KZc2lDoDD25g/p/eIGW/CYFIwYXcRFPdbLLLi+iW9ks/2l5tHqzlwHEtlL1RH4HLOQr25k3GAJA2FhVnyVmyZ4N2EnJfic/9XTfef9E8tKVo2cXEgYMCPbpH8sVu2OoaQ9BFw8dTM9ZxuTdGKksGOtGp56I4R8hA=,iv:QFhVAZ1jykTNLPDzqjYf9jkg5PuqYA8+s0Hn57ND3KA=,tag:Zz2qYANQP33izwg+3Ap16A==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
@@ -1,18 +0,0 @@
-temporal:
-    oidc_client_id: ENC[AES256_GCM,data:y6eSNJpCNCg=,iv:4n5fIeiVG2JZOCD4yZ4Asm/gWvRl0QNFiRGTR1bs8ws=,tag:liLSr9sadR82UPq6d3gqGA==,type:str]
-    oidc_client_secret: ENC[AES256_GCM,data:ebk0FVtSfq7JbIT+84cigdLg8zfN+4HTfGxlgqLw6hs1H92SFRHQFXO1l3U=,iv:qxa8aqUVoN31PpzAhs6bNMDCM6yPvOT27urIrM1rfo0=,tag:Vo25X8Znw7eh5DNq1eIJEw==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArZ1pyMXZ0Y3RFQVZkcTg5
-            aENyemRueXpIM0FaUVhMc2ZyVDRyWWlzK1JzCjA0OTZ0aGJDNVVSM29CY1RzQWJL
-            eVNiSCtMSXdmbEtKeGt1L3NYMy9ibUEKLS0tIGJnU3A4MjVnZ1pCa1lPMnVoM0xo
-            dWs1cVM5ZCszbXp6eFltRVhGbFc0ajQKyCc8lClnSqWUxhNOr1FDCwn5V7nvjxPN
-            7kjQpldseaRbsy+TM5sFQ1w6Acmun9uYjzs8PtmTNaayc/AFfspufA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T23:22:55Z"
-    mac: ENC[AES256_GCM,data:0YuRxQHfdeKbjJzxHI4iBc7I2KnalNJmybB6bVQxvdRutsxKXW/bu99yqHkD4y/nI66Pi6d7LhrPhhGat3x2c6Drs7QRYVWnZ75thil6yWsOcpH7H1esxEWTP3cpoMzGdS0aF6zwU9H+WDvfm/t1wpeDpJly3eczcPvfbK1joDU=,iv:TgwfpI+ZVLyd2c/PKWsJbCI9yKkADpPPafJ5No0fLks=,tag:nqwQHtZ263CI+fY9iTUAzQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2