refactor(argocd): replace SOPS CMP with ksops kustomize generator, rotate age key — CMP discover glob silently shadowed kustomize rendering of any app whose path held a .enc.yaml (MinIO Tenant/cloudflared/authentik jobs never applied); centralize 8 Secret manifests under k8s/argocd/secrets, defer 4 helm-values fragments

2026-08-12 13:16:15 -07:00
parent 9e84fb3386
commit beb3cb21a0
31 changed files with 383 additions and 393 deletions
@@ -0,0 +1,17 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: sops-secret-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - cloudflare-secrets.enc.yaml
+  - forgejo-secrets.enc.yaml
+  - grafana-oidc-secrets.enc.yaml
+  - grafana-secrets.enc.yaml
+  - homarr-secrets.enc.yaml
+  - homelab-ca-secrets.enc.yaml
+  - minio-secrets.enc.yaml
+  - vault-secrets.enc.yaml