feat(argocd): deploy SOPS CMP plugin for secret decryption — Stage 0 grafana

Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts
*.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets.

Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates
grafana-values.yaml to wire admin.existingSecret (chart-native support).

CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik.
Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4
(loki/authentik/forgejo/temporal) extend plugin script incrementally after
verification.

Co-Authored-By: Claude Haiku 4.5 <[email protected]>

k8s/argocd/apps/00-secrets.yaml

@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-secrets
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  syncOptions:
+    - CreateNamespace=true
+  source:
+    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/security/sops-secrets
+    plugin: {}
+  destination:
+    server: https://kubernetes.default.svc
+  revisionHistoryLimit: 3

k8s/argocd/bootstrap/sops-cmp-generate.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
+
+# Decrypt grafana secrets once
+GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)
+
+# Stage 0: grafana
+OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
+ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')
+
+cat <<EOF
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc
+  namespace: logging
+type: Opaque
+data:
+  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: logging
+type: Opaque
+data:
+  admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
+EOF

k8s/platform/logging/grafana-values.yaml

@@ -2,8 +2,8 @@
 # Grafana — dashboarding and log/metrics exploration UI.
 # Deployed in the logging namespace alongside Loki and Promtail.
 #
-# Secrets never set here:
-#   adminPassword        — injected via helmfile --set (GRAFANA_ADMIN_PASSWORD)
+# Secrets provided by ArgoCD SOPS CMP plugin:
+#   adminPassword        — mounted from the grafana-admin K8s Secret (admin.existingSecret)
 #   OAuth client secret  — mounted from the grafana-oidc K8s Secret (envFromSecret below)
 
 replicas: 1
@@ -14,9 +14,12 @@ deploymentStrategy:
   type: Recreate
 
 podAnnotations:
-  secret.reloader.stakater.com/reload: "grafana-oidc"
+  secret.reloader.stakater.com/reload: "grafana-oidc,grafana-admin"
 
 adminUser: admin
+admin:
+  existingSecret: grafana-admin
+  existingSecretKey: admin-password
 
 resources:
   requests:

k8s/security/ci-cd/argocd-values.yaml

@@ -47,6 +47,15 @@ configs:
       g, homelab-admins, role:admin
     policy.default: role:readonly
 
+  cmp:
+    plugins:
+      sops-secrets:
+        generate:
+          command: sh
+          args:
+            - -c
+            - /var/run/argocd/plugins/sops-cmp-generate.sh
+
 server:
   replicas: 1
   deploymentStrategy:
@@ -90,6 +99,26 @@ repoServer:
     enabled: true
     serviceMonitor:
       enabled: true
+  extraContainers:
+    - name: sops-cmp
+      image: registry.gitlab.com/argoproj/argocd-helm-charts/argocd-cmp-server:v2.12.1
+      command: [/var/run/argocd/argocd-cmp-server]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+      volumeMounts:
+        - mountPath: /var/run/argocd
+          name: var-files
+        - mountPath: /home/argocd/cmp-server/plugins
+          name: plugins
+        - mountPath: /tmp
+          name: tmp
+        - mountPath: /sops-age
+          name: sops-age
+  volumes:
+    - name: sops-age
+      secret:
+        secretName: sops-age
 
 applicationSet:
   replicas: 1