From d282ae1aa075d702a8fa1b6af312e33821239f6b Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:30:06 -0700
Subject: [PATCH] =?UTF-8?q?feat(argocd):=20deploy=20SOPS=20CMP=20plugin=20?=
 =?UTF-8?q?for=20secret=20decryption=20=E2=80=94=20Stage=200=20grafana?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts
*.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets.

Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates
grafana-values.yaml to wire admin.existingSecret (chart-native support).

CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik.
Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4
(loki/authentik/forgejo/temporal) extend plugin script incrementally after
verification.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 k8s/argocd/apps/00-secrets.yaml           | 26 ++++++++++++++++++
 k8s/argocd/bootstrap/sops-cmp-generate.sh | 32 +++++++++++++++++++++++
 k8s/platform/logging/grafana-values.yaml  |  9 ++++---
 k8s/security/ci-cd/argocd-values.yaml     | 29 ++++++++++++++++++++
 k8s/security/sops-secrets/.gitkeep        |  0
 5 files changed, 93 insertions(+), 3 deletions(-)
 create mode 100644 k8s/argocd/apps/00-secrets.yaml
 create mode 100755 k8s/argocd/bootstrap/sops-cmp-generate.sh
 create mode 100644 k8s/security/sops-secrets/.gitkeep

diff --git a/k8s/argocd/apps/00-secrets.yaml b/k8s/argocd/apps/00-secrets.yaml
new file mode 100644
index 0000000..328fcc9
--- /dev/null
+++ b/k8s/argocd/apps/00-secrets.yaml
@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-secrets
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  syncOptions:
+    - CreateNamespace=true
+  source:
+    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/security/sops-secrets
+    plugin: {}
+  destination:
+    server: https://kubernetes.default.svc
+  revisionHistoryLimit: 3
diff --git a/k8s/argocd/bootstrap/sops-cmp-generate.sh b/k8s/argocd/bootstrap/sops-cmp-generate.sh
new file mode 100755
index 0000000..61d6d6f
--- /dev/null
+++ b/k8s/argocd/bootstrap/sops-cmp-generate.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
+
+# Decrypt grafana secrets once
+GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)
+
+# Stage 0: grafana
+OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
+ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')
+
+cat <<EOF
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc
+  namespace: logging
+type: Opaque
+data:
+  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: logging
+type: Opaque
+data:
+  admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
+EOF
diff --git a/k8s/platform/logging/grafana-values.yaml b/k8s/platform/logging/grafana-values.yaml
index 68a494b..70c2af1 100644
--- a/k8s/platform/logging/grafana-values.yaml
+++ b/k8s/platform/logging/grafana-values.yaml
@@ -2,8 +2,8 @@
 # Grafana — dashboarding and log/metrics exploration UI.
 # Deployed in the logging namespace alongside Loki and Promtail.
 #
-# Secrets never set here:
-#   adminPassword        — injected via helmfile --set (GRAFANA_ADMIN_PASSWORD)
+# Secrets provided by ArgoCD SOPS CMP plugin:
+#   adminPassword        — mounted from the grafana-admin K8s Secret (admin.existingSecret)
 #   OAuth client secret  — mounted from the grafana-oidc K8s Secret (envFromSecret below)
 
 replicas: 1
@@ -14,9 +14,12 @@ deploymentStrategy:
   type: Recreate
 
 podAnnotations:
-  secret.reloader.stakater.com/reload: "grafana-oidc"
+  secret.reloader.stakater.com/reload: "grafana-oidc,grafana-admin"
 
 adminUser: admin
+admin:
+  existingSecret: grafana-admin
+  existingSecretKey: admin-password
 
 resources:
   requests:
diff --git a/k8s/security/ci-cd/argocd-values.yaml b/k8s/security/ci-cd/argocd-values.yaml
index 95f5046..e1c6df5 100644
--- a/k8s/security/ci-cd/argocd-values.yaml
+++ b/k8s/security/ci-cd/argocd-values.yaml
@@ -47,6 +47,15 @@ configs:
       g, homelab-admins, role:admin
     policy.default: role:readonly
 
+  cmp:
+    plugins:
+      sops-secrets:
+        generate:
+          command: sh
+          args:
+            - -c
+            - /var/run/argocd/plugins/sops-cmp-generate.sh
+
 server:
   replicas: 1
   deploymentStrategy:
@@ -90,6 +99,26 @@ repoServer:
     enabled: true
     serviceMonitor:
       enabled: true
+  extraContainers:
+    - name: sops-cmp
+      image: registry.gitlab.com/argoproj/argocd-helm-charts/argocd-cmp-server:v2.12.1
+      command: [/var/run/argocd/argocd-cmp-server]
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+      volumeMounts:
+        - mountPath: /var/run/argocd
+          name: var-files
+        - mountPath: /home/argocd/cmp-server/plugins
+          name: plugins
+        - mountPath: /tmp
+          name: tmp
+        - mountPath: /sops-age
+          name: sops-age
+  volumes:
+    - name: sops-age
+      secret:
+        secretName: sops-age
 
 applicationSet:
   replicas: 1
diff --git a/k8s/security/sops-secrets/.gitkeep b/k8s/security/sops-secrets/.gitkeep
new file mode 100644
index 0000000..e69de29