feat(argocd): deploy SOPS CMP plugin for secret decryption — Stage 0 grafana

Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts *.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets. Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates grafana-values.yaml to wire admin.existingSecret (chart-native support). CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik. Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4 (loki/authentik/forgejo/temporal) extend plugin script incrementally after verification. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
2026-07-20 11:30:06 -07:00
parent 063308308f
commit d282ae1aa0
5 changed files with 93 additions and 3 deletions
@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-secrets
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+  syncOptions:
+    - CreateNamespace=true
+  source:
+    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/security/sops-secrets
+    plugin: {}
+  destination:
+    server: https://kubernetes.default.svc
+  revisionHistoryLimit: 3
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
+
+# Decrypt grafana secrets once
+GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)
+
+# Stage 0: grafana
+OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
+ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')
+
+cat <<EOF
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc
+  namespace: logging
+type: Opaque
+data:
+  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: logging
+type: Opaque
+data:
+  admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
+EOF