feat(argocd): deploy SOPS CMP plugin for secret decryption — Stage 0 grafana

Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts *.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets. Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates grafana-values.yaml to wire admin.existingSecret (chart-native support). CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik. Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4 (loki/authentik/forgejo/temporal) extend plugin script incrementally after verification. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
2026-07-20 11:30:06 -07:00
parent 063308308f
commit d282ae1aa0
5 changed files with 93 additions and 3 deletions
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
+
+# Decrypt grafana secrets once
+GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)
+
+# Stage 0: grafana
+OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
+ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')
+
+cat <<EOF
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc
+  namespace: logging
+type: Opaque
+data:
+  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: logging
+type: Opaque
+data:
+  admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
+EOF