From d51713ad6aea39ba8c78b0d92522b41caf00350b Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:37:39 -0700
Subject: [PATCH] =?UTF-8?q?fix(iam):=20deploy=20authentik-secrets=20as=20k?=
 =?UTF-8?q?ind:Secret=20via=20ksops=20=E2=80=94=20was=20a=20helm-values=20?=
 =?UTF-8?q?fragment=20wired=20to=20nothing,=20so=20envFrom=20secretRef=20a?=
 =?UTF-8?q?uthentik-secrets=20never=20resolved=20(CreateContainerConfigErr?=
 =?UTF-8?q?or);=20provides=20AUTHENTIK=5FSECRET=5FKEY/BOOTSTRAP=5FPASSWORD?=
 =?UTF-8?q?/BOOTSTRAP=5FTOKEN?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../authentik-secrets.enc.yaml                | 20 ---------------
 k8s/argocd/secrets/authentik-secrets.enc.yaml | 25 +++++++++++++++++++
 k8s/argocd/secrets/secret-generator.yaml      |  1 +
 3 files changed, 26 insertions(+), 20 deletions(-)
 delete mode 100644 k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml
 create mode 100644 k8s/argocd/secrets/authentik-secrets.enc.yaml

diff --git a/k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml b/k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml
deleted file mode 100644
index eab1f6f..0000000
--- a/k8s/argocd/secrets/_deferred-values-fragments/authentik-secrets.enc.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-authentik:
-    secret_key: ENC[AES256_GCM,data:/7NF9khX7mCjwB7WI5BgbPQtLdqqrwkNuH9BoSCY5pAT2HdU5fVFxdsGguEo4UUmSSvrJ32AmaRgG2Xf3sJweKctyGsuNLauOzQXrYdqa2k=,iv:ZkDp4gOHY1eH44cDhGaZILi8dFDTNuYf1CVE+qrapzE=,tag:G2r3uuiixADJ/qQh/mT7Mw==,type:str]
-    bootstrap_password: ENC[AES256_GCM,data:4uNAXv1uuqiYO1j5CKntjHPWAX4+ek8v1zIrAFHJF+U=,iv:ccA703HMomR58cD2/6wK1W0IKJb7U1hNws6fmwG15E8=,tag:eO9zZ0TwUuXZ/vdHkSeO7w==,type:str]
-    bootstrap_token: ENC[AES256_GCM,data:OYRsLR+hzoKof7rZzzTu5eST6ByqRq+U+LWlhEC4qkLKVChhXi+mdIuK6RO5RHmHtgCBTyIikvwbFMLPSXAIEw==,iv:EJCetXnkNe+UuhWk4f3vr3kIEbCuVplVKHPne3aVIQ8=,tag:Rv/oDbf5afG7QHwSm/8SBg==,type:str]
-    postgresql_password: ENC[AES256_GCM,data:FG07lU+lJMm268FmpgZ4XaEk98ANWMiJ0zExLTl4Rkw=,iv:VSJ3d8p4f5SQM2lVdhSLY5dqdQTKwcfzOCATIM5M/cw=,tag:E5917Q6ofdSrrS9Pe8uMIg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFcStlcXdQb1AvZmxFT2U0
-            N05yYi9WQkc3WWsrMHc3VXBPQllnLzZEd2dFCnhuUENiWTg5OVV4MXBBd29rSVdN
-            MUdyZURiUHFXZlNld2NEOHkwa1RGZEEKLS0tIGRjUkFHL1lNcnErZ21UOE9TUTE4
-            RTNEMW5xbDJHYitTSjQ2cnRtSG9iQXMKXlHsfHV4EOoesW89I4McQdpKLfrcP1Cu
-            B3RhKbwPVVTx4RkSJ/Y02mV4C/MtHH8q1j4DgBvoBxU04efmD7u0VQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:w+RVU9gs7BaW8BOHISBhqGI3rj7gHwDgz71cAwpxemhJvM2D7to3ntGrae+W7jIvy/jie2Bnf40XfCOlgbuJGbAOZpyEodO80UhGNAr2XJH8mu1E4yJrq1Il+obTvDQU+cs4c78Ix/Mr+MzLnCLP/N3U0Qw5qJhxAGaDhH0g0AA=,iv:BgjCQM88VTInwvAbtudWkiuureT7wSM7QmCwlSGMycw=,tag:u4Z0lgXMJ9q4UE1hv/yl1A==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
diff --git a/k8s/argocd/secrets/authentik-secrets.enc.yaml b/k8s/argocd/secrets/authentik-secrets.enc.yaml
new file mode 100644
index 0000000..6436b1b
--- /dev/null
+++ b/k8s/argocd/secrets/authentik-secrets.enc.yaml
@@ -0,0 +1,25 @@
+apiVersion: ENC[AES256_GCM,data:Fc0=,iv:UFqMFeZTJZtFMoNeusjAoSI60U9StZS4IXw+n8JQCRM=,tag:uUvY4+jcjiSJHs0HDS3/7A==,type:str]
+kind: ENC[AES256_GCM,data:NUw86IEw,iv:gh4Vqn6uteYnYIFcXT/QVxRPKm+G+j2aIVuV71nZ4k4=,tag:nZA/x75Kx4+CoSx66BsvkQ==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:qex150pm0eGwYiiI05y9LUs=,iv:5Tk001T796c4HFikoh1ZVB6ierBfDqOUkFs5ilkr+V8=,tag:LiDAiCH7w6aRS41VKIlIKg==,type:str]
+    namespace: ENC[AES256_GCM,data:nI91,iv:c1hBWGMkVb+vg+MKNzty8CFfXxQabXEtT+EpiuQZNvo=,tag:BsGtJDbBadDdTa687+Sdag==,type:str]
+type: ENC[AES256_GCM,data:3rXawlSD,iv:FUtLK4KP7v/SBF08ZcU6siIO1qfjlJirf2x5PyzAjuA=,tag:mSIQ+Y43+wDfZGRbQ6a0Og==,type:str]
+stringData:
+    AUTHENTIK_SECRET_KEY: ENC[AES256_GCM,data:i5tVOWnN9a/cfhs6gckveRxUpiN7Ie227R/74kOIz6lQ5US2hkf03W5qSGCrzheL3DB0i8+d0iJYsApjn/wCiN7ndZZVFko3W5jDfVPybxc=,iv:djF1G9JHT5B7ziTokA/UuPpG+tG2LvFU4uMAR0x4M6o=,tag:vHOd7jLYkM8Evnr0QUVrCw==,type:str]
+    AUTHENTIK_BOOTSTRAP_PASSWORD: ENC[AES256_GCM,data:PjvYtH03CzQbTXEqt/Z18+u1zJdok7DLwDn51FUZXDA=,iv:pSwSm8hB0/Q8uOAcOZ1rTqq7BF782EglG19GGeghm1E=,tag:qGCQFWCrwsWBOiQ07ySMUQ==,type:str]
+    AUTHENTIK_BOOTSTRAP_TOKEN: ENC[AES256_GCM,data:1tnekGo0GIemJCMRenjN0yNeSiiMl/kky8ms84TsqBLaQ0lQzPxjq9qtgNJwoAsufxrznrkDVKjeOEHNYcA82A==,iv:NNFWSLMILoWccA9ihy1OArSS1X3OySB7PIHdXZdyzlg=,tag:t2w+KyReOXftTrU9pBQDnQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZGRKWm9PTkNSOENtREgx
+            M2V3Z0xxOXRhRGVRclo3SzBKRkc0VmtCY0NnClJPSGJRcUlzWmNFeTZ1bmorNEV4
+            U3l3TzVlMTlrWkJnQzBtUTJtcUwrM3MKLS0tIEJrMWZrbllYYUZKN1V4MVMzcXAv
+            eUtheHlNMHpsTEJXZ1FTMFVxbWloa0kKLRkE1Du+4gdOLerOl9y0mZw+8fqfECQY
+            uP64Q+9BSuPYNiTLZvYDzmdoy+KTS7i7C9rf+iU96R/crbQLamV9Ew==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-08-12T20:37:07Z"
+    mac: ENC[AES256_GCM,data:b3pDx340d1iZxsPPXzACckoLBrW+XjX1qlGrWEEI30j2Ao0hewTRZJyHbdI97A6b/hqzBN/4tjqqkdqm8goNhUQweMLTw86X6sALuE0aLS9wK53qjqih8fQwQBbgLDtjFXtW26h+smIm7aB5ZSDvU2le44HDXuWd83sWtCavNq0=,iv:ZMDsoKpygFJrYpXy2dA0IlxAi0jt24rxF72eUzgQs7k=,tag:WWE7G7+c9JK6fF1U9V8igg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
diff --git a/k8s/argocd/secrets/secret-generator.yaml b/k8s/argocd/secrets/secret-generator.yaml
index 11aa3c4..eec0bd2 100644
--- a/k8s/argocd/secrets/secret-generator.yaml
+++ b/k8s/argocd/secrets/secret-generator.yaml
@@ -7,6 +7,7 @@ metadata:
       exec:
         path: ksops
 files:
+  - authentik-secrets.enc.yaml
   - cloudflare-secrets.enc.yaml
   - forgejo-secrets.enc.yaml
   - grafana-oidc-secrets.enc.yaml