From d6f5b9ed69c2afeea5afb6e3a11288675f4ed5b1 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Mon, 20 Jul 2026 13:13:47 -0700 Subject: [PATCH] =?UTF-8?q?feat(argocd):=20wire=20SOPS=20ConfigManagementP?= =?UTF-8?q?lugin=20properly=20=E2=80=94=20initContainer=20installs=20sops/?= =?UTF-8?q?yq,=20sidecar=20decrypts=20*.enc.yaml=20into=20app=20Secrets?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Correct CMP setup (prior attempt used unsupported config): repoServer.initContainers fetches sops v3.9.0 + yq v4.44.3 into a shared volume; repoServer.extraContainers runs argocd-cmp-server with plugin.yaml from the sops-cmp-plugin ConfigMap, age key from sops-age Secret. Plugin emits authentik/loki-s3-creds/grafana-admin/grafana-oidc Secrets from decrypted enc files. sops-secrets Application (wave 0) uses the plugin at repo root. Unblocks authentik/loki/grafana which were Degraded on missing secrets. --- k8s/argocd/apps/00-secrets.yaml | 5 +- k8s/security/ci-cd/argocd-values.yaml | 63 +++++++++++++++++++++++ k8s/security/ci-cd/sops-cmp-plugin.yaml | 66 +++++++++++++++++++++++++ 3 files changed, 132 insertions(+), 2 deletions(-) create mode 100644 k8s/security/ci-cd/sops-cmp-plugin.yaml diff --git a/k8s/argocd/apps/00-secrets.yaml b/k8s/argocd/apps/00-secrets.yaml index a56d0e7..be6bb98 100644 --- a/k8s/argocd/apps/00-secrets.yaml +++ b/k8s/argocd/apps/00-secrets.yaml @@ -19,7 +19,8 @@ spec: source: repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git targetRevision: main - path: k8s/security/sops-secrets - directory: {} + path: . + plugin: + name: sops-secrets-v1.0 destination: server: https://kubernetes.default.svc diff --git a/k8s/security/ci-cd/argocd-values.yaml b/k8s/security/ci-cd/argocd-values.yaml index 95f5046..38c4880 100644 --- a/k8s/security/ci-cd/argocd-values.yaml +++ b/k8s/security/ci-cd/argocd-values.yaml @@ -91,6 +91,69 @@ repoServer: serviceMonitor: enabled: true + # ── SOPS ConfigManagementPlugin ───────────────────────────────────────────── + # initContainer fetches sops+yq into a shared volume; the sidecar runs + # argocd-cmp-server with the plugin.yaml from the sops-cmp-plugin ConfigMap and + # decrypts *.enc.yaml with the age key from the sops-age Secret. + initContainers: + - name: install-sops-tools + image: alpine:3.20 + command: [sh, -c] + args: + - | + set -e + apk add --no-cache curl + curl -sSfL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /custom-tools/sops + curl -sSfL https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_amd64 -o /custom-tools/yq + chmod +x /custom-tools/sops /custom-tools/yq + volumeMounts: + - name: custom-tools + mountPath: /custom-tools + extraContainers: + - name: sops-cmp + image: quay.io/argoproj/argocd:v3.4.5 + command: [/var/run/argocd/argocd-cmp-server] + env: + - name: PATH + value: /custom-tools:/usr/local/bin:/usr/bin:/bin + securityContext: + runAsNonRoot: true + runAsUser: 999 + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /var/run/argocd + name: var-files + - mountPath: /home/argocd/cmp-server/plugins + name: plugins + - mountPath: /home/argocd/cmp-server/config/plugin.yaml + subPath: plugin.yaml + name: sops-cmp-plugin + - mountPath: /home/argocd/plugins/generate.sh + subPath: generate.sh + name: sops-cmp-plugin + - mountPath: /custom-tools + name: custom-tools + - mountPath: /sops-age + name: sops-age + - mountPath: /tmp + name: cmp-tmp + volumes: + - name: custom-tools + emptyDir: {} + - name: cmp-tmp + emptyDir: {} + - name: sops-cmp-plugin + configMap: + name: sops-cmp-plugin + defaultMode: 0555 + - name: sops-age + secret: + secretName: sops-age + applicationSet: replicas: 1 resources: diff --git a/k8s/security/ci-cd/sops-cmp-plugin.yaml b/k8s/security/ci-cd/sops-cmp-plugin.yaml new file mode 100644 index 0000000..57db161 --- /dev/null +++ b/k8s/security/ci-cd/sops-cmp-plugin.yaml @@ -0,0 +1,66 @@ +# ConfigMap holding the SOPS CMP plugin spec + generate script. Mounted into the +# repo-server sidecar at /home/argocd/cmp-server/config/plugin.yaml (the path the +# argocd-cmp-server binary reads) and /home/argocd/plugins/generate.sh. +# +# The plugin decrypts every k8s/**/*secrets*.enc.yaml Helm-values fragment and +# emits correctly-keyed Kubernetes Secrets to stdout — no helm template inside +# the plugin. Applied to the argocd namespace (bootstrap resource). +apiVersion: v1 +kind: ConfigMap +metadata: + name: sops-cmp-plugin + namespace: argocd +data: + plugin.yaml: | + apiVersion: argoproj.io/v1alpha1 + kind: ConfigManagementPlugin + metadata: + name: sops-secrets + spec: + version: v1.0 + generate: + command: [sh, -c] + args: + - /home/argocd/plugins/generate.sh + discover: + fileName: "./*.sops-marker" + generate.sh: | + #!/bin/sh + set -eu + export SOPS_AGE_KEY_FILE=/sops-age/keys.txt + # CMP runs with cwd = the app source path; sops-secrets app points at repo + # root, so enc files resolve from the current directory. + REPO_ROOT="$(pwd)" + + emit_secret() { + # $1 ns $2 name then key=jqpath pairs read from decrypted $ENC + ns="$1"; name="$2"; shift 2 + printf 'apiVersion: v1\nkind: Secret\nmetadata:\n name: %s\n namespace: %s\ntype: Opaque\ndata:\n' "$name" "$ns" + for kv in "$@"; do + k="${kv%%=*}"; path="${kv#*=}" + val="$(echo "$DEC" | yq -r "$path")" + printf ' %s: %s\n' "$k" "$(printf '%s' "$val" | base64 -w0)" + done + printf -- '---\n' + } + + # ── authentik (iam) ──────────────────────────────────────────────── + DEC="$(sops -d "$REPO_ROOT/k8s/security/iam/authentik-secrets.enc.yaml")" + emit_secret iam authentik \ + AUTHENTIK_SECRET_KEY=.authentik.secret_key \ + AUTHENTIK_BOOTSTRAP_PASSWORD=.authentik.bootstrap_password \ + AUTHENTIK_BOOTSTRAP_TOKEN=.authentik.bootstrap_token \ + AUTHENTIK_POSTGRESQL__PASSWORD=.authentik.postgresql_password + + # ── loki S3 (logging) ────────────────────────────────────────────── + DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/loki-secrets.enc.yaml")" + emit_secret logging loki-s3-creds \ + access_key_id=.loki.s3.accessKeyId \ + secret_access_key=.loki.s3.secretAccessKey + + # ── grafana (logging) ────────────────────────────────────────────── + DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")" + emit_secret logging grafana-admin \ + admin-password=.adminPassword + emit_secret logging grafana-oidc \ + GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET