feat(argocd): wire SOPS ConfigManagementPlugin properly — initContainer installs sops/yq, sidecar decrypts *.enc.yaml into app Secrets

Correct CMP setup (prior attempt used unsupported config): repoServer.initContainers fetches sops v3.9.0 + yq v4.44.3 into a shared volume; repoServer.extraContainers runs argocd-cmp-server with plugin.yaml from the sops-cmp-plugin ConfigMap, age key from sops-age Secret. Plugin emits authentik/loki-s3-creds/grafana-admin/grafana-oidc Secrets from decrypted enc files. sops-secrets Application (wave 0) uses the plugin at repo root. Unblocks authentik/loki/grafana which were Degraded on missing secrets.
2026-07-20 13:13:47 -07:00
parent ce1fc4e296
commit d6f5b9ed69
3 changed files with 132 additions and 2 deletions
@@ -0,0 +1,66 @@
+# ConfigMap holding the SOPS CMP plugin spec + generate script. Mounted into the
+# repo-server sidecar at /home/argocd/cmp-server/config/plugin.yaml (the path the
+# argocd-cmp-server binary reads) and /home/argocd/plugins/generate.sh.
+#
+# The plugin decrypts every k8s/**/*secrets*.enc.yaml Helm-values fragment and
+# emits correctly-keyed Kubernetes Secrets to stdout — no helm template inside
+# the plugin. Applied to the argocd namespace (bootstrap resource).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sops-cmp-plugin
+  namespace: argocd
+data:
+  plugin.yaml: |
+    apiVersion: argoproj.io/v1alpha1
+    kind: ConfigManagementPlugin
+    metadata:
+      name: sops-secrets
+    spec:
+      version: v1.0
+      generate:
+        command: [sh, -c]
+        args:
+          - /home/argocd/plugins/generate.sh
+      discover:
+        fileName: "./*.sops-marker"
+  generate.sh: |
+    #!/bin/sh
+    set -eu
+    export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
+    # CMP runs with cwd = the app source path; sops-secrets app points at repo
+    # root, so enc files resolve from the current directory.
+    REPO_ROOT="$(pwd)"
+
+    emit_secret() {
+      # $1 ns  $2 name  then key=jqpath pairs read from decrypted $ENC
+      ns="$1"; name="$2"; shift 2
+      printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: %s\n  namespace: %s\ntype: Opaque\ndata:\n' "$name" "$ns"
+      for kv in "$@"; do
+        k="${kv%%=*}"; path="${kv#*=}"
+        val="$(echo "$DEC" | yq -r "$path")"
+        printf '  %s: %s\n' "$k" "$(printf '%s' "$val" | base64 -w0)"
+      done
+      printf -- '---\n'
+    }
+
+    # ── authentik (iam) ────────────────────────────────────────────────
+    DEC="$(sops -d "$REPO_ROOT/k8s/security/iam/authentik-secrets.enc.yaml")"
+    emit_secret iam authentik \
+      AUTHENTIK_SECRET_KEY=.authentik.secret_key \
+      AUTHENTIK_BOOTSTRAP_PASSWORD=.authentik.bootstrap_password \
+      AUTHENTIK_BOOTSTRAP_TOKEN=.authentik.bootstrap_token \
+      AUTHENTIK_POSTGRESQL__PASSWORD=.authentik.postgresql_password
+
+    # ── loki S3 (logging) ──────────────────────────────────────────────
+    DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/loki-secrets.enc.yaml")"
+    emit_secret logging loki-s3-creds \
+      access_key_id=.loki.s3.accessKeyId \
+      secret_access_key=.loki.s3.secretAccessKey
+
+    # ── grafana (logging) ──────────────────────────────────────────────
+    DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")"
+    emit_secret logging grafana-admin \
+      admin-password=.adminPassword
+    emit_secret logging grafana-oidc \
+      GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET