From f06cefabc45de214c4dea747e55c14a247a04c04 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Tue, 11 Aug 2026 14:06:06 -0700 Subject: [PATCH] fix(argocd): wire missing SOPS CMP plugin sidecar on repo-server, add grafana-admin secret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sidecar container was absent from live repo-server Deployment (never in helm history), causing sops-secrets Application to fail with cmp-server socket not found — cascaded CreateContainerConfigError across every app depending on SOPS-decrypted secrets. Also fixes duplicate version field in plugin ConfigMap that produced a mismatched socket filename, and adds an initContainer to fetch the sops binary into a writable emptyDir since the sidecar runs non-root. grafana-secrets.enc.yaml rewritten from a bare values file (never valid as a K8s Secret) to a proper Secret manifest so grafana-admin now actually gets created. --- .../phase4-argocd/argocd-cmp-cm.yaml | 10 ---- .../phase4-argocd/argocd-values.yaml | 55 +++++++++++++++++++ k8s/infra/logging/grafana-secrets.enc.yaml | 25 +++++---- 3 files changed, 70 insertions(+), 20 deletions(-) diff --git a/k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml b/k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml index ea4fdbe..44faa65 100644 --- a/k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml +++ b/k8s/bootstrap/phase4-argocd/argocd-cmp-cm.yaml @@ -11,16 +11,6 @@ data: metadata: name: sops-secrets-v1.0 spec: - version: v1.0 - init: - command: [sh, -c] - args: - - | - # Install sops if not present - if ! command -v sops &> /dev/null; then - wget -qO- https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 > /usr/local/bin/sops - chmod +x /usr/local/bin/sops - fi generate: command: [sh, -c] args: diff --git a/k8s/bootstrap/phase4-argocd/argocd-values.yaml b/k8s/bootstrap/phase4-argocd/argocd-values.yaml index bc41fa1..9be5fdd 100644 --- a/k8s/bootstrap/phase4-argocd/argocd-values.yaml +++ b/k8s/bootstrap/phase4-argocd/argocd-values.yaml @@ -54,6 +54,61 @@ repoServer: operator: Exists effect: NoSchedule + # Fetch sops binary into shared emptyDir (runs as root; main containers can't write /usr/local/bin) + initContainers: + - name: install-sops + image: alpine:3.20 + command: [sh, -c] + args: + - | + wget -qO /sops-bin/sops https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 + chmod +x /sops-bin/sops + volumeMounts: + - mountPath: /sops-bin + name: sops-bin + + # SOPS CMP sidecar (decrypts *.enc.yaml via argocd-cmp-cm ConfigMap plugin) + extraContainers: + - name: sops-secrets-v1 + command: [/var/run/argocd/argocd-cmp-server] + image: quay.io/argoproj/argocd:v3.4.5 + env: + - name: SOPS_AGE_KEY_FILE + value: /sops-age/key.txt + - name: PATH + value: /sops-bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + volumeMounts: + - mountPath: /var/run/argocd + name: var-files + - mountPath: /home/argocd/cmp-server/plugins + name: plugins + - mountPath: /tmp + name: cmp-tmp + - mountPath: /home/argocd/cmp-server/config/plugin.yaml + subPath: sops-secrets-v1.0.yaml + name: argocd-cmp-cm + - mountPath: /sops-age + name: sops-age + readOnly: true + - mountPath: /sops-bin + name: sops-bin + readOnly: true + securityContext: + runAsNonRoot: true + runAsUser: 999 + + volumes: + - name: sops-bin + emptyDir: {} + - name: cmp-tmp + emptyDir: {} + - name: argocd-cmp-cm + configMap: + name: argocd-cmp-cm + - name: sops-age + secret: + secretName: sops-age + # Controller configuration controller: resources: diff --git a/k8s/infra/logging/grafana-secrets.enc.yaml b/k8s/infra/logging/grafana-secrets.enc.yaml index 1d86e79..f5046c4 100644 --- a/k8s/infra/logging/grafana-secrets.enc.yaml +++ b/k8s/infra/logging/grafana-secrets.enc.yaml @@ -1,18 +1,23 @@ -adminPassword: ENC[AES256_GCM,data:qykgCu5Kv5IwzM1JFLXL7wgiAyI=,iv:bAph3Jd4fxuyglS7zrWIwzfUgK/wBwRrcEpKusgFhVk=,tag:ymwdnU/Dxnp54eGur2caoQ==,type:str] -env: - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:FwldsYfbOkRYGcycxn5BHZk/dOZsu23e3UCPo7dJKrcyr0n8dXQ9nH5XVSRHDpLOdRk7wbQwl+4Rgb8bGs21/w==,iv:JkNEfbsEIeE9TGouDA1xgjS4fX+v/sDrimaGpc4iaME=,tag:6Z3X29GKbgd2x6ghWA+CUw==,type:str] +apiVersion: ENC[AES256_GCM,data:BTs=,iv:xd8LqaXGfzo52SPAQYuUmHVcFD68hST+MRhs5JHjwU4=,tag:oJVWyA9pFBkTTzjB6gmahQ==,type:str] +kind: ENC[AES256_GCM,data:+bWoytA7,iv:dTjYaCtLsQ63Utq9uW2BNydSFsBFe1z3+Ev9suCjN/k=,tag:Jl00LjJayDxycWKt9sfzew==,type:str] +metadata: + name: ENC[AES256_GCM,data:4QXIyXaahJc+++YKcQ==,iv:l1321009Nz16407LDntwoxXAKcrKaGAWYi6uYhlgocw=,tag:vPSTVlxgj0v8cIHf8lI3Gw==,type:str] + namespace: ENC[AES256_GCM,data:kegyFUpUTg==,iv:FcKkgCI+yDM0dDFq2+hDbqzwpNCGKQkhXiMXB57IadA=,tag:UyXgT7dJ+5ECY5ptBER08w==,type:str] +type: ENC[AES256_GCM,data:2a2VYwV4,iv:uwMiEGmUOxvmbHyDtTYN4jflni+z3tgsFsODc4M60yE=,tag:8gEA5x+dPm8svxpEhNNfsA==,type:str] +stringData: + admin-password: ENC[AES256_GCM,data:sLmcTvdXQbI/EfUTyw==,iv:kyIAyCPn6iinaaKcjpGDPtzDoi28GhX8ykImSsZxbOg=,tag:r1Til5RWCej2nLDOXAjnZw==,type:str] sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQdVNSMWZaVDZuN2RBKyt0 - eWJHRm5vRlErZ1UweXA0N2xSNGdESE5leWo4CjQ2TTlONnpJK2VZWmxoamdhdHZN - ZGVMSU84SUZpVTUxREZlek9JcUxaTXcKLS0tIHlNaEpzZG1iaVpvU0E1UTQzbkVk - WnQxSHZ6S3cyZ2hUTlpTNXQyaVZzRU0KwU/0aRJ0D/UsqtFcrJLmuHpNELhTsfYS - 4WL2TQ/yaUz261s7LEVQdpKUza8JjQXiKqqNcV2gaqEWurdx20ILzQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAycTcwSEdVbXkvd1RLMmNK + ZzZWSVB1RHZaK2RhbmZCYmI5eFZPN05KUG1NCkl5WW54VjZJM1U2ODFGd3NDQkVH + OHRDaFVoL3Rqdm5YVFJodkZGNWxzNE0KLS0tIGVwVC9velV2d0doSklScWtuQk8v + c1l4TWdrL1JhUjYxRm8zNEdMcTJGVkEK43xCEPxYJa0nv7AJixflsawuKkcjNnPu + lj+PUeQzWNKGziWsEjRMyFCux6hIzr5mwk8R0CAu8WLFWQOKu6Mqag== -----END AGE ENCRYPTED FILE----- recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T23:02:08Z" - mac: ENC[AES256_GCM,data:LeN0mm7i7fsDpwtGQ6La7/UzhHbKfG1f/K30wW7fZJ1XbqPZGh7cdq07kMqrodlR6oWvrq7r4gbyuhcH9ptlxKgN4NuD3OoUjn6/CiPEF+wzgKMMgg2JdqFLsZNxVvGL/Ig3Y5hP5iag91QdtQxXaJmaV6Q9+FF6maYofsOU2rA=,iv:Eik9jEhdu+7qJv1oN7e1Vydnv7rh0pnRpbcBPDhh8e8=,tag:Mkry9bpTsmsf9Xs1jW7b1g==,type:str] + lastmodified: "2026-08-11T21:04:35Z" + mac: ENC[AES256_GCM,data:rTgYeF39pNDXerJ3mn4J+Cg2JTye3rZnNd7RHUZjayO5S+uvnZa0a7bNBNEXmf0ctqKIamsnPbMDWluNt8/vN9h4AsU0ssajrWH0hK45XYJtAiHJ2YP1CdWgYYMxalsEitw8OnO/eJ70wuxbAs8eVTHIbSVjcDmRYGJyblUjM3U=,iv:E1yYQJpr/MV0RRWNRCZmUvw/Lkr69GtAmpOja014aPs=,tag:OoMR94Y/lhrAeEW8ZEkj3w==,type:str] unencrypted_suffix: _unencrypted version: 3.13.2