rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
37 Commits 3 Branches 0 Tags
3e0a1c86ba6f6fd804b6defbe86e1bc9a52a334e
Commit Graph
7 Commits
Author SHA1 Message Date
Story Crater Bot 08a3fd9bcb feat(phase0): configure ArgoCD SOPS decryption + update encrypted secrets 
Phase 0 continuation: enable ArgoCD to decrypt SOPS-encrypted secrets on sync.

1. Update ArgoCD Helm values (terraform/argocd-bootstrap.tf):
   - Add SOPS_AGE_KEY_FILE env var to repoServer
   - Mount sops-age K8s Secret at /home/argocd/.sops
   - Add ConfigManagementPlugin for SOPS (detects *.enc.yaml files)

2. Update encrypted secrets with real values:
   - k8s/base/secrets.enc.yaml: encrypted with actual service credentials
   - All secret values encrypted at rest in git
   - ArgoCD decrypts on sync using K8s Secret + AGE key

Prerequisites:
  - K8s Secret created: kubectl create secret generic sops-age -n argocd --from-file=keys.txt=/Users/rockliang/.sops/key.txt
  - SOPS_AGE_KEY_FILE env var set in ArgoCD repoServer (done above)

Next: Phase 1 — migrate 9 hookless releases to ArgoCD + create Applications that reference encrypted secrets.
 2026-08-18 15:08:01 -07:00
Story Crater Bot 80e146e106 feat(minio): migrate to official MinIO Operator chart, TF-owned 2026-08-18 15:08:01 -07:00
Story Crater Bot 07b785e5fc Fix: Inject homelab-ca cert into ArgoCD repo-server 
- Mount homelab-ca-secret for TLS verification
- Allows repo-server to reach forgejo.riotpiao.homelab.com
- Fixes x509 certificate verification error
 2026-08-18 15:08:01 -07:00
Story Crater Bot 68dc426e53 feat(argocd): phase2 app-of-apps for 19 workloads + AppProject sourceRepos fix 2026-08-18 15:08:01 -07:00
Story Crater Bot f64fda297e Temp: disable kubernetes_manifest cert-manager resources (already live) 
- Will import separately after helm issues resolved
- Avoids re-create conflicts during bootstrap apply
 2026-08-18 15:08:01 -07:00
Story Crater Bot 1c1b924d1d Fix: downgrade ArgoCD to 7.3.3, ignore helm metadata drift 
- ArgoCD 7.9.1 -> 7.3.3 (match live cluster)
- Ignore helm release metadata in lifecycle rules
- Prevents unnecessary upgrade attempts
 2026-08-18 15:08:00 -07:00
Story Crater Bot 4e473978b5 Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF 
- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply
 2026-08-18 15:08:00 -07:00