Story Crater BotandClaude Haiku 4.5
4379f3cb21
Phase 0 groundwork for helmfile→ArgoCD migration using SOPS (Secrets Operations): 1. Install SOPS + AGE encryption - AGE key generated and stored locally at ~/.sops/key.txt - Public key embedded in .sops.yaml for file encryption rules 2. Create K8s Secret for AGE private key - kubectl: create secret generic sops-age -n argocd --from-file=keys.txt=~/.sops/key.txt - ArgoCD will use this key to decrypt secrets at sync time 3. Encrypt initial secrets - k8s/base/secrets.enc.yaml: AES256_GCM encrypted secrets for all services - Placeholder values (will be replaced with real values per environment) - Secrets never visible in git (encrypted at rest) 4. Configure SOPS - .sops.yaml: creation rules for k8s/*/secrets.enc.yaml files - All future secret files auto-encrypt on edit (sops -e) Setup: Store AGE key as K8s Secret in argocd namespace: export KUBECONFIG=cluster-config/kubeconfig kubectl create secret generic sops-age -n argocd --from-file=keys.txt=~/.sops/key.txt Next: Configure ArgoCD Helm plugin to decrypt secrets on sync (Phase 0 continuation). Co-Authored-By: Claude Haiku 4.5 <[email protected]>
4 lines
127 B
YAML
4 lines
127 B
YAML
creation_rules:
|
|
- path_regex: k8s/.*secrets.*\.ya?ml
|
|
age: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|