Story Crater Bot
8d63db9f3b
- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml) - Remove helm install --wait flag (talos-cp-2 slow node timeout issue) - Add comprehensive progress logging with timestamps to bootstrap.sh - Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key) - Add local SOPS decryption for bootstrap secrets - Add CNPG NetworkPolicy allowing app→database connectivity - Disable Forgejo bundled dependencies (saves 66Gi storage) - Inject database credentials via deployment.env (GITEA__DATABASE__*) - Remove invalid ext4 mount options from StorageClass - Add namespace manifests with PodSecurity labels - Add encrypted forgejo-admin secret (SOPS) - Reduce forgejo-db size 50Gi→25Gi per instance - Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)
35 lines
959 B
YAML
35 lines
959 B
YAML
# ArgoCD CMP plugin for SOPS secret decryption
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-cmp-cm
|
|
namespace: argocd
|
|
data:
|
|
sops-secrets-v1.0.yaml: |
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: ConfigManagementPlugin
|
|
metadata:
|
|
name: sops-secrets-v1.0
|
|
spec:
|
|
version: v1.0
|
|
init:
|
|
command: [sh, -c]
|
|
args:
|
|
- |
|
|
# Install sops if not present
|
|
if ! command -v sops &> /dev/null; then
|
|
wget -qO- https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64 > /usr/local/bin/sops
|
|
chmod +x /usr/local/bin/sops
|
|
fi
|
|
generate:
|
|
command: [sh, -c]
|
|
args:
|
|
- |
|
|
# Find all .enc.yaml files and decrypt them
|
|
find . -name '*.enc.yaml' -type f | while read -r file; do
|
|
sops -d "$file"
|
|
done
|
|
discover:
|
|
find:
|
|
glob: "**/*.enc.yaml"
|