Story Crater Bot
88e73a885a
repoServer CPU limit (500m) was too tight once the SOPS sidecar added real decrypt work under the liveness probe's 1s timeout — repo-server kept getting killed mid-sync. Raised to 1000m (node has 23+ idle cores, no scarcity). Separately, the generate script's doc-separator fix exposed that several .enc.yaml files (cloudflared, temporal, authentik, loki) are raw Helm-values snippets, not K8s manifests — ArgoCD hard-failed the whole batch on the first one missing 'kind:'. Script now skips those, so correctly-shaped Secrets (grafana-admin included) sync independently. grafana-admin also needed an admin-user key alongside admin-password — the chart looks up both from the same existingSecret.
31 lines
946 B
YAML
31 lines
946 B
YAML
# ArgoCD CMP plugin for SOPS secret decryption
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: argocd-cmp-cm
|
|
namespace: argocd
|
|
data:
|
|
sops-secrets-v1.0.yaml: |
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: ConfigManagementPlugin
|
|
metadata:
|
|
name: sops-secrets-v1.0
|
|
spec:
|
|
generate:
|
|
command: [sh, -c]
|
|
args:
|
|
- |
|
|
# Find all .enc.yaml files and decrypt them, separating multi-doc output.
|
|
# Skip files that aren't full K8s manifests (no top-level "kind:") — some
|
|
# .enc.yaml files hold raw Helm values, not standalone Secret objects.
|
|
find . -name '*.enc.yaml' -type f | while read -r file; do
|
|
decrypted=$(sops -d "$file")
|
|
if echo "$decrypted" | grep -q '^kind:'; then
|
|
echo "---"
|
|
echo "$decrypted"
|
|
fi
|
|
done
|
|
discover:
|
|
find:
|
|
glob: "**/*.enc.yaml"
|