Story Crater BotandClaude Haiku 4.5
d282ae1aa0
Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts *.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets. Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates grafana-values.yaml to wire admin.existingSecret (chart-native support). CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik. Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4 (loki/authentik/forgejo/temporal) extend plugin script incrementally after verification. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
27 lines
616 B
YAML
27 lines
616 B
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: sops-secrets
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
project: homelab
|
|
revisionHistoryLimit: 3
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
source:
|
|
repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
|
|
targetRevision: main
|
|
path: k8s/security/sops-secrets
|
|
plugin: {}
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
revisionHistoryLimit: 3
|