Story Crater BotandClaude Haiku 4.5
d282ae1aa0
Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts *.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets. Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates grafana-values.yaml to wire admin.existingSecret (chart-native support). CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik. Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4 (loki/authentik/forgejo/temporal) extend plugin script incrementally after verification. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
33 lines
706 B
Bash
Executable File
33 lines
706 B
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
export SOPS_AGE_KEY_FILE=/sops-age/keys.txt
|
|
|
|
# Decrypt grafana secrets once
|
|
GRAFANA_SECRETS=$(sops -d k8s/platform/logging/grafana-secrets.enc.yaml)
|
|
|
|
# Stage 0: grafana
|
|
OIDC_SECRET=$(echo "$GRAFANA_SECRETS" | yq -r '.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET')
|
|
ADMIN_PASSWORD=$(echo "$GRAFANA_SECRETS" | yq -r '.adminPassword')
|
|
|
|
cat <<EOF
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-oidc
|
|
namespace: logging
|
|
type: Opaque
|
|
data:
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: $(echo -n "$OIDC_SECRET" | base64 -w0)
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-admin
|
|
namespace: logging
|
|
type: Opaque
|
|
data:
|
|
admin-password: $(echo -n "$ADMIN_PASSWORD" | base64 -w0)
|
|
EOF
|