From 8ed3923c18580d839303b441110ccad137202b4f Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:54:34 -0700
Subject: [PATCH] fix: use ksops generator pattern for SOPS-encrypted secrets

- Remove configmap.enc.yaml from resources (blocked kustomize parsing)
- Create secret-generator.yaml with ksops exec plugin config
- ksops decrypts secrets before kustomize reads them
- Allows Image Updater to safely edit images section
- Fixes: ArgoCD repo-server now properly decrypts secrets via ksops plugin

Pattern mirrors homelab/k8s/argocd/secrets/ for consistency
---
 infra/portfolio/base/kustomization.yaml    | 13 +++++++++----
 infra/portfolio/base/secret-generator.yaml | 10 ++++++++++
 2 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 infra/portfolio/base/secret-generator.yaml

diff --git a/infra/portfolio/base/kustomization.yaml b/infra/portfolio/base/kustomization.yaml
index cc9dc18..24e665a 100644
--- a/infra/portfolio/base/kustomization.yaml
+++ b/infra/portfolio/base/kustomization.yaml
@@ -1,17 +1,22 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: portfolio
+
 resources:
 - namespace.yaml
-- configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml
 
+# SOPS-encrypted secrets via ksops generator (ArgoCD repo-server plugin)
+# ksops intercepts encrypted files, decrypts them, returns valid resources
+generatorOptions:
+  disableNameSuffixHash: true
+
+generators:
+  - secret-generator.yaml
+
 # ArgoCD Image Updater configuration - for tag updates
 images:
 - name: forgejo.riotpiao.com/rock/portfolio
   newTag: latest
-
-# Note: SOPS decryption is handled by ArgoCD repo-server plugin,
-# not via kustomization.yaml, to allow Image Updater to parse this file
diff --git a/infra/portfolio/base/secret-generator.yaml b/infra/portfolio/base/secret-generator.yaml
new file mode 100644
index 0000000..693d873
--- /dev/null
+++ b/infra/portfolio/base/secret-generator.yaml
@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: portfolio-secrets-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - configmap.enc.yaml