2026-09-09 07:43:27 +00:00
2 changed files with 19 additions and 4 deletions
@@ -1,17 +1,22 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: portfolio
+
 resources:
 - namespace.yaml
- configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml

+# SOPS-encrypted secrets via ksops generator (ArgoCD repo-server plugin)
+# ksops intercepts encrypted files, decrypts them, returns valid resources
+generatorOptions:
+  disableNameSuffixHash: true
+
+generators:
+  - secret-generator.yaml
+
 # ArgoCD Image Updater configuration - for tag updates
 images:
 - name: forgejo.riotpiao.com/rock/portfolio
  newTag: latest
-
-# Note: SOPS decryption is handled by ArgoCD repo-server plugin,
-# not via kustomization.yaml, to allow Image Updater to parse this file
@@ -0,0 +1,10 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: portfolio-secrets-generator
+  annotations:
+    config.kubernetes.io/function: |
+      exec:
+        path: ksops
+files:
+  - configmap.enc.yaml