- Remove configmap.enc.yaml from resources (blocked kustomize parsing) - Create secret-generator.yaml with ksops exec plugin config - ksops decrypts secrets before kustomize reads them - Allows Image Updater to safely edit images section - Fixes: ArgoCD repo-server now properly decrypts secrets via ksops plugin Pattern mirrors homelab/k8s/argocd/secrets/ for consistency