Added fixes before token usage cutoff. Added required credentials for dns api for cert-manager and external-dns

2026-08-16 23:12:25 -05:00
1 parent a63c841342
commit 06fa317063
@@ -0,0 +1,43 @@
+# =============================================================================
+# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
+# and never auto-encrypted by SOPS). Reference scaffold only.
+#
+# (a) Copy to:      platform/cert-manager/cloudflare-api-token.sops.yaml
+# (b) kustomization: add this line under `resources:` in
+#                    platform/cert-manager/kustomization.yaml
+#                       - cloudflare-api-token.sops.yaml
+# (c) Encrypt:       sops -e -i platform/cert-manager/cloudflare-api-token.sops.yaml
+# (d) Consumed by:   cert-manager ClusterIssuers (DNS-01 solver). The Cloudflare
+#                    DNS-01 solver's apiTokenSecretRef points at secret
+#                    `cloudflare-api-token`, key `api-token`. [Phase 2]
+#
+# The token must be a Cloudflare API token with Zone:DNS:Edit + Zone:Read scope.
+# =============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-api-token
+    namespace: cert-manager
+type: Opaque
+stringData:
+    api-token: ENC[AES256_GCM,data:3B3SYYtEDObLThD5FcgJnUP3YRhPSo3p/44HUz5s0u0QZZY888NvOBXp8OhV65n0Q9Wa6MY=,iv:qZ6Qfytl99+uGQX5DYfXtGZpywr6TRA0oZ8d6s8B3TE=,tag:hRHbcyBqsHArkf184Lm8ZQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrbXZHTncvcVJ5VnArSklG
+            K0FLUVFPdGlDNHpPRHh0TWlhS3dLRUFPSmdvCjY2WlYrY2sxUUt6VmxNM2VhcnFu
+            dkF1clJTdFgrU1VSa2hMREZSUWlCY0UKLS0tIDU0cDkwU0xvQzJzUHYrR3A0cEpV
+            cDNGWFZQUWFVN3g4cEtVUHJzV0RtV0EKrajH83JeVGFs5xf5tqy6TbLIYDXNcDLU
+            YMVzmw16FL4UbUQy/z/sC19voOuty5tlV0oQH01uE12qzYYR24bXzQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-17T04:07:14Z"
+    mac: ENC[AES256_GCM,data:4rhbN0ZWlxuLZeiN1yNSE33EC+xEyNNEavIsetxGSaOIxqPAK4SDvS5HAqpiUBFSDVIzvSIV6cDA3Y/M0IaOQ5bkhYbElxPEFGNfrz1R693UV39AA8f11ZkzwDHQSgGKSBTJGM+YSteblB+6jfbw0ktpurI4JNcVqGHG3PpOWNY=,iv:+BBJHn3i1n296A+Vi3wUTFNWupxccv6LOpF06F9QAuI=,tag:Z6GOMmlpzttEqNf1iH2rXw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4
@@ -0,0 +1,47 @@
+# =============================================================================
+# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
+# and never auto-encrypted by SOPS). Reference scaffold only.
+#
+# (a) Copy to:      platform/externaldns/cloudflare-api-token.sops.yaml
+#                   (component DIR is platform/externaldns/, but the Kubernetes
+#                    NAMESPACE is external-dns — note the hyphen.)
+# (b) kustomization: add this line under `resources:` in
+#                    platform/externaldns/kustomization.yaml
+#                       - cloudflare-api-token.sops.yaml
+# (c) Encrypt:       sops -e -i platform/externaldns/cloudflare-api-token.sops.yaml
+# (d) Consumed by:   external-dns reads env CF_API_TOKEN via secretKeyRef
+#                    name `cloudflare-api-token`, key `api-token`. [Phase 2]
+#
+# NOTE: This is the SAME Cloudflare token as the cert-manager copy — just a
+# second copy living in the external-dns namespace. ClusterIssuer secrets and
+# external-dns run in different namespaces, so the token must exist in both. A
+# single Cloudflare API token with Zone:DNS:Edit + Zone:Read scope serves both.
+# =============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-api-token
+    namespace: external-dns
+type: Opaque
+stringData:
+    api-token: ENC[AES256_GCM,data:8+4CNm8QZh4Q8Z33r+YRKXUlh7CGHzSaXcUEC9pWbGhyaAeAbea8mFm3eXVxKqbmuclgiYw=,iv:1NsSyjiH1ZU7Nh9FW9aBGhmY5KDB9koKFx+T8aeSd4k=,tag:GVL5/EWJW6TmSGo9wDGJ5w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcEdxSklUSWkwVHJqRU5S
+            NEJuZjc1L0VkeStQdTJtS3RuRnpwUTIwMFNnClFzaFE3SDRXN0NIL3AzSzVmcjlL
+            N0RPb1FNR1UzNVFMbVFXSFA5bkZ6ZmcKLS0tIGNKbG1yRGN4QW91aEgwSDJuN2t6
+            blFCdXlLVDBGK3JESGhuME5QeVRpOE0Ke9WNjV8CSEdzelFyhn/ZWCUJfAhwSZcf
+            KE2ms+cJ7cR6hSjLFQWal6Rbt4fX7qogPtWSpQ1pR3+8F/00X6ruTw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-17T03:56:14Z"
+    mac: ENC[AES256_GCM,data:Hr2Q0EuzUbF08yE6pK34FbJ8hBWDoKuNnqzB4TZsauLKz9ZUHq0A+UKNX6oG+PNUujSTGf3BlyY4hffNWrH5mcGAA7k9yWpqUKDdALlde89X3KqVckUe7RWHLgcz7h8pDSr3kekoowXc49XtGS86ArqulEnH4QdwoPcHNvo/qwI=,iv:aC/dU2zQ1oK8SxndVJw81URPe2rgH6KJTsvh/K4K8jY=,tag:bIuEtbB+p294EqxzqX3D9Q==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4