Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

wire Cloudflare DNS token secrets + exempt *.sops.yaml from yamllint

Browse Source 
- Rename the committed encrypted secrets to canonical cloudflare-api-token.sops.yaml
  (cert-manager + external-dns namespaces) and uncomment the resource lines in both
  kustomizations, so cert-manager DNS-01 + ExternalDNS get the token at reconcile.
- Exempt **/*.sops.yaml from ci/yamllint.yaml: SOPS re-emits encrypted files with its
  own indentation + long ENC[...] lines (never hand-edited), which was failing the lint
  gate on main after the secrets were committed. Same treatment as **/vault.yml.

Both Secrets confirmed present + encrypted in the platform build; gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-17 00:35:45 -05:00
1 parent 06fa317063
commit 275ac466b2
5 files changed
+9 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

platform/cert-manager/cloudflare-api-token.cert-manager.sops.yaml → platform/cert-manager/cloudflare-api-token.sops.yaml
View File
File renamed without changes.
platform/cert-manager/kustomization.yaml
+2 -3
View File
@@ -7,6 +7,5 @@ resources:
- helmrelease.yaml
- clusterissuers.yaml
# SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Operator flow:
# copy bootstrap/sops/secret-templates/cloudflare-api-token.cert-manager.yaml.example here as
# cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
# - cloudflare-api-token.sops.yaml
# SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Flux decrypts at reconcile.
- cloudflare-api-token.sops.yaml