Merge Cloudflare secret wiring + yamllint sops exemption into main

ci/yamllint.yaml

@@ -7,9 +7,13 @@ yaml-files:
   - "*.yaml"
   - "*.yml"
 
-# ansible-vault-encrypted files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML — skip them.
+# Machine-generated encrypted files — skip them:
+#  - ansible-vault files are a `$ANSIBLE_VAULT;...` blob, not parseable YAML.
+#  - SOPS-encrypted secrets (*.sops.yaml) are re-emitted by `sops` with its own indentation
+#    and long ENC[...] / mac lines; they're never hand-edited, so linting them is noise.
 ignore: |
   **/vault.yml
+  **/*.sops.yaml
 
 rules:
   # Kubernetes / Kustomize / Helm manifests routinely exceed 80 cols; allow room

platform/cert-manager/kustomization.yaml

@@ -7,6 +7,5 @@ resources:
   - helmrelease.yaml
   - clusterissuers.yaml
   # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Operator flow:
-  # copy bootstrap/sops/secret-templates/cloudflare-api-token.cert-manager.yaml.example here as
-  # cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
-  # - cloudflare-api-token.sops.yaml
+  # SOPS-encrypted Cloudflare DNS-01 token (ClusterIssuer apiTokenSecretRef). Flux decrypts at reconcile.
+  - cloudflare-api-token.sops.yaml

platform/externaldns/kustomization.yaml

@@ -6,6 +6,5 @@ resources:
   - helmrepository.yaml
   - helmrelease.yaml
   # SOPS-encrypted Cloudflare token (env CF_API_TOKEN) — SAME token as cert-manager, second copy in
-  # the external-dns namespace. Copy bootstrap/sops/secret-templates/cloudflare-api-token.external-dns.yaml.example
-  # here as cloudflare-api-token.sops.yaml, fill + `sops -e -i`, then uncomment. See bootstrap/sops/CREDENTIALS.md.
-  # - cloudflare-api-token.sops.yaml
+  # the external-dns namespace. Flux decrypts at reconcile.
+  - cloudflare-api-token.sops.yaml