jakman85andClaude Opus 4.8
a108d5ab98
Operator directive: don't diverge architecture to avoid asking for credentials; provision them upfront via SOPS and keep the existing (unified) graph. Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2; monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance. Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's; restore unified base graph (dev = ../base + cluster-vars + SOPS decryption, R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes. platform/kustomization.yaml now phased (single shared list): Phase-2 set = kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components commented with phase markers. SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia); bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real secret values (operator encrypts). Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
68 lines
2.5 KiB
Markdown
68 lines
2.5 KiB
Markdown
# SOPS Secret Templates
|
|
|
|
This directory holds **reference templates** for the SOPS-encrypted secrets that
|
|
platform components consume. They are **not applied and not encrypted**.
|
|
|
|
## Why `.yaml.example`?
|
|
|
|
Every file here uses a `.yaml.example` extension so that:
|
|
|
|
- **kustomize never loads them** (they are not `.yaml` / not listed in any
|
|
`kustomization.yaml`), and
|
|
- **SOPS never auto-encrypts them** (the repo's `.sops.yaml` creation rules match
|
|
`*.sops.yaml`, not `*.yaml.example`).
|
|
|
|
They exist purely so the operator can see the exact Kubernetes Secret shape
|
|
(name, namespace, keys) each component expects. **They contain only placeholder
|
|
values** (`REPLACE-ME`, `<fill me>`) — never real secrets.
|
|
|
|
## Operator flow (per secret)
|
|
|
|
For each `<name>.yaml.example`:
|
|
|
|
1. **Copy** it to the target path shown in the file's top comment, renaming to
|
|
`<name>.sops.yaml`. Example:
|
|
|
|
```bash
|
|
cp bootstrap/sops/secret-templates/grafana-admin-credentials.yaml.example \
|
|
platform/monitoring/grafana-admin-credentials.sops.yaml
|
|
```
|
|
|
|
2. **Fill** in the real values (replace every `REPLACE-ME` / `<fill me>`).
|
|
|
|
3. **Encrypt in place** with SOPS + age:
|
|
|
|
```bash
|
|
sops -e -i platform/monitoring/grafana-admin-credentials.sops.yaml
|
|
```
|
|
|
|
4. **Wire it** into the component by adding the resource line (shown in the
|
|
file's top comment) under `resources:` in that component's
|
|
`kustomization.yaml`:
|
|
|
|
```yaml
|
|
resources:
|
|
- grafana-admin-credentials.sops.yaml
|
|
```
|
|
|
|
5. **Commit** the encrypted `.sops.yaml` (ciphertext is safe to commit) and the
|
|
`kustomization.yaml` change. Flux decrypts it at reconcile via the cluster
|
|
age key.
|
|
|
|
## Files in this directory
|
|
|
|
| Template | Secret / namespace | Phase |
|
|
|---|---|---|
|
|
| `cloudflare-api-token.cert-manager.yaml.example` | `cloudflare-api-token` / `cert-manager` | 2 |
|
|
| `cloudflare-api-token.external-dns.yaml.example` | `cloudflare-api-token` / `external-dns` (same token) | 2 |
|
|
| `grafana-admin-credentials.yaml.example` | `grafana-admin-credentials` / `monitoring` | 4 |
|
|
| `alertmanager-smtp.yaml.example` | `alertmanager-smtp` / `monitoring` | 4 |
|
|
| `keycloak-admin-credentials.yaml.example` | `keycloak-admin-credentials` / `keycloak` | 6 |
|
|
| `oauth2-proxy-credentials.yaml.example` | `oauth2-proxy-credentials` / `oauth2-proxy` | 6 |
|
|
| `pia-credentials.yaml.example` | `pia-credentials` / TBD (Phase-3 VPN) | 3 |
|
|
|
|
## Master checklist
|
|
|
|
See [`bootstrap/sops/CREDENTIALS.md`](../CREDENTIALS.md) for the full,
|
|
end-to-end credential provisioning flow and checklist.
|