jakman85andClaude Opus 4.8
275ac466b2
- Rename the committed encrypted secrets to canonical cloudflare-api-token.sops.yaml (cert-manager + external-dns namespaces) and uncomment the resource lines in both kustomizations, so cert-manager DNS-01 + ExternalDNS get the token at reconcile. - Exempt **/*.sops.yaml from ci/yamllint.yaml: SOPS re-emits encrypted files with its own indentation + long ENC[...] lines (never hand-edited), which was failing the lint gate on main after the secrets were committed. Same treatment as **/vault.yml. Both Secrets confirmed present + encrypted in the platform build; gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
48 lines
2.6 KiB
YAML
48 lines
2.6 KiB
YAML
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
|
|
# and never auto-encrypted by SOPS). Reference scaffold only.
|
|
#
|
|
# (a) Copy to: platform/externaldns/cloudflare-api-token.sops.yaml
|
|
# (component DIR is platform/externaldns/, but the Kubernetes
|
|
# NAMESPACE is external-dns — note the hyphen.)
|
|
# (b) kustomization: add this line under `resources:` in
|
|
# platform/externaldns/kustomization.yaml
|
|
# - cloudflare-api-token.sops.yaml
|
|
# (c) Encrypt: sops -e -i platform/externaldns/cloudflare-api-token.sops.yaml
|
|
# (d) Consumed by: external-dns reads env CF_API_TOKEN via secretKeyRef
|
|
# name `cloudflare-api-token`, key `api-token`. [Phase 2]
|
|
#
|
|
# NOTE: This is the SAME Cloudflare token as the cert-manager copy — just a
|
|
# second copy living in the external-dns namespace. ClusterIssuer secrets and
|
|
# external-dns run in different namespaces, so the token must exist in both. A
|
|
# single Cloudflare API token with Zone:DNS:Edit + Zone:Read scope serves both.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cloudflare-api-token
|
|
namespace: external-dns
|
|
type: Opaque
|
|
stringData:
|
|
api-token: ENC[AES256_GCM,data:8+4CNm8QZh4Q8Z33r+YRKXUlh7CGHzSaXcUEC9pWbGhyaAeAbea8mFm3eXVxKqbmuclgiYw=,iv:1NsSyjiH1ZU7Nh9FW9aBGhmY5KDB9koKFx+T8aeSd4k=,tag:GVL5/EWJW6TmSGo9wDGJ5w==,type:str]
|
|
sops:
|
|
kms: []
|
|
gcp_kms: []
|
|
azure_kv: []
|
|
hc_vault: []
|
|
age:
|
|
- recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcEdxSklUSWkwVHJqRU5S
|
|
NEJuZjc1L0VkeStQdTJtS3RuRnpwUTIwMFNnClFzaFE3SDRXN0NIL3AzSzVmcjlL
|
|
N0RPb1FNR1UzNVFMbVFXSFA5bkZ6ZmcKLS0tIGNKbG1yRGN4QW91aEgwSDJuN2t6
|
|
blFCdXlLVDBGK3JESGhuME5QeVRpOE0Ke9WNjV8CSEdzelFyhn/ZWCUJfAhwSZcf
|
|
KE2ms+cJ7cR6hSjLFQWal6Rbt4fX7qogPtWSpQ1pR3+8F/00X6ruTw==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-08-17T03:56:14Z"
|
|
mac: ENC[AES256_GCM,data:Hr2Q0EuzUbF08yE6pK34FbJ8hBWDoKuNnqzB4TZsauLKz9ZUHq0A+UKNX6oG+PNUujSTGf3BlyY4hffNWrH5mcGAA7k9yWpqUKDdALlde89X3KqVckUe7RWHLgcz7h8pDSr3kekoowXc49XtGS86ArqulEnH4QdwoPcHNvo/qwI=,iv:aC/dU2zQ1oK8SxndVJw81URPe2rgH6KJTsvh/K4K8jY=,tag:bIuEtbB+p294EqxzqX3D9Q==,type:str]
|
|
pgp: []
|
|
encrypted_regex: ^(data|stringData)$
|
|
version: 3.9.4
|