0 Fork 0

Files

T

jakman85andClaude Opus 4.8 a108d5ab98 correction: credential-forward + unified graph; activate SOPS (author-first)

Operator directive: don't diverge architecture to avoid asking for credentials;
provision them upfront via SOPS and keep the existing (unified) graph.

Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so
cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2;
monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance.

Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's;
restore unified base graph (dev = ../base + cluster-vars + SOPS decryption,
R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential
improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes.

platform/kustomization.yaml now phased (single shared list): Phase-2 set =
kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components
commented with phase markers.

SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example
for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia);
bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines
in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real
secret values (operator encrypts).

Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert,
make -C ci gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-16 22:09:20 -05:00

2.5 KiB

Raw Blame History

SOPS Secret Templates

This directory holds reference templates for the SOPS-encrypted secrets that platform components consume. They are not applied and not encrypted.

Why `.yaml.example`?

Every file here uses a .yaml.example extension so that:

kustomize never loads them (they are not .yaml / not listed in any kustomization.yaml), and
SOPS never auto-encrypts them (the repo's .sops.yaml creation rules match *.sops.yaml, not *.yaml.example).

They exist purely so the operator can see the exact Kubernetes Secret shape (name, namespace, keys) each component expects. They contain only placeholder values (REPLACE-ME, <fill me>) — never real secrets.

Operator flow (per secret)

For each <name>.yaml.example:

Copy it to the target path shown in the file's top comment, renaming to <name>.sops.yaml. Example:

cp bootstrap/sops/secret-templates/grafana-admin-credentials.yaml.example \
   platform/monitoring/grafana-admin-credentials.sops.yaml

Fill in the real values (replace every REPLACE-ME / <fill me>).

Encrypt in place with SOPS + age:

sops -e -i platform/monitoring/grafana-admin-credentials.sops.yaml

Wire it into the component by adding the resource line (shown in the file's top comment) under resources: in that component's kustomization.yaml:
```
resources:
  - grafana-admin-credentials.sops.yaml
```
Commit the encrypted .sops.yaml (ciphertext is safe to commit) and the kustomization.yaml change. Flux decrypts it at reconcile via the cluster age key.

Files in this directory

Template	Secret / namespace	Phase
`cloudflare-api-token.cert-manager.yaml.example`	`cloudflare-api-token` / `cert-manager`	2
`cloudflare-api-token.external-dns.yaml.example`	`cloudflare-api-token` / `external-dns` (same token)	2
`grafana-admin-credentials.yaml.example`	`grafana-admin-credentials` / `monitoring`	4
`alertmanager-smtp.yaml.example`	`alertmanager-smtp` / `monitoring`	4
`keycloak-admin-credentials.yaml.example`	`keycloak-admin-credentials` / `keycloak`	6
`oauth2-proxy-credentials.yaml.example`	`oauth2-proxy-credentials` / `oauth2-proxy`	6
`pia-credentials.yaml.example`	`pia-credentials` / TBD (Phase-3 VPN)	3

Master checklist

See bootstrap/sops/CREDENTIALS.md for the full, end-to-end credential provisioning flow and checklist.

2.5 KiB Raw Blame History