jakman85andClaude Opus 4.8
84a2d762f0
bootstrap/sops (age-keygen refusing in-repo, .sops.yaml, install-age-key.sh glue installing the sops-age Secret) + bootstrap/flux (bootstrap.sh: flux install -> apply -k clusters/dev; decryption/url patches). PM wiring: place .sops.yaml at repo root (SOPS walks to root); inline the 3 flux patches into clusters/dev (avoids kustomize ../ load-restriction). clusters/dev builds with decryption enabled; full CI gate PASS. No key material; nothing executed. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
30 lines
1.1 KiB
YAML
30 lines
1.1 KiB
YAML
---
|
|
# Enable SOPS decryption on the `platform` Flux Kustomization (ADR-0007, R-SEC-01).
|
|
#
|
|
# This REALISES the commented TODO in clusters/base/platform.yaml:
|
|
# # decryption:
|
|
# # provider: sops
|
|
# # secretRef:
|
|
# # name: sops-age
|
|
# It is a strategic-merge patch (matched by apiVersion/kind/name/namespace) that ADDS the
|
|
# decryption stanza to the existing base Kustomization WITHOUT forking it (R-ENV-02).
|
|
#
|
|
# The `sops-age` Secret is created out-of-band (../../sops/age-key-secret.md); it is referenced
|
|
# BY NAME ONLY here — no key material in git.
|
|
#
|
|
# WIRING (clusters owner / PM — outside the security engineer's subtree): add this file to
|
|
# clusters/dev/kustomization.yaml `patches:` (path-relative), e.g.
|
|
# patches:
|
|
# - path: ../../bootstrap/flux/patches/platform-sops-decryption.yaml
|
|
# so the dev overlay reconciles platform manifests with decryption enabled. See ../README.md.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: platform
|
|
namespace: flux-system
|
|
spec:
|
|
decryption:
|
|
provider: sops
|
|
secretRef:
|
|
name: sops-age
|