jakman85andClaude Opus 4.8
37f4fa6767
Install image-reflector-controller + image-automation-controller as part of the flux-system install (bootstrap.sh --components-extra) so the image.toolkit CRDs pre-exist before reconcile — no F-MON1 split needed for the ImageUpdateAutomation CR. Refine the cluster-wide ImageUpdateAutomation for machine-authored git write-back (setter strategy, path ./apps) reusing the flux-system GitRepository secretRef, and document the operator git-write-credential hand-off + SOPS secret template (gitea-image-automation-credentials). image-automation stays deferred in platform/kustomization.yaml until that credential is provisioned. Co-Authored-By: Claude Opus 4.8 <[email protected]>
SOPS Secret Templates
This directory holds reference templates for the SOPS-encrypted secrets that platform components consume. They are not applied and not encrypted.
Why .yaml.example?
Every file here uses a .yaml.example extension so that:
- kustomize never loads them (they are not
.yaml/ not listed in anykustomization.yaml), and - SOPS never auto-encrypts them (the repo's
.sops.yamlcreation rules match*.sops.yaml, not*.yaml.example).
They exist purely so the operator can see the exact Kubernetes Secret shape
(name, namespace, keys) each component expects. They contain only placeholder
values (REPLACE-ME, <fill me>) — never real secrets.
Operator flow (per secret)
For each <name>.yaml.example:
-
Copy it to the target path shown in the file's top comment, renaming to
<name>.sops.yaml. Example:cp bootstrap/sops/secret-templates/grafana-admin-credentials.yaml.example \ platform/monitoring/grafana-admin-credentials.sops.yaml -
Fill in the real values (replace every
REPLACE-ME/<fill me>). -
Encrypt in place with SOPS + age:
sops -e -i platform/monitoring/grafana-admin-credentials.sops.yaml -
Wire it into the component by adding the resource line (shown in the file's top comment) under
resources:in that component'skustomization.yaml:resources: - grafana-admin-credentials.sops.yaml -
Commit the encrypted
.sops.yaml(ciphertext is safe to commit) and thekustomization.yamlchange. Flux decrypts it at reconcile via the cluster age key.
Files in this directory
| Template | Secret / namespace | Phase |
|---|---|---|
cloudflare-api-token.cert-manager.yaml.example |
cloudflare-api-token / cert-manager |
2 |
cloudflare-api-token.external-dns.yaml.example |
cloudflare-api-token / external-dns (same token) |
2 |
grafana-admin-credentials.yaml.example |
grafana-admin-credentials / monitoring |
4 |
alertmanager-smtp.yaml.example |
alertmanager-smtp / monitoring |
4 |
keycloak-admin-credentials.yaml.example |
keycloak-admin-credentials / keycloak |
6 |
oauth2-proxy-credentials.yaml.example |
oauth2-proxy-credentials / oauth2-proxy |
6 |
pia-credentials.yaml.example |
pia-credentials / TBD (Phase-3 VPN) |
3 |
Master checklist
See bootstrap/sops/CREDENTIALS.md for the full,
end-to-end credential provisioning flow and checklist.