jakman85andClaude Opus 4.8
91aa7acab8
PIA-provider server selection is flaky here (random dead IPs); the operator's .ovpn uses sweden.privacy.network (load-balanced, reliable). Switch to custom mode (VPN_SERVICE_PROVIDER=custom, OPENVPN_CUSTOM_CONFIG=/config/pia.ovpn), mount the pia-custom-ovpn Secret, keep creds + kill-switch + tun-mtu 1300. Drops PIA-provider server list/updater and native PF (Phase-6 concern). Pending the operator-provisioned pia-custom-ovpn Secret (not merged until it exists). Co-Authored-By: Claude Opus 4.8 <[email protected]>
SOPS Secret Templates
This directory holds reference templates for the SOPS-encrypted secrets that platform components consume. They are not applied and not encrypted.
Why .yaml.example?
Every file here uses a .yaml.example extension so that:
- kustomize never loads them (they are not
.yaml/ not listed in anykustomization.yaml), and - SOPS never auto-encrypts them (the repo's
.sops.yamlcreation rules match*.sops.yaml, not*.yaml.example).
They exist purely so the operator can see the exact Kubernetes Secret shape
(name, namespace, keys) each component expects. They contain only placeholder
values (REPLACE-ME, <fill me>) — never real secrets.
Operator flow (per secret)
For each <name>.yaml.example:
-
Copy it to the target path shown in the file's top comment, renaming to
<name>.sops.yaml. Example:cp bootstrap/sops/secret-templates/grafana-admin-credentials.yaml.example \ platform/monitoring/grafana-admin-credentials.sops.yaml -
Fill in the real values (replace every
REPLACE-ME/<fill me>). -
Encrypt in place with SOPS + age:
sops -e -i platform/monitoring/grafana-admin-credentials.sops.yaml -
Wire it into the component by adding the resource line (shown in the file's top comment) under
resources:in that component'skustomization.yaml:resources: - grafana-admin-credentials.sops.yaml -
Commit the encrypted
.sops.yaml(ciphertext is safe to commit) and thekustomization.yamlchange. Flux decrypts it at reconcile via the cluster age key.
Files in this directory
| Template | Secret / namespace | Phase |
|---|---|---|
cloudflare-api-token.cert-manager.yaml.example |
cloudflare-api-token / cert-manager |
2 |
cloudflare-api-token.external-dns.yaml.example |
cloudflare-api-token / external-dns (same token) |
2 |
grafana-admin-credentials.yaml.example |
grafana-admin-credentials / monitoring |
4 |
alertmanager-smtp.yaml.example |
alertmanager-smtp / monitoring |
4 |
keycloak-admin-credentials.yaml.example |
keycloak-admin-credentials / keycloak |
6 |
oauth2-proxy-credentials.yaml.example |
oauth2-proxy-credentials / oauth2-proxy |
6 |
pia-credentials.yaml.example |
pia-credentials / TBD (Phase-3 VPN) |
3 |
Master checklist
See bootstrap/sops/CREDENTIALS.md for the full,
end-to-end credential provisioning flow and checklist.