jakman85andClaude Opus 4.8
84a2d762f0
bootstrap/sops (age-keygen refusing in-repo, .sops.yaml, install-age-key.sh glue installing the sops-age Secret) + bootstrap/flux (bootstrap.sh: flux install -> apply -k clusters/dev; decryption/url patches). PM wiring: place .sops.yaml at repo root (SOPS walks to root); inline the 3 flux patches into clusters/dev (avoids kustomize ../ load-restriction). clusters/dev builds with decryption enabled; full CI gate PASS. No key material; nothing executed. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
22 lines
760 B
YAML
22 lines
760 B
YAML
---
|
|
# Enable SOPS decryption on the `apps` Flux Kustomization (ADR-0007, R-SEC-01).
|
|
#
|
|
# REALISES the commented TODO in clusters/base/apps.yaml (same pattern as the platform patch).
|
|
# Strategic-merge patch — adds the decryption stanza to the base `apps` Kustomization without
|
|
# forking it (R-ENV-02). `sops-age` Secret referenced BY NAME ONLY (created out-of-band).
|
|
#
|
|
# WIRING (clusters owner / PM): add to clusters/dev/kustomization.yaml `patches:` alongside the
|
|
# platform patch, e.g.
|
|
# patches:
|
|
# - path: ../../bootstrap/flux/patches/apps-sops-decryption.yaml
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: apps
|
|
namespace: flux-system
|
|
spec:
|
|
decryption:
|
|
provider: sops
|
|
secretRef:
|
|
name: sops-age
|