Add SOPS+age secrets pipeline

apps/sops-secrets-operator.yaml

@@ -0,0 +1,34 @@
+# sops-secrets-operator, installed like MetalLB and Longhorn: an Application
+# pointing at apps/sops-secrets-operator, a Helm chart that pulls in the
+# upstream operator chart. Once this syncs, any SopsSecret custom resource
+# committed anywhere in this repo gets decrypted into a real Kubernetes
+# Secret automatically. See docs/10-secrets.md for the full explanation,
+# including the one manual step this needs before it can decrypt anything.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-secrets-operator
+  namespace: argocd
+  # Safe to cascade: this operator holds no persistent data of its own.
+  # Deleting it stops decrypting SopsSecrets; the encrypted source files and
+  # the age key stay intact.
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/sops-secrets-operator
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sops
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/sops-secrets-operator/Chart.yaml

@@ -0,0 +1,20 @@
+# An "umbrella" chart, same pattern as apps/metallb/ and apps/longhorn/:
+# declares a dependency on the upstream sops-secrets-operator chart. Argo CD
+# detects this as a Helm source because a Chart.yaml exists at this path.
+#
+# This operator watches for SopsSecret custom resources (ordinary YAML files,
+# encrypted with `sops`, safe to commit to this public repo) and decrypts
+# them into real Kubernetes Secrets inside the cluster. See docs/10-secrets.md
+# for the full explanation and the one manual bootstrap step this needs.
+apiVersion: v2
+name: sops-secrets-operator-app
+description: Installs sops-secrets-operator, which turns committed SOPS-encrypted SopsSecret resources into real Kubernetes Secrets
+version: 0.1.0
+dependencies:
+  - name: sops-secrets-operator
+    # A version range rather than an exact pin, so this doesn't silently go
+    # stale. Check https://artifacthub.io/packages/helm/sops-secrets-operator/sops-secrets-operator
+    # for the current release and pin an exact version for a fully
+    # reproducible install.
+    version: ">=0.28.0"
+    repository: https://isindir.github.io/sops-secrets-operator/

apps/sops-secrets-operator/values.yaml

@@ -0,0 +1,15 @@
+# Values for the upstream sops-secrets-operator chart, nested under
+# `sops-secrets-operator:` (the dependency's name in Chart.yaml).
+#
+# The operator needs the age *private* key to decrypt SopsSecret resources.
+# That key must never be committed — it's mounted from a Secret you create
+# by hand, once, directly on the cluster (see docs/10-secrets.md), the same
+# kind of one-time manual bootstrap step as Argo CD's own install.
+sops-secrets-operator:
+  secretsAsFiles:
+    - name: sops-age-key-file
+      mountPath: /etc/sops-age-key-file
+      secretName: sops-age-key-file
+  extraEnv:
+    - name: SOPS_AGE_KEY_FILE
+      value: /etc/sops-age-key-file/key