Add SOPS+age secrets pipeline

apps/sops-secrets-operator/Chart.yaml

@@ -0,0 +1,20 @@
+# An "umbrella" chart, same pattern as apps/metallb/ and apps/longhorn/:
+# declares a dependency on the upstream sops-secrets-operator chart. Argo CD
+# detects this as a Helm source because a Chart.yaml exists at this path.
+#
+# This operator watches for SopsSecret custom resources (ordinary YAML files,
+# encrypted with `sops`, safe to commit to this public repo) and decrypts
+# them into real Kubernetes Secrets inside the cluster. See docs/10-secrets.md
+# for the full explanation and the one manual bootstrap step this needs.
+apiVersion: v2
+name: sops-secrets-operator-app
+description: Installs sops-secrets-operator, which turns committed SOPS-encrypted SopsSecret resources into real Kubernetes Secrets
+version: 0.1.0
+dependencies:
+  - name: sops-secrets-operator
+    # A version range rather than an exact pin, so this doesn't silently go
+    # stale. Check https://artifacthub.io/packages/helm/sops-secrets-operator/sops-secrets-operator
+    # for the current release and pin an exact version for a fully
+    # reproducible install.
+    version: ">=0.28.0"
+    repository: https://isindir.github.io/sops-secrets-operator/