Add SOPS+age secrets pipeline

apps/sops-secrets-operator.yaml

@@ -0,0 +1,34 @@
+# sops-secrets-operator, installed like MetalLB and Longhorn: an Application
+# pointing at apps/sops-secrets-operator, a Helm chart that pulls in the
+# upstream operator chart. Once this syncs, any SopsSecret custom resource
+# committed anywhere in this repo gets decrypted into a real Kubernetes
+# Secret automatically. See docs/10-secrets.md for the full explanation,
+# including the one manual step this needs before it can decrypt anything.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-secrets-operator
+  namespace: argocd
+  # Safe to cascade: this operator holds no persistent data of its own.
+  # Deleting it stops decrypting SopsSecrets; the encrypted source files and
+  # the age key stay intact.
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/sops-secrets-operator
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sops
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true