From 8f97feb3e995cc6d6ce5c0ee5919a86b7a1ad44a Mon Sep 17 00:00:00 2001
From: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Date: Fri, 21 Aug 2026 20:35:32 +0200
Subject: [PATCH] infra/kube: added kube cluster infrastructure

---
 .sops.yaml                                    |  2 +-
 infra/kube/.gitignore                         |  3 +
 infra/kube/manifests/cilium/values.yaml       | 67 +++++++++++++++++++
 .../manifests/flux-system/flux-instance.yaml  | 48 +++++++++++++
 infra/kube/reconcile.sh                       | 55 +++++++++++++++
 infra/kube/talconfig.yaml                     | 46 +++++++++++++
 infra/kube/talsecret.sops.yaml                | 49 ++++++++++++++
 7 files changed, 269 insertions(+), 1 deletion(-)
 create mode 100644 infra/kube/.gitignore
 create mode 100644 infra/kube/manifests/cilium/values.yaml
 create mode 100644 infra/kube/manifests/flux-system/flux-instance.yaml
 create mode 100755 infra/kube/reconcile.sh
 create mode 100644 infra/kube/talconfig.yaml
 create mode 100644 infra/kube/talsecret.sops.yaml

diff --git a/.sops.yaml b/.sops.yaml
index d3946d2..f98fa00 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -3,7 +3,7 @@ creation_rules:
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.yaml
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.env$
     input_type: dotenv
diff --git a/infra/kube/.gitignore b/infra/kube/.gitignore
new file mode 100644
index 0000000..e1f13d2
--- /dev/null
+++ b/infra/kube/.gitignore
@@ -0,0 +1,3 @@
+clusterconfig/
+manifests/cilium.yaml
+talconfig.json
diff --git a/infra/kube/manifests/cilium/values.yaml b/infra/kube/manifests/cilium/values.yaml
new file mode 100644
index 0000000..1aa4245
--- /dev/null
+++ b/infra/kube/manifests/cilium/values.yaml
@@ -0,0 +1,67 @@
+ipam:
+    mode: kubernetes
+kubeProxyReplacement: true
+securityContext:
+    capabilities:
+        ciliumAgent:
+            - CHOWN
+            - KILL
+            - NET_ADMIN
+            - NET_RAW
+            - IPC_LOCK
+            - SYS_ADMIN
+            - SYS_RESOURCE
+            - DAC_OVERRIDE
+            - FOWNER
+            - SETGID
+            - SETUID
+        cleanCiliumState:
+            - NET_ADMIN
+            - SYS_ADMIN
+            - SYS_RESOURCE
+cgroup:
+    autoMount:
+        enabled: false
+    hostRoot: /sys/fs/cgroup
+k8sServiceHost: localhost
+k8sServicePort: 7445
+etcd:
+    clusterDomain: cluster.local
+l2announcements:
+    enabled: true
+externalIPs:
+    enabled: true
+ingressController:
+    enabled: false
+    loadbalancerMode: shared
+    default: false
+    service:
+        externalTrafficPolicy: Cluster
+envoy:
+    xffNumTrustedHopsL7PolicyIngress: 1
+sops:
+    lastmodified: "2026-08-21T18:35:32Z"
+    mac: ENC[AES256_GCM,data:Ad0t52gfwmsLe1VWx9dsV9zI1k2XFHRpy369T6xqoimcqM19jMcInS/0Rgpg9QTFqOhMMJnf/Qf9H1+bvOvoyk32ykbkRJh7V2QHF/vaBfD/GyvEeJb17swoPehf6JyaLhzpIU8I94el3EEFhwi42xhnW8c/ghtKMqcc5VNwJP0=,iv:ouYUEQhKHMlCVsMEaDyhAndS3y0WRkv+LPX9JGnjtfs=,tag:wXEAZhc6yn47LO/U0PauoA==,type:str]
+    pgp:
+        - created_at: "2026-08-21T18:35:32Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//c5xdgliA1tjpUtZlZ0ByB+acwEbEA7Ee2K2ySg3GcQHG
+            2oE2QO2TvRkUzyLE+td7NgRWBqEV/6u/Ozfee2tLiijjCgUg4QtgEPFqQVS9QKZW
+            QXRRsBhG5vxdJqKXn22g2bofNuJZuDSUiGL2MMy85Tm1HAc9Rb65+UcRqtlqrkVU
+            e2GaxcYM+YexWnpBqA+685PSidbYVehH5WSgfTXqbilYmxmZH0wBPdLzSm63dDd2
+            SdtFy3JfsNDg3jYMge57FHd+FANltbdW5tHQaa+6FX9akyQ+3mY/xXt2Ut/KiiuP
+            WFb3SvNxluRXjvyKQXmkUPZDjL8YbY+jdcH9WEuWXFClwa2g3OVOSPotSvJ5eW3A
+            z5kk3tIq+LqIYpCPd/0AjpkAzeijAFATTxVUUsvPJHe6WDrCC0koP/7Vqqk3vvJh
+            5BM4/1pT5v9HfbgirR5ja3EBxgLEGFHRW4IAL5dJnL+JtM/NQwYJuWmzEn9Bdlu8
+            25aqVfVRkeOrjh/dS+2jwJvjPhzWd0KHv58PkCJVT6tJcitgak3eK8yV74HXRrbj
+            dBYr0hxs1oDQt5U6bqVVfzCXg0c/ZP1Or/kcjQQUHNsOyornbxJ6RTqeVTdLENWY
+            RZ6d2WNFVagbH8Kr2ah/L+MzHPQvhNSrLBpj8FjJH3wifZ4AePubSidv+ipJkH3S
+            XgFe9BbrSzN6b684/bBswl6sOK/AiW9pFPrGTuT+0qFvPcKNHLq+faltMS9rz3DW
+            FF+s0h07i4pkf9iED1nfXane+DpuKpDaE6S8UIn7SwrXJ5A67woc28QcaFbxYkw=
+            =lil9
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    version: 3.10.2
diff --git a/infra/kube/manifests/flux-system/flux-instance.yaml b/infra/kube/manifests/flux-system/flux-instance.yaml
new file mode 100644
index 0000000..df875fd
--- /dev/null
+++ b/infra/kube/manifests/flux-system/flux-instance.yaml
@@ -0,0 +1,48 @@
+apiVersion: fluxcd.controlplane.io/v1
+kind: FluxInstance
+metadata:
+  name: flux
+  namespace: flux-system
+spec:
+  distribution:
+    version: "2.x"
+    registry: ghcr.io/fluxcd
+  sync:
+    name: homeprod
+    kind: GitRepository
+    url: https://github.com/vhaudiquet/homeprod
+    path: kubernetes/
+    ref: refs/heads/main
+  components:
+    - source-controller
+    - kustomize-controller
+    - helm-controller
+    - notification-controller
+    - image-reflector-controller
+    - image-automation-controller
+  cluster:
+    type: kubernetes
+    multitenant: false
+    networkPolicy: true
+    domain: "cluster.local"
+  kustomize:
+    patches:
+      - target:
+          kind: Deployment
+          name: "(kustomize-controller|helm-controller)"
+        patch: |
+          - op: add
+            path: /spec/template/spec/containers/0/args/-
+            value: --concurrent=10
+          - op: add
+            path: /spec/template/spec/containers/0/args/-
+            value: --requeue-dependency=10s
+      - patch: |
+          - op: add
+            path: /spec/decryption
+            value:
+              provider: sops
+              secretRef:
+                name: flux-sops
+        target:
+          kind: Kustomization
\ No newline at end of file
diff --git a/infra/kube/reconcile.sh b/infra/kube/reconcile.sh
new file mode 100755
index 0000000..3c7398d
--- /dev/null
+++ b/infra/kube/reconcile.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+# Reconcile Talos cluster infrastructure
+# Environment needed:
+# - SOPS_KEY: sops private key
+set -euo pipefail
+
+if [ -z "${SOPS_KEY:-}" ]; then
+  echo "Error: SOPS_KEY environment variable is not set" >&2
+  exit 1
+fi
+
+# Render the Cilium chart for manifest deployment
+helm repo add cilium https://helm.cilium.io/
+helm repo update
+helm template cilium cilium/cilium \
+  --version 1.20.1 \
+  --namespace kube-system \
+  -f manifests/cilium/values.yaml \
+  > manifests/cilium.yaml
+
+# Escape shell variables that must be resolved at container runtime, not by talhelper.
+# talhelper expands ${VAR} statically; prefixing with $$ (i.e. $${VAR}) tells it to
+# preserve the literal ${VAR} in the output so bash can expand it inside the container.
+sed -i 's/\${BIN_PATH}/$${BIN_PATH}/g' manifests/cilium.yaml
+
+# Generate Talos machine config
+talhelper genconfig
+
+# Apply generated machine config to the nodes, without reboot.
+# If it fails, it is safer for reconcile to be done manually:
+# the reboot is needed and that might disrupt the node
+talhelper gencommand apply --extra-flags="-m no-reboot" | bash
+
+# Obtain kubeconfig and export it for kubectl
+talosctl --talosconfig ./clusterconfig/talosconfig kubeconfig -f ./clusterconfig/kubeconfig
+export KUBECONFIG=./clusterconfig/kubeconfig
+
+# Show nodes
+kubectl get nodes
+
+# Create Flux namespace if it does not already exists
+kubectl get ns "flux-system" || kubectl create ns "flux-system"
+
+# Create SOPS secret in the cluster
+kubectl create secret generic flux-sops \
+  --namespace "flux-system" \
+  --from-literal=sops.asc="$SOPS_KEY" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Install the Flux operator if not installed already
+kubectl get deployment -n flux-system flux-operator || helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
+  --namespace "flux-system" \
+  --wait
+
+kubectl apply -f manifests/flux-system/flux-instance.yaml
diff --git a/infra/kube/talconfig.yaml b/infra/kube/talconfig.yaml
new file mode 100644
index 0000000..40dc2df
--- /dev/null
+++ b/infra/kube/talconfig.yaml
@@ -0,0 +1,46 @@
+---
+clusterName: kube
+talosVersion: v1.13.8
+kubernetesVersion: v1.36.0
+endpoint: https://10.2.2.138:6443
+domain: cluster.local
+allowSchedulingOnMasters: true
+clusterPodNets:
+  - 10.244.0.0/16
+clusterSvcNets:
+  - 10.96.0.0/12
+cniConfig:
+  name: none
+nodes:
+  - hostname: p330
+    ipAddress: 10.2.2.138
+    filenameTmpl: "{{.ClusterName}}-{{.Hostname}}.yaml"
+    extensionServices: []
+    controlPlane: true
+    machineSpec:
+      mode: metal
+      arch: amd64
+      secureboot: false
+      useUKI: false
+      bootMethod: iso
+    installDisk: /dev/nvme0n1
+    schematic:
+      customization:
+        systemExtensions:
+          officialExtensions:
+            - siderolabs/intel-ucode
+            - siderolabs/iscsi-tools
+    kernelModules:
+      - name: iscsi_tcp
+      - name: libiscsi
+      - name: scsi_transport_iscsi
+      - name: ext4
+      - name: ixgbe
+        parameters:
+          - allow_unsupported_sfp=1
+    networkInterfaces:
+      - interface: eno1
+        dhcp: true
+inlineManifests:
+  - name: cilium
+    contents: "@./manifests/cilium.yaml"
diff --git a/infra/kube/talsecret.sops.yaml b/infra/kube/talsecret.sops.yaml
new file mode 100644
index 0000000..8b4d9ca
--- /dev/null
+++ b/infra/kube/talsecret.sops.yaml
@@ -0,0 +1,49 @@
+cluster:
+    id: QZrdcHhAE5mxOUYoS9nJ-XHHb7fBHd17boapsttJMwg=
+    secret: 8IFn4rACB48hi2SBn865IuvRecSUIwLKJH2xvSDeuVs=
+secrets:
+    bootstraptoken: y1d6p9.nmumn3ajw0p606pv
+    secretboxencryptionsecret: s+2ytZDmMyHVOjkkmRt/7zulC7nbkh7h2N4PAzc9iCs=
+trustdinfo:
+    token: 5lcmzb.ew08sz9caoxyivq5
+certs:
+    etcd:
+        crt: ENC[AES256_GCM,data:04C1XZdng46drtSuB7GXbPHUtJvitXQpVnHp3VNCYbM5hlYV27ygs7P97KBsI/KHK3+ucLj9m89ZF1pcxUfESZxqhUusHxHoyMwXx8O5fvHCWt2HKVafFXf/HHAVXCd1+pPRCa+I+ItJyg37aSGvzaVa+QRgH0h8mSci0pKO2f+oBZzyaoyeCooL2KzOqvIImfZMAdzH9iU0fXU/vFHToTzK1S6rNjdDbNiYA7Gqjj2hLOXRVd7edT1Sfq+M4lFY6TRyj1tZyk9V/aZAIouaV5/ifAEi0Xj4iadq/mSJrn4dX03xvzcFvjayVBra68vi09wvWWT7AGimvc7auUSkEfxxGEhXJ/NoMpd67FZiX5Zo/NUd8cym5qTJtCNKNw1vU83oDdTF48pi7Oo45MtvUPahWsR97w+wFPOOoXK91JZCF/3Cjd99HiPRHuNhoXO9KmUPqwMSnKhtooyW0v5LnL3pQ7W9O4Acq/52eqtejkKDqI26hsKCri2EnqdxXOjxDfr/ED7UfgLa31yLo16KqLuvMCgse+serSmqn4YuknrFE2VvPB7rOpjhzJufZd9R1lHi00sSqCQ03XwtducQaptJYJ+pKRlwmYGTYvK9aRGEezwYZo3BM02/txYOYTuBUG7B49AAIi0iPFVvl8gY3a/XYsCBjb2st3qZZ/vPUxwHZba0eLqg8S1VkYimfGSkx6qw6JKhVyzQGlerS1Q/wCzrdMTlaIRWb8gfwiLZMOmOsTM3IeuG+R7E1WlSLrASL14PvE5aF5m1zRJhwz+TUA5O9qVoXGLMkcJ5NF8gwxRosli/Ck9tTGSCCsrdjNkyXK76GExeQu8DvjPvHE8NYDmlWg9NbTHcuz76igPbbJc//NG0A2Gv/29wVCcQSUgTWisevdJ40w+kLxqhsjO8LPFT1nOzHdq+iZqDgrFBwiU6qMeDjerzbpWE3GgWKgNVQNPxmD4hpMPWH2DPXwzekSnf6F0iGutPtMvVtSWBb2D4Rt+ZrkzbFguCmUiICyoytMyRUw==,iv:d4AYii/zly4sSkor/UpjStWX6bG6ty1qamcwfzU5nA8=,tag:TAnrbRvhsMAQlW72Bj7gJQ==,type:str]
+        key: ENC[AES256_GCM,data:PG1++uGvdfalbuojD6tuDjwjVTqBxaBa6CBUJvP7nRZAPW+txeMbS/OPdwEoQk1+3aR5TyGbyCxlYWHOAFp3iOmCgQ0CfemXg7MRWmfvX5iD71Jr4QnF4qhU1dstdUW8awc5m8H0yWwj18zYoEwTJ7B/vcvqbgmB5CFd/nENG21A3JRv6kpYIR/ER991TGaF9CgrDxx188Y83dLp5fQjfXoOdGvk4+p/5CE9fP/QuMhIFqjxiKPrXH6JlVMCghMz1/7tCazWIQ5a75BXCQdbjIZWH7HSROzQb5nYcO0BHvKzjpL4/igIk4CVh5gH4GlUo2smckNHwi1Fg820DrgUyKii12NkZsHh0jFpL3JyZMG1b31kTVQS/A5zrSQp0kN2wvmZWewJOPrcQdQufr/zIg==,iv:h1lVQ16OyOZ8KGBo/bA2DaZQ259+Fe9qeeBZFixe6PY=,tag:yBLMSV/J1Y93qfr7u1S1kA==,type:str]
+    k8s:
+        crt: ENC[AES256_GCM,data:OsLTa71SiHO9DbYz2courPFE8Xaz2mIXIcQZ5OiNKWEsndgiwnCyFnsD18mUgTqno/I9YjOZ4GyjBcI7VhEM5XZmoHeNV6Tmqr+NpMgHx1p+w8k/4pxooNlc88+ke/CumcI/BwJM215aoFVauqN53BI/22hYHi85LfgxOBwWQP4vLRRMbfhY3Y/M8Wh/WIvft99URa7+k3cyIY4BR+kjJK8T7ht2+95QWj5BVrt4SDZGltT0Pba7RNuTfPyOMl/8qYB9iYwl6EZWJD6jXGLUMaknqybfx89cwaRbjBEPwRTkb89HLEAXmwnFWqiiGVnwNKDgiITqPlqpSQAsDLYZ1Bq1gaMklCMKU4NlR28xWuGJBhx/2+aSEIJYhPjEWOxkVZ7XI7thDPwIxscgv60jdP3qwPYMPIJvuUaNQhAuQ4gUtXJcuIOxT6qf4HyxlQ8pBEkllMWEPCmCB8niAE8Dfjtw+i1GZlY0pdibPTfb5ldQ0gN3CC6Vn6siH72nsf9lG39mnpXK0M2ji5cXBVIDkxcniHWQPADKL+PTEzRgKE76hc6csNGmj0azb0JKXYhWmypBxP58MKkdGng/YhPTW1ybV5wZ9R7ecbAZ54BpqMYN9dvVlggeDBHMyOPmOKyRfIm2Y2ZCXfXefaV2hXeqTD8d7Wtewm18Goktov9HcsaFp/MZIO6JCM9lyzkffbnUHwxzZJ6oUcq8YIzX1z3Z87+ZO5HDwkyGn/JGsVs/+FVe5e7ss9vrOjoiu4aeJEDUpl1SLmruERxREbQzAoDkIxzInFG41iCDtL1tarCw/DwNbeeGv6OrP9XdLograjwY7z9e4VE4Mh4p/tUb/JYxB+Wbm9s5Z69dGorXViupvXTzg/ll+sVu5yOYn7PDOXUPMOk9xdA5EXXVGkiELQPgiwF8lXHvP3dey3xe3sig/yAAl0EHy37aQbXvj4TxmSRBBh0cWq2k8Sbi3spClxUX+hNRp0ar4i74rTUhOVj5CeHsD+eLlB35vp5UpQYZ7ImWUXZyHA9Qhr4YsxPJ0OWEghuIGGQ=,iv:UHTuWt6axFc7tC9WHC8WqgqoutMUhy7jpl2foPR27rs=,tag:W9t6XgEW91/84cDtdzKJRg==,type:str]
+        key: ENC[AES256_GCM,data:smGam8PGovfaGlca97pnJVxQ+tVMhEsGhaA1ckflxtI8nml+S2Dg6O/ie5bHSHDEX2lFy0sGKYy3rZo6bret3wk5L1zDKp2GziJp3VwyqTiyE8nKWUFIVywhr/36bor+LStzFtZUzWWEYpjE1uGn5uIOzVNmfjDqv/Wuh3AMT4WhEiIyO/JlzeZmZHmApBd5SdK6PpPNIlQfN3rdTc2UzU98zuDWxWLNEfDfcINiS5gKWWB/cfk5AzqgZih8L/0XmnDf5InQ8AtMF41a9yKqipiKHIE21XDbeOv7e6pKGz8Y9+1RugmBXLOCDDweTec62AAJs9gnjTtLbKb6J2wYuWOkQ2WE/8tSJ06R5MvIYEGNsYgJQjOdKcIPD6b+kJN6B3QCOY9DCTeNKH+T22iMug==,iv:8g25E0Ke3+05/kZwW9ZBddbvhqIKFFlg3u+AldmwOzo=,tag:dzGPe/A2Gm97xLl05lAL4Q==,type:str]
+    k8saggregator:
+        crt: ENC[AES256_GCM,data:lQkvzAh0pbL0ICa3VdqZ1Ct9LdcD5B0epn/s6yg0XYldjnWQ8wuhI+Fc5s2ozFOJgncw0NfjQ/PRKIK0eNXrXu4HZE1pIgeg8kU2baOf0PknACiFB+WV/oCRk5xHGGt0XKtJNR12ypGsxifeGm3J1R3Kh7J8R1k8VpWdt5nmt8sA+TSSHYE6sMNq9u4uMv0Qqu4kK6La+KDq12vD911QI7ykzZAIR4KyHpPF0cucaAIx/ErGi9BWQGsieULUR1jZxGYwdd2YWxadexwMjptI9SikC/wcEY75FnW4L1i09jSoAKlu0A/hufTZTnKy5bITwRKEaEKCIdUgEV6b8EUJRFsoG7pRtWBvj4la4ghmjw6YaqGMZ1DhuTVgyCjavh+fwA0aB1LGvHq8vUcg3JKTQ+BbLhwoKXw2dpkza/kMFilZhOh3vwjFCre1WD+EtMJqcau7UXLFplhRl/T7/JUBTF9my5/cVbNqe0ltSJb9/Y3k7OAr8N71IxEToXgLSt3LRgt+6s+SnBMI8vO5Ni0nDLb40k+SPk5phq+0kMxxdtbPoDqR/n4r+GF/hFDLQ43d/bn/DAMmqHhmcQg33Ip5saZ+wFbTsaFEWGGMdBaz4FUdS+O6yc6e1UE6H8epgVw8zZ0m5RNxt0TO7mM28khqnU2Bq9kJvvjcupCELtcud3ngXBKfx1jGMnNze76sUUK8kGCmzDskjaEiSWrj2LKSIs7eb6EJU1MeVy28rtaLlOlfNpynl8AFqagMGtPGJE6ODsO/7tKcFBXCxX/NqEtc7n3ANFnf4FWNjsP6eWf1dN83kl70qaw/dPUA6a40ob9vCt+M4Vhr1VIfaKu2XwxmPSummm0t5yBqEDqV2YdErgYYoaNSqEqOonldzUpqhyLRj/Zh2hpB17Q/WR82yTboailHMD1l4sN7FXwDArEuwibgqGXNNxA4kfi7kiaXO46Q,iv:gXdAkqyIfYhSdXPOlsWKZCgqOwJph+hddMCRXvx66W0=,tag:D4ieBqmzcSK5pHT34frGIg==,type:str]
+        key: ENC[AES256_GCM,data:j2K5ZAWR8ypK+jjV/3ab2Pxdus0u+wx0WUJyRql73YKscm1Ipa98I82RSgdhd+TXK4hgmlDhS+3GXm+Vxc2apHxrHPUw5O5A3hH66eat+PABqU/0BlUX7dp9+dOe4NjbHeThEI56y1vo+86H+59Dq04YbsFauLM0ZILveRZE1T7HRITacvP0qeLnKZCrz/3zPIdypmxudGXG+3bSzZSXpOJnYdvq9aJnvgO3ozgnJv9inlq4jgZbGCYPW8nacZxYMaSPd0RPhJleUdA68uI9xZmxk1WL8QuPplVI73mciBaqzlhTHK9mB7uqsy/JJKCWQAwb7qVYKsJFAGU8Mw/wsQtwO5avapKIAIXRB6swYpo5z7Y7k/wuaDWmKbGA8jlzOFLTxjmP8v7UwK8TJV0DxA==,iv:EqLNFitolyKo1JoxJogxSjl1Z3PoQIb1pmTE+kX2+K8=,tag:zogctj9rNLo2eT+VPbPHtQ==,type:str]
+    k8sserviceaccount:
+        key: ENC[AES256_GCM,data:BNooaQXUI4JjR+XZI3vkK+KNBY2AB6fKUxT3qijDLCgBDa32k8O8zvPxFiu169yJT0Ja8Ih0YX/hLkCNWlc87jeNRCmrlPQNjJ06RuJvii7tY63zHtKnYn3n/qSKe3iO7sqmVzGoGlIr7MABk2IDTnwV6DLusGiYyRr6M9DHGaQ47w/ZEPmS8gvE7EVMWuU2mN7H/RgMYHxcb/QvhrmC4K0GTxmt6cfx4OCibpDjKvuRCT86uwvM1ezVzunXOlBEI4TJHvHVMwn6tXDXoKOCnjUAsytuucz+G357rqQXQUJcN+UbToCEgVi+Du6nxrSuZ+/76XnLmYFGFZpV4V20Mm44O718VfdrdXWPKqv9+0R7gmZ4W6/I2wPP4KH1yc0SsCCEnQDNnmaO3dTI+g0MKpeiQCYFLEm60rNBg1oy7I7Q/ob1wG3CXwGy2pkOpRowblq0dMVaxtdbI6I/3qpwvGnewKitTDowN4YWNDaklJR1f3g7bIyOvQ6nmTX8ntV11aO45qNEmkktHYOL7i/fHVInjfUkVKeZVH7f760hoin3/uxvOKPMgNViAhGgb9ZTMc71DlOIxw6YzsAcc0U4iglp9L40kFJ0lex9s37n80zZhsvgvzb5Lc4ek3W9cxp3kTSrcwjWIA56sXOd4SX0RMRABf6HWhmhQ+GO0p2J3v60zTzA79eiHBZ943HXOBVYtkbuyJtPoDm2gaUo9zRd+l0GQNY/otUUgJH+GB8p6P+P7PcbyU93O6Pv1dcdcgP/qs5m65PbkkTcGtxZYIw1G0L3s0Wx0+NoRAlzdqMUoUOAF6p1g5r++TMOdi2Jst2l9XeHaEZFL8owlW4p3dILsSsmLRoZqCn+IO3w14wGuTHu+cshXTq3oAcllem3R9G0hSSwG1UzZCSkWYH+edx/BrFfu0wSf6Fuwq1GCvNX7nHPvqGSxuv9K3YrBn/pOubAEJPkOyLn8SaCqCGFmaVika6t/+yJMM7pznjh+QdXozVML+Sub01CXWBafHi0bEbQKVQr3L31v8h+NB5Lbysp0dKsd4+/JGcIot/T+eRMGErFVZR7wB7FdpRGSvwrvD2/VSQerAD0P0IkuimIO4PaRteEyvnWC5N3BkiOoW1X9ll4GlNNKMkcoPSWUlYiI3IAZWVN9oq1/0RL7EOLhvBG95gFGFQWemyufnyonAWuulcFdL/3H6Fg6XLQWdtKCreEx960EgYZeXtvUqne/qo80Y5iEcK8NUHKNliKlamS0GAr7FQKZkxumQuF0Fswfzu97gd3wSCy1rI333WUSJ70dr4Q8DX8AazguQWJVHHEdvAa8FUFueOHFUAoMu1WoQxvPMHWpuV1EESaLnx+TDgpPqe4NKRxNIW/mFzh4cAleN4eaV9LUx0hAt3ITlneuMJ0UrMYWEapXh9Sc0DHQiJ+5nGJwKMNCU9yt3lRDzID5nLiY8a9Ea/FXYF1bdqo8hsBxkDqGE9XWNYzV2IuLxf5JuqQ7fwj+IywCkAXZGkyO2z9+nzLxoliUf/oXeV3cQRYImCf7/zG3DSjGOhaks2ch42vull2zGMX7vLMDsCry46uYUA5FKg93cuWIbqxCMsSLLqRdsneU9PL5mDRWlDZf8G0Br47xBK0kjyMbAVnSDO/cLINEDFASNbDz7YkiL0O8L3qXi1mc1YQKkzPcqHuHTGWYtchiijDZ1ZOTFtkNHqKr3M0yabFmaFbVrvvknOdkb76OYzccWLSEKgFoMi7Xqgj20O/P00CeqoW2XyqPfPIzZp8FLPh1nQoLJFi8LADB7FKcQONEJ2rPWe6Ul5TEbdO9AMjQdRAEKnKYMz9xPHU6VRGFwvhFzhhCUWsvoYsvqwyfcFGB5b9Z0gJmj5SzokYAdv5rnxbomyVt7SfQB+jGTx6NYR9siMCEk868zSxcEsP+Z8ANosT4gRIiX+nh9Hxkr8/hjMelCawQFgpqTEKYM7Tq3GGokQG9CMrcs4I0PxjfVf+Edd5vXI0RGunzICMP/pTreYpSkNnpGiyQG8T7MmHRdz8ASLQsnUE7T96waiZJiAVGRMAG1JitNG7KlFPh6Memfy/UJLHJjKtQU/3euOwjAfU/mQVHRvbmgBKWZi0G0VXrLKhaoILtdvsBXVeYtLNuw15792SSEsCb1yUpHTMHp8Hd5B5HRxOEFkFRCQz/sMic62hWU2xHonx3A69XcXKi5dJjCP03QWmybl6rIdmG357d88TmYys9PBaAofi26pTMGmhtoMxeEJr8zqnE/bxF1j1rW1+15mDCwV4reP0Ng/AHSCVJ/fCg6XCrvFp1yKQ0GBoWI/z0BZAZdYX9ZGHUBHvpSYZcL6KHmhp/57v5b7Mb5hdHSfMb6U89KUvws4RZMtxUTqVBxjC3bpkBe+8M7RZ16vK2cpnj3Ufm9xByM14Itx5j81sQo6wFGCAc/p6/7lzTH1mW/O8tWq436jr18vixUKQSdkQdkZSbnFqbhHL6ffrf6ChcQxfJA16V7jvQUnlSkDai9k+X0gSfBEwOYGm77HA+ZeA5liNAIOXcAj4iT7fPD4/QW/AE+lMKw7ygTkciVwhHbW0gljePytolbRAJ6Ax037+kk+4yDc2ndftfoMeYWvPna9fYc+9S7ydkizRINGwVY6XoXTzG6v/H/CjHYahpitO00CNIhUlPo2PpOUI0PBgRksfYXdzMkCGkP+P0v1eF6bE7GcAlw/uvEWefrIB1UfHF7AaFJvBh/QR2w/jUBS837cL51E/rukigR9C/SSOhOBQJ80mGrrtGnDr8X0JumM1f8MYaK6WYW8TiVusn7gmxOHe6HyKpgnMZaEc+UdShZdHSrcldLtDr+mEX2s2j30Ne9oJ6O4mbiXMmIuS2STVNczCWm1UC3XUz6/PonL119rdsEVwkGXIYsYo//8bQaQeYEq4y6Nf3CyTaI1dk0+ZyQIAdpiYI6UFtDRyDYu0UF9nwDbjoTojcbmcGFSBNJHLIbxVw8iah6d69ZH7DaR9puIm/2RD6tJR325B5/qdF4lPVbI42NyLVMqJld5+1E8ErMTaGe1kQfJjIa7/RHJRALaxEqEZ/J2pJUPraJV638XNtj73BZUIyHCo5pRBxiIi/lJkvFuHC9fgtq5B347ovkCLM7J/AqxR4nn1JGpiGo+tLqIHHdthPfnBOr1k9JHLu2wr6RjJ8JWQ6wyh/jFGJ3zBaDdnQ53GVAdoTBRoG+MssgD+r1+Mnp1p6jMA+cw6P4t4UQ2jFQbuvLzMiapxOr7eHG7II5YBRGRoiiOi5o5a89osLJ5LLdvPJnjDOFe6fIVtZpLhqgQAbBb/ysY/SQ2oAYWSMzyOoWuNZFatKZoAznrVXo4bow9TM6M6Z8H+MKBbjrRyGlnfR9MhYUqdNTUUfqBrsvc0u954Nuj/R5bdBnsOz+YRqTInZfKn+rOn4IZD0l2wL991dEzkQpzdaN1eknA9TkWJLNT0n3y4d6kkXxghYwB+rM338t/XVMqyHAC/zjBobxnFB2WIKgHHvVL/nHX1ndqv7SRj7wRiajJgm69mo5VWwZpBm+WN/FAHLkgP2kDiPQ+aMpYsY/Ni0Dz6zM7EkPPeSfpxVhCbG68GXd6rNJaZb4el9qK9C6DRCKLlJDKI+n43AU6UeJrAEsIDPo+JT1l4/DbUiH/Yp8yQGGRRbvda6oBKfdo4LM3cinkDC/37kdY3/IqMnVux325ObrhnFn/AMgdi8eFQyty6qENaiOx09Zibw2FZogFO68HtFSGe54nPrQUU+cxHuOEK++IZEk8qV7WgpKcvI8Kf8p08IDZ98UYmq1+FM5pAids0gLZTYM5q57Mmq82+RW3hzUHwIujEriU/HfZ1rObF25EfmQ6Y9kn1I6vFkMVJ8ImR87LILPYhvCJy+l7QrrsHP7z5LM7WXAx/r9Jr+wJXewO8ejbqIndetiQ9fGYJY4RVV/oWuBEFGeU946iMWXtNbwoTiLWPW+Q1MQz56M1wapuuR0DwdyXfbvzO9iOKOF/e75plQAtk0b5BulOAZvyOvDtKOO8duViXVuKGZWk7qzacUy0YRQMzat8HosPIZcChH9mWA4DLKPNhlboN/wlXvG7wA5kUnpl1t/3OQ74OYjzInsvdqmNdNWT2mAJ6uGtklPyeHkLyDHzFgV0Rj9YsDlw0g7cTRkmck+DANWv436IogLfMmf4uWahuHNXYhEeTOKh0UkEhJQ2NEMhDxJ+Nz66TZseLFOpoZeXaoUTq5RG1EhQF3xWxiFf/tbbhOfGaJ8HtcJxiVdrwA4zA1UupMnDqK34LV2iM3Dkj8XABSlfFtb5LTM/FozcF/BEkeiUllfikCVZinzwJgq++aLd784cc1ku5eLOFtH+AErBK29/ijFliYir3k6Wbhbutf+TBqthBJ6Uu/iKtbVh0qrFNWt3+gUDOe3tvihWH7Qxd/JmEqdbWZ51Dr/EoGA+Sv5o/Ww2fZrVi5Prtv/Gh1YDyGF6d40AL8j3aVUOgDAbj10zxV0erObYuoq8KFduMHkuJl/fpQ0zbBzMhZgcHwii00SCHzXR1ei2oo80cgj8hMLbKItpB4K1QrUuy2aCo4hU2dwYLkEikx/4jXOxwwKOGylqIP/YiIPlT7Jsz7umYXVhqfy4q68pudO4Z5jlJiYgnclZEAgSDHioUqBJhFyETc/MNGYkg7aNBu3nT4zUOFqy0/ETuU0PtaV+eEUgWtR1+bMupHXaKSArXJD9ijpbQ3pYNJ42uf3HH+7okWvTWwcBbyR7g5Jz3rGOerHSebSga9CCUhAUrO5/XX37D8yojvcwezgk2zIISWPi7kGiUrxF2SgE6Txo9UUGC9DVd47r2ICW1wdLONc1wF9uXChBh0UTOYsM555JHUG/o9gE/3iHIiVe2nqYbMapeFnadx4rpKinqKa38IF+fuH1esU59ls6r1fvi8y0DhFPe7PYZDuOyuGUxWzyffDQ2uiOpLQPN8ObiueQOiyAnKz0f6cjxUMiLO6mQahsdl5RaIVokmwGfMeBlLypOgzlXXLwbNJA3gZNC4zKUf6b4KntGAzGlZVhAfOAxsLYc6SZkfjgVvXJvE/tJ4GgGMl6jYk4Fwv797FeiOcMOadCr/zo0hpvTy9A+C8j2RCRKcGSSd7cY6H5zMEJHSgFqUR3HkKlH04XLcNGNxa+JR3aPNo3BVbmf6eXdtjzxzmuvL4c5DBhQ55rg8Ov9P8ntETzApaqRQ8FX7K5AqrEMln0Fy/K8cR0447KoJdCCOP0JQPm8NoW234jkHQzyz3Y5EsqoEDduUgiOqh13EHLo/OYGE3Tm1uHpRWz+TkuB8MxUezQFqdpeuyk7dTPuPgtSUFUoUwo/+rCxE1JeBFBpePnCZGIyhyWrto1hQDARkjA4euekpoAWqXSt2mXoZ96tJCeoJm8rvS+brYSPnL0QUXMon6+g5rpICF+HDLGJ3zWJ0k6tOoKGrBnQ5SGfqYorWOGwDNG5AqwIcjgrwu7kgNCPqKF9+aU84CijZTm3jScBnW+Jo6yFl8UVqzWR5XSM90nR2k6NVv3Qg+1qsmpDu54xJcploa8avaj3uVBPiNxZPPDGMA5H5y7Lwcc6G0iteVpRLY6IabA5+y7ZarT1c15t+SO4+FUyfhY/wU/egVOxiXPGX94wglkd0l3VlImwkPq30IB0craqwdZQJH37xdLcBdtHwPPPN967E97u9eCTxDhel5xyli1ireWkz7s+b/wVk1n+TJ5Cx+h5ZvHtQLQJyJM8qClhLSS6918xW/BXKyZo,iv:vGBNbbUQBJx6V2jSPCQi56PV2uNfhOm4BmwQxIb4RjE=,tag:kJHlcwaaj+ODdJAqwlAaJw==,type:str]
+    os:
+        crt: ENC[AES256_GCM,data:jaebXQbrJYrgMmqqLBsW7HEoOKTcieERmWYWsvXiJnjBCQ6ie/3jtPK9x982wjjU6xlIgUzL6frjjBhVmjWG42QYLf4LFqgbFc3nwR1veJ2ZsZ0P4Hyz2FYJpx1t6WLhagTBlcxtzNo6c0IG0c2rGD5PzV5q4jbMdHMO5jdtxU9yYIJLFY0Q9YUnLO/ICtH7v8cctya1qgtDu7Q6dIDbws+T48eccezaJaQdFKDefGAE7d805GfsvzkyXc/bpjWEcwcqUHyS1NdBtzXDXlZic3GhFNhdyigemvbAlz7QkLQwE3N2PXjpPN6jHXqP5GUDBJhzBXe68hNVstA3dSGnq8S4P+1TcRrdE6TmATcLOyWFHRD2dLz62MbjctRHO+7IyAdC6OKEESVTvUKmVShGinVIiXhW727waDOHJlMl25chScRcHXsXE+JdjNsle9V0w+M6W0+hFLb62+98SzXy6R6SwF9+q8nWRlhUE2Vmt3AL8Gyn2vFS5OihOZl7kOZSZ3OVNag6/ZOiKu3n1BZg5HDT13itxB/kCsASGgNW29TuPyeB/N5ileOOgAn4aIC/Fz/N0BaebD1MVuJtCKajZLkFbODhGcJF5K/wd0kcrANO8dYAhkJdw5RR170WF1260DZNa8VjT8gbFelDHEhgghml5D2tGVilzaf9WN+5PD2pUtU5zZRTYXvTM5zUQ1q1Liv8F5jqTDEDZawYn67tFodRlPoyJ9mmcfVNWRiA7gkuHHNI9DRPveqkeCtg67qkJU4XHt9LeBCpMDkJRDFij4QmNLXUoOOJB1GDyQ0t1xOCVwY4GSXXAhLbXDHuJDtN9k7SOJwFqWShK2FQhs7WV1jzGYFKDOzhrpfjOn5m0V1Sk3ji,iv:RsamTEweph4iuZZJKRixPfR+Pn/74pTDLd9D2VB4FK4=,tag:2wFIcTl0aKqhz51WQ/BhoQ==,type:str]
+        key: ENC[AES256_GCM,data:jVnPOPuvcZ6CetQvaBUlXFmRk70cweCu0riLxDjkL4dELV1mReBrPxVgd8J/ucPTx3NwFt0PDRiT2oQ6QLlWS5hOuGIt35dBDMTwGxQWMMFcVp30IGjm8kZCShiXNJdueZ3RsNhiqvGsYqeZz2xQn14L4INbdUs0k1szKIFATJp2SRoZt6I0uCG7X7w6KdPX6kyYmStBbjhhcdFeIxcK1G7NSkUDCR0yJwiWFdSREiEcQUSb,iv:0hOqTpW0joorvx5CMXFa/OB2OGAb3xnRYSpzIFiqNfc=,tag:hpk08vumWoCYL4bSjGHu/Q==,type:str]
+sops:
+    lastmodified: "2026-08-21T18:20:05Z"
+    mac: ENC[AES256_GCM,data:6DE/xxY2IsPLsn9Gkd0RlV+ulqgqirT3cAnQKnqumMrtuVPKotWS16H/BPBx3nc5oFDrdo4nwGKzGPaUmYYWN2+BTk2sxp5tgZozaDIyVFZCio0fZRnFSI3wdRjC9yZVA+4zZjx69w4iVSvlZxW/8igS7NZIuMu7HAfG0x4EDfs=,iv:nl93MPuMWGUtkuNvZJl/yHjV0UZWOe1el3QYwhiDcEg=,tag:LOFNFcbY0InniqhRLfRawA==,type:str]
+    pgp:
+        - created_at: "2026-08-21T18:20:05Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/8DvqaVGSh3lzl6n2IFwojtpkGK3U5itUSBRMpIJKgSn/h
+            dzUemfNhjf7YT/VQh2zkQhAN3u5u4V0vEJWZ4IuOmUgBktARmhEZXcQ8aI6ZLmVt
+            hPs5DtRRLwiachoR2v8waqgfn+BG7teF/pkj8Jjv1ca2puS5yOnczxPus+TRpv2z
+            rtvr78jf4p/hXvIfsyiTJKaSrkwJToQjxkueZAJqAaHyxv1LvqnlqI6lIY+nLVEF
+            egteZXY7erPljtlp9Rd5rXpXmOJ1ue+1IOj456tMMTmbHcBa8bYcK/iWmOu3Nkjt
+            WqEc66QJ+iB2C7sM2Wq/tXkZsfOEEo+AfeUFVOrnMPng4bNFZYpknFP03/EkVEwj
+            5Q89kZq2ibSZOKoY/yvDrkouxMDv8GaEGyg8o84RQG+gQMeSHngOlEGuKQUd5h29
+            1ccNa6A3d1Uv7Cuq2vbCFrDfh+XH2ZP0frGqvMlq9cQHaYhPlnHIOYBhlRHgaNPk
+            usXCyzt4faEX8c+Ktpsk16funaTPSnd8bSN7t3Ckbu2TwCg1Y71+6bU60/M9NyO5
+            FkyjwHf+BO3YschW7Q45O644XBm+Z98lzg7NQBCCKLa+vvdwSnVFd9e8kSUJD9Kc
+            KrC3vfamIfPCXFMNZY549UdB6DlkUt+x/0Z5g1dL5tmirX3LygNug+MVoslw5PTS
+            XAEi8r9UVAQ4G6OspWFAeP/wxAX4yrq772IIG8CJdQziB1e1BUPcagBc3FzN4aj9
+            7KdSHE9mN6Li8vrA+6/BdysY4KsTaiUQKiGKYrJU/NNhniAwQ29MUpRdQs2V
+            =Xo67
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2