mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-21 16:36:05 +00:00
kosmosandvhaudiquet
5bf07a2fff
Address review feedback on SOPS handling for encrypted values.yaml. - renovate.json: Renovate has NO preUpgradeTasks option (verified against the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks (which run after the tag bump, before the commit): decrypt the values.yaml, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values. Only **/values.yaml is re-encrypted; the docker-compose and Chart.yaml files are not SOPS-encrypted here. - kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob running the renovatebot/renovate image, with sops allowed as a postUpgradeTask command and the SOPS PGP key loaded to re-encrypt values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources. - Wire code/renovate into the root kubernetes kustomization.
10 lines
498 B
Plaintext
10 lines
498 B
Plaintext
# SOPS PGP PRIVATE key for fingerprint DC6910268E657FF70BA7EC289974494E76938DDC
|
|
#
|
|
# PLACEHOLDER — replace with the actual ASCII-armored PRIVATE key used to
|
|
# encrypt .sops.yaml files, then sops-encrypt this file before committing
|
|
# (wrap the whole file as a single value matching the `.*key` regex in
|
|
# .sops.yaml, or store it via the .pre-commit flow). Keep it out of git in
|
|
# plaintext; this is a Secret source.
|
|
#
|
|
# -----BEGIN PGP PRIVATE KEY BLOCK----- ... -----END PGP PRIVATE KEY BLOCK-----
|