funman300/k3s-homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(secrets): seal remaining user-provided cluster secrets

Browse Source 
Converts cloudflare-api-token, argocd repo creds, nightscout, and the three
solitaire secrets to SealedSecrets (adopted in place; values verified unchanged
by before/after data hash). Controller-generated secrets (cert-manager webhook CA,
LE account key, argocd internals) intentionally left alone.

Verified post-seal: argocd repository label and dockerconfigjson type preserved,
letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Alex
2026-07-16 10:01:58 -07:00
parent 07654cd135
commit 3a9675f992
8 changed files with 139 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/cluster-secrets/README.md
+30
View File
@@ -0,0 +1,30 @@
# cluster-secrets
SealedSecrets for credentials belonging to components **not** deployed from this
repo's ArgoCD apps (cert-manager, argocd itself, and solitaire — whose manifests
live in the Ferrous-Solitaire repo). They are committed here **encrypted**, purely so
the cluster's secrets are reproducible after a rebuild.
No ArgoCD Application watches this directory; these are applied manually:
kubectl apply -f apps/cluster-secrets/
## Disaster recovery
These are useless without the sealed-secrets controller's private key. Restore it
FIRST, or a fresh controller will generate a new key and none of these can be decrypted:
gpg -d /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg | kubectl apply -f -
kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
kubectl apply -f apps/cluster-secrets/
Passphrase for that file lives in the password manager. It is not recorded anywhere else.
## Contents
| File | Secret | Notes |
|---|---|---|
| cloudflare-api-token-sealedsecret.yaml | cert-manager/cloudflare-api-token | DNS-01 ACME; TLS renewal depends on it |
| argocd-gitea-repo-sealedsecret.yaml | argocd/gitea-rusty-solitare | repo creds; needs label argocd.argoproj.io/secret-type=repository |
| solitaire-gitea-registry-sealedsecret.yaml | solitaire/gitea-registry | image pull secret (dockerconfigjson) |
| solitaire-matomo-sealedsecret.yaml | solitaire/matomo-secret | |
| solitaire-secrets-sealedsecret.yaml | solitaire/solitaire-secrets | |