Alex
3a9675f992
Converts cloudflare-api-token, argocd repo creds, nightscout, and the three solitaire secrets to SealedSecrets (adopted in place; values verified unchanged by before/after data hash). Controller-generated secrets (cert-manager webhook CA, LE account key, argocd internals) intentionally left alone. Verified post-seal: argocd repository label and dockerconfigjson type preserved, letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.5 KiB
1.5 KiB
cluster-secrets
SealedSecrets for credentials belonging to components not deployed from this repo's ArgoCD apps (cert-manager, argocd itself, and solitaire — whose manifests live in the Ferrous-Solitaire repo). They are committed here encrypted, purely so the cluster's secrets are reproducible after a rebuild.
No ArgoCD Application watches this directory; these are applied manually:
kubectl apply -f apps/cluster-secrets/
Disaster recovery
These are useless without the sealed-secrets controller's private key. Restore it FIRST, or a fresh controller will generate a new key and none of these can be decrypted:
gpg -d /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg | kubectl apply -f -
kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
kubectl apply -f apps/cluster-secrets/
Passphrase for that file lives in the password manager. It is not recorded anywhere else.
Contents
| File | Secret | Notes |
|---|---|---|
| cloudflare-api-token-sealedsecret.yaml | cert-manager/cloudflare-api-token | DNS-01 ACME; TLS renewal depends on it |
| argocd-gitea-repo-sealedsecret.yaml | argocd/gitea-rusty-solitare | repo creds; needs label argocd.argoproj.io/secret-type=repository |
| solitaire-gitea-registry-sealedsecret.yaml | solitaire/gitea-registry | image pull secret (dockerconfigjson) |
| solitaire-matomo-sealedsecret.yaml | solitaire/matomo-secret | |
| solitaire-secrets-sealedsecret.yaml | solitaire/solitaire-secrets |