Alex
3a9675f992
Converts cloudflare-api-token, argocd repo creds, nightscout, and the three solitaire secrets to SealedSecrets (adopted in place; values verified unchanged by before/after data hash). Controller-generated secrets (cert-manager webhook CA, LE account key, argocd internals) intentionally left alone. Verified post-seal: argocd repository label and dockerconfigjson type preserved, letsencrypt-prod issuer still Ready, both ArgoCD apps still Synced/Healthy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
1.5 KiB
Markdown
31 lines
1.5 KiB
Markdown
# cluster-secrets
|
|
|
|
SealedSecrets for credentials belonging to components **not** deployed from this
|
|
repo's ArgoCD apps (cert-manager, argocd itself, and solitaire — whose manifests
|
|
live in the Ferrous-Solitaire repo). They are committed here **encrypted**, purely so
|
|
the cluster's secrets are reproducible after a rebuild.
|
|
|
|
No ArgoCD Application watches this directory; these are applied manually:
|
|
|
|
kubectl apply -f apps/cluster-secrets/
|
|
|
|
## Disaster recovery
|
|
|
|
These are useless without the sealed-secrets controller's private key. Restore it
|
|
FIRST, or a fresh controller will generate a new key and none of these can be decrypted:
|
|
|
|
gpg -d /mnt/bulk/backups/sealed-secrets/master-key-YYYYMMDD.gpg | kubectl apply -f -
|
|
kubectl -n kube-system rollout restart deploy/sealed-secrets-controller
|
|
kubectl apply -f apps/cluster-secrets/
|
|
|
|
Passphrase for that file lives in the password manager. It is not recorded anywhere else.
|
|
|
|
## Contents
|
|
| File | Secret | Notes |
|
|
|---|---|---|
|
|
| cloudflare-api-token-sealedsecret.yaml | cert-manager/cloudflare-api-token | DNS-01 ACME; TLS renewal depends on it |
|
|
| argocd-gitea-repo-sealedsecret.yaml | argocd/gitea-rusty-solitare | repo creds; needs label argocd.argoproj.io/secret-type=repository |
|
|
| solitaire-gitea-registry-sealedsecret.yaml | solitaire/gitea-registry | image pull secret (dockerconfigjson) |
|
|
| solitaire-matomo-sealedsecret.yaml | solitaire/matomo-secret | |
|
|
| solitaire-secrets-sealedsecret.yaml | solitaire/solitaire-secrets | |
|