k.rennerandClaude Opus 4.6
02ce513b4a
Replace External Secrets Operator + Vault with SOPS-encrypted secrets
in git, decrypted by FluxCD using an age key.
- Add .sops.yaml with age public key for encryption
- Encrypt Cloudflare API token with SOPS
- Remove ESO HelmRelease and Vault ClusterSecretStore
- Add decryption config to infrastructure-crds Kustomization
- Bootstrap step: create sops-age secret from local age key
No external dependencies. Age private key lives on workstation,
injected during bootstrap via:
kubectl create secret generic sops-age -n flux-system \
--from-file=age.agekey=$HOME/.config/sops/age/keys.txt
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
4 lines
120 B
YAML
4 lines
120 B
YAML
creation_rules:
|
|
- path_regex: .*\.sops\.yaml$
|
|
age: age1yqjvqkwwwxdj7mr546zfs5ckzuwndp69ya2n2drd4vypwns8w4ys04qfy3
|