feat: SOPS + age encrypted secrets structure

- .sops.yaml with 3 age keys (admin, dev, prod) - infra/gitea/values/*.enc.yaml — per-env encrypted Helm values - infra/kargo/values/*.enc.yaml — per-env encrypted Kargo admin secrets - kargo/credentials/*.enc.yaml — per-env encrypted git credentials (ksops) - infra/kargo-credentials/ — ArgoCD app for deploying Kargo creds via ksops - All repoURLs point to deploy-app-kargo-private Structure from deploy-app-kargo (reference), adapted for SOPS workflow
2026-03-11 10:01:26 +03:00
parent 720748be50
commit 4dd68859d8
60 changed files with 1444 additions and 1 deletions
--- a/infra/kargo/values/secret-values.dev.enc.yaml
+++ b/infra/kargo/values/secret-values.dev.enc.yaml
@@ -0,0 +1,27 @@
+# Kargo secrets for dev/test cluster
+passwordHash: ENC[AES256_GCM,data:qmQr8l5EK92BZyadoAU0+hrOS2N8evnmxroL13GhQbD9idHKhHwkSt6fn1OgYyu+CtnJ6BxeyDyJCNbN,iv:4tnO8HczTo4GO+NFFQK6JRsOYXkS3wFiJfwYrCmot0M=,tag:LTeO8xl31f4+oLy/FDEyIQ==,type:str]
+tokenSigningKey: ENC[AES256_GCM,data:Plf3vK+DJYmFsvS1cHTKtPvsvCC17i2/0lAEnG65CZVcrtux3+BiMY7rukLfW7uw/hQ+6JLB1PS4EWIGMNx/xw==,iv:54mdXGpgJ3f1dkeTyfZbfSoufJE89MUYIQpEz6jUt0E=,tag:KqK4shNvrQ7Dbu0+uYqjPw==,type:str]
+sops:
+    age:
+        - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVHNjbmJ2K3ljSHNmdEpE
+            RzdrL1o5ZXhxQXl0N0ptWk5JWjlCYnVtTXdZCkRWUDl5RkkzYXFBbjRpMmdnY254
+            YWhPeEw0MzF6K2VoTEI1R09PV0szQlkKLS0tIG42S0h4VUtsaWN0WTI0V1piYTU5
+            MUYvbzVyWUVRZHRYd21MY2dWMzVBTE0KJ0cSonX/lD3PBjz3BFFPkea+XDDPqGAF
+            gd20j8xOjyV1nu6Dg1qq80ZN3E0rotXnTK5zu/AyW4wcByUTG465Hw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBUmlEM1Z4NDRZaU9LSFF3
+            SjZnM0R6U0NlYWtkbGFMdGRXbW9YRjBIeVVjCk9nV05aZk04L0xvUnk4c3hRczZV
+            ZEY4dmI0NndjWHEvSDJ6OTUrS3owM3cKLS0tIFFhWUk5Qy9GMGNrWGM2WnY4SWNm
+            UVVUcktPakNYeWVxakp2RjQweG41MVEKoHKCkhsn29s4JuRCfBqoF78/UcShnCAx
+            sGnz9zTnE+LSVMbknG1+Y3kFdRNXesLFZfyyk3W2atjp7Tw9rGYWTw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-11T06:57:04Z"
+    mac: ENC[AES256_GCM,data:E4jKWJsO9bEMzEjmp+XhBx45heXB7W5op11YyC2TV2KA0PNfAa7eZXIAZ7PVjVIfhbmODv3pd3KG4mY7lJ9I1ly6VfFGl4wMtXZkQlVt5+2DF6GyLGGfjKftRcGni4xP2J4wfzZGiIiQ2G8IUfmGy8Wpegw9lo6/UvES1w1kies=,iv:6fwg2NNoZnKq9jiFHLRQ6FZXrx9OzFEnxWU1VwEVoj0=,tag:CiJAekk+4dp/pyWkqXJKVw==,type:str]
+    encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    version: 3.12.1
--- a/infra/kargo/values/secret-values.prod.enc.yaml
+++ b/infra/kargo/values/secret-values.prod.enc.yaml
@@ -0,0 +1,27 @@
+# Kargo secrets for prod cluster
+passwordHash: ENC[AES256_GCM,data:iYRGwF7yug4fy4q70CoWMJCAIwd5nszzTqXHXe88zGRRYw6YtvAszCpGcecRRFhCwIfycTnciXfN,iv:CwerCu5GfMhpTpeqQ2QmMBMwxf7t2L12PUM4yCT4yIE=,tag:XNhTKS0d6T0VhK6E9BDn1w==,type:str]
+tokenSigningKey: ENC[AES256_GCM,data:+05VkEeKatxayA1wK0a19fE6PFc3utOHvvT3Z+4KwfUBI778n5X9rMwSQQSFsbQyduPLITGf5VYKGaC5z3okAQ==,iv:uuS6oHdCLrvh6H38sfYzXTsrZ1lw5CJxjNN/0jchV9Q=,tag:iVuTqL2zew18OMeFwnGqrQ==,type:str]
+sops:
+    age:
+        - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEYytrSWhtUWtEQUpQVEhh
+            S1RvN2N3ZFcvaFVmdU5KQ2pYTitPMUJJQTNFCml4YWMzRWdiZHAxRUoycHRmTU1L
+            RUhDOEJzSThIVDV0Y1RSQWczeEVXU0UKLS0tIHgwM0k3R2k1V1h5U2tWajdnMElj
+            SUdhZzh1S3Y3cktwTUJzQk5Lc3BjeTAK4LOXLhfyd4NMWsuUm0/Bjxq+9ni6wntw
+            6u2UgYliecKNw4IX+2Ukhp/z4jGlVEayAE8QrfCj7RjBATPUYncPEw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1bittd3daOE9jWUJKeHB4
+            R2k4Q3lNSzNkTDA0RTZlL1JrSFNMalRhWEVVCjNYSDVZU3kvRHlqZTRaOGRkZDJI
+            RUJiM2RMY0tFU2QvT25tQlFtK1l1NTgKLS0tIGJDYzhFelR1TkpNL2JmMGJ4YXd2
+            SGNGTGhGWGovbUJHMHh0QWhIWlhBdVUKAKxeFgOPJRaTl5z0bydzd1nr5SDmqfMx
+            7n/OjVadcCg4PLd54eMpgiJ7ts4UeaAK+RxdHtI9Y7jP1ConLffoAg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-11T06:57:04Z"
+    mac: ENC[AES256_GCM,data:Mp01K4uHW7ZFXzURs8nzkfwe6d7xgiOds12/VN1I5qB5OoC3afM1pZRQ7/mM0lTyueVt9hTh4B76zAFp6rB+/ombjJ5JPnwyEayAklovy7R6BFC1podhb78npC2u7K5P7DIFI54nJqj1XfFt4eIMQjkR6AnFeT1pqzquF7SVnLQ=,iv:VesrzDd09vugtzAYjB/oyHm99Dmm8dlDgP0NITvd4Rs=,tag:5z5zBC/7ulnqTRz9UXyrhw==,type:str]
+    encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
+    version: 3.12.1