readd sops secret

.gitea/workflows/validate.yaml

@@ -48,6 +48,7 @@ jobs:
             ! \( -path '*/config/*' -prune \) \
             ! -path './bootstrap/config.yaml' \
             ! -path './bootstrap/badge.yaml' \
+            ! \( -name '*patch*.yaml' \) \
             | sort
           )
 
@@ -70,25 +71,12 @@ jobs:
                 -strict \
                 -kubernetes-version 1.35.0 \
                 -schema-location default \
+                -ignore-missing-schemas
                 -schema-location '.ci-schemas/{{.Group}}/{{.ResourceKind}}{{.KindSuffix}}.json' \
                 -schema-location '.ci-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
+                -schema-location 'https://git.olb42.com/olb042/kubeconform/raw/branch/main/crdSchemas/{{ .ResourceKind }}_{{ .ResourceAPIVersion }}.json'
                 -summary
 
-      - name: SOPS - check no secret files committed unencrypted
-        run: |
-          fail=0
-
-          while IFS= read -r file; do
-            if ! grep -q 'sops:' "$file"; then
-              echo "ERROR: $file appears to be unencrypted"
-              fail=1
-            fi
-          done < <(
-            find . -type f \( -name '*.secret.yaml' -o -name '*.enc.yaml' \) | sort
-          )
-
-          exit "$fail"
-
       - name: Apply bootstrap Application
         env:
           KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}

manifest/overlays/production/argocd-age-key.sealed.secret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-age-key
+  namespace: argocd
+spec:
+  encryptedData:
+    key.txt: AgAH1fIhZzPappr79MuofsbpCGGiFU6aMruZqKe+qVcr0WnMsE2Ao86/PSZMyvRls38roE6p0fX0/rbVrcDrNexzt4MqC4lURaYCcp2qCXhNfvxCisSRIHgSC4HzD4x4poleo/V935+wyAbaptw2OWZ7rUGjAdoLvte1noZhNrmBTdhlv87oW/ON1MFzFkjbKKiEXV76eO0woo4c/BVsuCF983CwIHqeHoEJsIDkm2MtY4TTgRm4KZR0iA+IPWVW6zoA7LniGE3Xsnv1BOql6AhcaFnUkkvuRx2vhbWjxyjzoU727OZb3Z1hu1VfYDiZXkRXcoJb53nEz9W/psSylrHyiGf5Vf/RGWnaYZ/H9VhgTwlHzrZmXLukT9HVDMQ1OQFTK4HUPbvlO9HVyaZ73IAcLvnPh4/gQppjAmz1TH6r0dmwJULYKpLbCy4OE8ppZjakBGb+s+xE8Py2V3TCW+gA966+A47GRMdKRfP4heG+Wkbi4cWspaZkYO+iEo446EpHZZ31dqzuzZZBUKp2FqcX10SVDNtjs4wMQHwaPwxxTSROj+sWWbKOEERpHIT1TYHah7xZStrMC8L3J7O0A09CsatJJNOLGeCZdLZJxbt6TNQ1s6uc9QmS0+mHpekjinnd6eYwyX47+0e8NZ/+20mhF3ePgFzKlvae6X1iWaHnwjGlPwVpQKj7ICKlerKr0a2H3HIC+iZRW3ArsZxtb481X8QuclNA5pasGh4by7Zqaeyda03monbH+vbVrqYwWzDTYHrGfrGd+hSTJyw3FhO9FfJ0b7T84mAczw==
+  template:
+    metadata:
+      name: argocd-age-key
+      namespace: argocd
+    type: Opaque

manifest/overlays/production/kustomization.yaml

@@ -13,6 +13,7 @@ resources:
   - argocd-secret.sealed.secret.yaml
   - repo-creds-external.sealed.secret.yaml
   - repo-creds-internal.sealed.secret.yaml
+  - argocd-age-key.sealed.secret.yaml 
 
 patches:
   - path: argocd-cm-patch.yaml