move to sealed secrets

2026-05-05 01:01:52 +01:00
parent c111a36a03
commit d13564d5e5
21 changed files with 127 additions and 237 deletions
@@ -47,6 +47,7 @@ jobs:
            ! \( -name 'secret*.yaml' \) \
            ! \( -path '*/config/*' -prune \) \
            ! -path './bootstrap/config.yaml' \
+            ! -path './bootstrap/badge.yaml' \
            | sort
          )

@@ -7,3 +7,4 @@
 # Local plaintext twins for sync-managed secrets. Keep these untracked.
 manifest/overlays/*/secret.yaml
 manifest/components/**/secret.yaml
+manifest/overlays/**/*.plain.yaml
@@ -1,5 +0,0 @@
-creation_rules:
-  - path_regex: manifest/(overlays|components)/.*/.*\.enc\.yaml$
-    age: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-  - path_regex: manifest/(overlays|components)/.*/secret\.secret\.yaml$
-    age: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:6DE=,iv:jmCYy0QZYlBVpnuskjcYwjFD78h4oHwiCZUUFmO9LGg=,tag:B/MqUiYVkcD8kI3tbpMGSw==,type:str]
-kind: ENC[AES256_GCM,data:Wxy9n8fQ,iv:VTC3D0lqQfL3v9mVubEjlkbrFzwHKENX7TEaRwHHJas=,tag:GCkfev+cNdboclIRmy+81Q==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:V9MD1Ep17zBd8RsXPTk=,iv:JYdyor8U2/M5xu9Elx2OONEEI69XtTrvjunr4QtvbDI=,tag:diAsRb17TfxRvh8hqeJPdw==,type:str]
-    namespace: ENC[AES256_GCM,data:FPWqsFwo,iv:J3T2KTD5Pz0M2Hj8UCkzsoeEp6dvVXI8vCdyzE52t7k=,tag:pIJh0kFzHzDSm0Bmtis2PQ==,type:str]
-type: ENC[AES256_GCM,data:m74topXX,iv:TIfxgPckr3CdlY+BfZreuqPgYzWu8iQJ3yS7Uu0QFnk=,tag:a1tUAGF3eBYPoLys0z/Nsg==,type:str]
-stringData:
-    key.txt: ENC[AES256_GCM,data:FgFRiXd9kdgqArIlm70Fr2S7Yxcq32s0OzLnfxZhTk7PGbeBdhDHo+pclcM9htHd/uJKoOtxwjBBxacAkojD5Sfp4QnDOOysZpo=,iv:QFpW2dgR14HyuPs8IijdImzVOEvfMUm6NhOrg1gXB1s=,tag:0U8hQz8ibma/XNaloUJ17Q==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrekcwSy9xT0Zla3Rza0oy
-            ZjlpaUo4QUF2NW5kSGNIekozVEhnRC9Wa2tvCnZXL0syUWFSWGpydDN3VXAwSVB3
-            elZ2Y3BHMy96bTJQOWg1QzVJRzZZeXMKLS0tIHVrSmF1THJQZW9sYnZlTmxiZVlz
-            SG5HMWlmRitpUTBEOXg4clh4K2hNN00KKr7D8oIXoGc72kUsSvcA3P10REYMzyAC
-            3NGQmfkDSXcbXTWsOGUPkjtqt/boinEMvUpid8AH+xtEzKblBsIcTw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:/ybCzs14eKMlwEgqXajKUjHt3vRvIwTWqAo0RWohCCI/oOn/PQtBWd9vXM58NaKWNbG0pohHvI2QC1XQ717Da3ZfE6bD8DJTKerCcpkHGXKUVj1pd8B/lL5OYnvPrMOgvb0EqIQZd0E2vsildBySHQonrYX2ryF6VR9pmWIXcAs=,iv:y1KLAxrOVUBp4iSGH5WwW+hdFT1UNhvgI/C4Oj8yFtY=,tag:1mG+YzZwKXSkZOKi8R2r+A==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
@@ -97,7 +97,9 @@ data:
  url: https://argocd.olb42.com
  oidc.config: |
    name: Zitadel
-    issuer: "https://zitadel.olb42.com"
-    clientID: "370752543384470542"
-    clientSecret: $oidc.zitadel.clientSecret
+    issuer: "https://auth.olb42.com"
+    clientID: "371517213338829947"
+    clientSecret: $oidc.auth.clientSecret
    requestedScopes: ["openid", "profile", "email", "groups"]
+    requestedIDTokenClaims: {"groups": {"essential": true}}
+    enablePKCEAuthentication: true
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:+rE=,iv:6V8DIeiL+5j7kzS3OuSXgArPhqLn04Wa/KoifCDOciQ=,tag:j+JJW61bELsePwJ2dfqKxQ==,type:str]
-kind: ENC[AES256_GCM,data:pIWaoeQi,iv:1yRMsEKS+fktnQW+uKnnmJVD4L0ddD63TY6eidSIKOs=,tag:jL4WmDBtfOG6sm5FBXrMHA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:d6dDrnkNCf29T5Z1gFoJ85hb,iv:LdDvcvglvpoovGrHPSGLWxtXk8waS9i/zYMsYBpG8NE=,tag:gkF68mCh1jMixrFXC7Z+jw==,type:str]
-    namespace: ENC[AES256_GCM,data:TrRrdNXM,iv:Xf3AXVlR93CWBBhlRMB7q0SQdKiohzK/V9wOKXGTyis=,tag:Lf1z3FdESjPLa/tTApRU0Q==,type:str]
-type: ENC[AES256_GCM,data:FGwbGyKf,iv:yX05oJnqDKecf1Fs0KDPodFwXSSXGNK8EVhPzdZFGPM=,tag:b5KB4nfulU3ObEVDZOHn2g==,type:str]
-stringData:
-    token: ENC[AES256_GCM,data:ihpfWRkB41/g/NFje3WeF1YRUgFTKdKOGiiCH4uWMPFlTGwU074xKA==,iv:DrFTGMksxYw/2uyPLjR8lwmSwu7R8iVx1Wim8AzdEfI=,tag:NXbCHsrv0q4SklkvGMhMzw==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQcTJPcXlSTHlJVG9WSEpL
-            UXh6eEhoTkV3T1JTcGpsTmRPcWtreFYvakNnCjllQUdUQm5vV0plSlpvU3g4bzh3
-            Wkh6THB1NTJqR21VMFM1VDNGTkVLOEUKLS0tIDdRVU9LR2lLWEFZVG9aTnkrLzBK
-            RVRKc01FZ28zT0s4NWVXSit4U2RZMmcKMkJlvMXPjT41/zpN0RM5XJOKCJwRiuOe
-            Ht0dm2182nT+cRzndX90gyItwqHiLcYb/JVjejln1JcD5fFGyiPqNA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:jRlYu7vjxV2LwAXMUqxrXhW2e2zh5EAPWgRH9hX6Ozr9UFoDPtpwSFOlX1ZGoqig37UwfK7no/aWIwejPUsPPjyPSX8XoR7OmDQVDBOX986/8xgT9AuEk209+Bau4mLptJQvELUGgQvUTJC6f8Q0mM6SRDICeVVo3p49LCXuhmQ=,iv:qjBED3IZtkZ+d3nb8KH2xBm1yuP5q5nkCR92FlP4piQ=,tag:ifTij0bliApEqpehke+omQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-gitea-token
+  namespace: argocd
+spec:
+  encryptedData:
+    token: AgB/Ll5YQ8VtVjif0E0sngk2lB0SVkBmSREeZhJ9DrC0s1eWkY2QjnfBlny+iAb//VkDNEKqrN5Bkv2UrNdAXVp5blQ83M0OHpXxy2lSDkXgco6WiWsSYoua2hI/xq6XG9UxM78NSFaxmvo2nqUWcMxWZkcmqM6ne8zkORjiJN7DhXBqsklXeQTHAmJObEhiAXvcj1vNR69hIB/lwcU4+pxiLPsIsrhy4vTRA/Xtn/hRLoA4NyMrnjM7ZiOOwDP9/EDWCDQ6uT56X4DJP8xO/lJ1KOEhbvsobA9Mr5mTx/pYYBpFa5umPbnBDhNS+fs9P7IrLP7Ho4y9JfYpGCh8vithg2BX9WbbFQGoVbTWCsNdIZgjdhY4iyuMbxPR6VhsSwmo9bVvl3BH926NAgq3Ca5Ld1bi0x62uZJ6uqYYAfetmkHAkS67WlmgbkwO4s+24YyWD+lMeq6DRrEmXhBfJrDdLUany/1JJXi/JKsYGa9Ydj3E7Q8dad+oZ9NhxCFVG2r+uyx8PBEAmiVbc9I4Yp+Xj+LZ1a/FLVN+TDd9BQYX2cYlG27KzHSs4Tw+jlPKLnJH8VLJuauIYtW4bKzpwuLgmMv13UXtD2LBu3kruFWzgn/C5JFAKd28Gk0K4Iv309dtbkXeswX32N4rlRO7Tp2LFRgH5LJV3fZW2zOGvfCN1ZWX+T8E+K6EiytfCAZrbpy6Hnmewr0VXgg6iUwHdg9E8rdNk9yIIQGj4PK6QTuU93EbVIZGUFFu
+  template:
+    metadata:
+      name: argocd-gitea-token
+      namespace: argocd
+    type: Opaque
@@ -1,29 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:uDM=,iv:5zJ9zeBF9HcDpeW5pa2V8DKod7it0QmpJbPYbC2C5l8=,tag:VG3DWeTa0BrkAyy4IEPZgw==,type:str]
-kind: ENC[AES256_GCM,data:jSg5p1A0,iv:IQJbzH8kwB8MDtvPODxnVjyHPDJZsmk7pJAsxQgXvIk=,tag:2Z/s7DoQHq1PWCzYyxPdkQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:nTkL/kAqE63tkjbiJfMAi/FVktLgoXtvBMXU,iv:bjBX8Zw3jkNOXNqKcX1QiKAESRvVAlmy8iKPYWm9bXs=,tag:ZwkFTOOTSq1tx5G6VCCzwA==,type:str]
-    namespace: ENC[AES256_GCM,data:6wXXTlFW,iv:MNaxNMCC37T4cwcH7QvluctCD4hso/LTYZPGfc3Dl8s=,tag:W81+Q/KyX0mIrfbk/gNwKg==,type:str]
-    labels:
-        app.kubernetes.io/component: ENC[AES256_GCM,data:mIBkwyxqAgtQYHpKpvscsSOgGpEweCYX,iv:4Dq0AnGByGTtAUY5dgiRfpdcnyoqSHnLnyYJZ/mJTvM=,tag:qI7ETqJhfQtZ/1uJP4/LVA==,type:str]
-        app.kubernetes.io/name: ENC[AES256_GCM,data:fJliyNDZ4Rfa6D2QIKLKcmxGk7Pv59DNGLKqjVC78g==,iv:ziFzw+V3crWBdW5Z9mIpRUpuY1Y8xk0fPMrFfHuuxvk=,tag:6OF9t2bn/temQMEhrahnuQ==,type:str]
-        app.kubernetes.io/part-of: ENC[AES256_GCM,data:lCtXuuKf,iv:XaxeTocZimiU0q0QbDW0N66aKUFX5XHUnSaI95YdLQk=,tag:gEEpdYJ2wG95StL4Dr3J1g==,type:str]
-    annotations:
-        kustomize.config.k8s.io/behavior: ENC[AES256_GCM,data:CNXKM2k=,iv:CMLFoADwTlFdkL79xzF1wmqxWbtOM6h9GAfwniZz8Iw=,tag:xBpOixAte8XFalWYOTkbyg==,type:str]
-type: ENC[AES256_GCM,data:OCyLelpq,iv:Y1DFcVAFKY4X1gXuNyjciZfFNpfYUByk9qGudC90ebM=,tag:IS9Eqe5NwaiwjOfCNzKFpw==,type:str]
-stringData:
-    gitea-token: ENC[AES256_GCM,data:HtJ71iZcM9EBnYbzbpwnpdx8ErpEYxP+ud//klM7z1DllyaPpSy5JA==,iv:t2IvB5MsFEDC8XkDnKxACj6USz1z9cAwzNYMvpH2a/4=,tag:65N0OlkQgQt+74vI0MEDcQ==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2STlCQXN3dkJRZ2s2SGNl
-            Wk44bHpjVUhSNmV1MEV1cjB0S3cyR2F5YkVZCk9sZmNaT2kzVVRjZEFyMkdIb1ZX
-            amY3bFpLOCtMSFdNZnQ5azVwcEdxbm8KLS0tIGo2WU82eVMzUlFtc3JUSkduQVZB
-            dVNGRTNyTmNjUlVBRy9sOVV3STBZMTAKukXeDMUklESDFF17XezNj1lkNg68Pkng
-            oFtBnxqsTDNN5WWIR/VWor8GQlA6uGKymIsEtIsMsKtvxCSnOf3+TQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:41:25Z"
-    mac: ENC[AES256_GCM,data:lD3x8ysEmZQwKzzFOAgdmmnxM5qhqm0iMwlxW/vcYBh6MyMGqcFC0qOCZMd1eo7EbyNYKdBpZrJvp+QXGQWjebPc8sqX0PgGPbWmuk/SqMo0ZMJnre4C59SSIUo9DdQhWRGZoOrbZ7xl20bV/HCab1ACqeoamBNXow7eeeaosKE=,iv:Igy0kZnu98uTpjJyvAOhrj3AC9H7eyU1I++6kpFtNY0=,tag:oWa4jnOTMTfRp28TMUvLFg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
@@ -0,0 +1,20 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-notifications-secret
+  namespace: argocd
+spec:
+  encryptedData:
+    gitea-token: AgBl0iElWlgJeUgDQzO0lC1obMjpSKut830C1nlcfXY/eIeZgKFoEwBqaiW5cNKT8qsHsTSfyJMV4lNsSE+oQ9z2DFepHwlLsgUFoBVp21rzziOqOBkch9IrdBxjC8ZyG8WEIhqkbKp8jdq2Foo7Hgr6Y+p+X7vs+PEBDPeuebGwJDRMklqMu0arXaUAoTJstki2vNDT49IDEnJ12dEnpmjcMyISPkT7ScchbT+Jt+UOXOEl2a6kNrBXycV/aZxzcfNSKPXxDbQHc8kS6PYtnPlIcW5K6WRiZTlBCd227HrOtPxlKmE12BIrheePfz4ZCewHC5j/SdGXVfDy1Age0aOPMmaggrlSxJeVebhkBusLOQ8EqOk7oFTSw4X71Mb1NsSekSNXGMKG87lcIrXcEfU5qtqGFu45jsUe1nLwCW211+uOjdNgEvF+UdGkDIPR0VFkPmEGpLWn7jlTs3KIbZmXA3PsFd/ZgHR17vVQz/nC1PVFw6le61WqRK8d+4NgYFVzIx9B6zYTRqt72ewBqAdPRwK6Rzz9VcM2lHw+U0AInJ3hgAZDjA1IfogvJQArx9z8owW3iBRizRlcVIdmSGbASIvs7QiQA8PWPzMD3i+P2/Wug68kwcI0cYKPo96tA8LYhkziD/kJeVFqilf1b/kVtwRwT81d09twjvYqKTKhFPaySQfAG3ObnM7K4Yim/knOEcqrolHMwDfxHGb3yacpb8J0BWbdLVZI4WE7La/kgZOFZRUqSMyz
+  template:
+    metadata:
+      annotations:
+        kustomize.config.k8s.io/behavior: merge
+      labels:
+        app.kubernetes.io/component: notifications-controller
+        app.kubernetes.io/name: argocd-notifications-controller
+        app.kubernetes.io/part-of: argocd
+      name: argocd-notifications-secret
+      namespace: argocd
+    type: Opaque
@@ -7,8 +7,9 @@ data:
  policy.csv: |
    p, role:app-manager, applications, *, */*, allow
    p, role:app-viewer, applications, get, */*, allow
-    g, argocd_administrators, role:admin
-    g, argocd_users, role:readonly
+    g, [email protected], role:admin
+    g, argocd_administrators, role:app-manager
+    g, argocd_users, role:app-viewer
    g, mcpserver, role:app-manager
    g, homepage, role:app-viewer
  policy.default: role:readonly
@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:6AA=,iv:gn8Ynq2QIxaGq9yswYC1Lyn1u+64cs6itrioyp0xOi8=,tag:NirvNuZgGG89uSsPgC+g3A==,type:str]
-kind: ENC[AES256_GCM,data:U3lfmJE4,iv:dHbOBZflefIr3lrO/lgID+tyN4SpD9mJvolRwyYsh/E=,tag:r5dUwc1XIptNU02mKq7MRg==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:4oAtnzl73wEJxs/W,iv:5itZEVxJ8CubFFvB1u3xQCU/W+JcXr5EnPZUihV13fg=,tag:LySd+k+BECqSUshltsvslg==,type:str]
-    namespace: ENC[AES256_GCM,data:DylT9Hzi,iv:GR7tz4/NtwoXO0CqMfTApH7M+gG412xlCGoEW+D3QTc=,tag:9cFvr6USxK9+GyzFWxAM6w==,type:str]
-type: ENC[AES256_GCM,data:n2AEVnYN,iv:vEJzlQx3KmPpZ68uEuNwA3naVQUdU7hUu/qN5jw3YnY=,tag:9Q8Y2bM/3rffsxCosevueQ==,type:str]
-stringData:
-    auth: ENC[AES256_GCM,data:zvczuvAnQ7l5gXDqRxHoURrlsL6BMIDD5JH3L3ZxDA==,iv:UC8/24LpZkOMgqnE+gDkQS2hfGCiRNiQwatQq4B5KOY=,tag:OejCCqhG7ylvNNCOnCPL7w==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SG45WjN2UFhzRWU4Snh5
-            RFNiNXVMMU1wWUNrRzNlVkwvSWFULzdUd0VrCmJJT2piSWxqK0xRNWJYdlhxKysx
-            VVlZbngxV1YwNldveG5reXc3ODdGREkKLS0tIFRhVjlJcFNITlUwemxvMlArS3lW
-            QjZoODdNSGV1NWFhNTZCVWY4eHpOeDQK6RWdSxGF5dtKKXS9wMcl4D8X9zeqP4S6
-            z+u4yAZ3M4xPw9AHPZKlTJ7HGXs7e94cvXNVPgDKyT+lkCvFcU58LQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:CckEIo7zJYo5uQ58Se/yi67iaUXd4IrLQ1Op72L4BNZRDWDR9vOALn7Kt54tpBKLN8SN/5pCJkURCFUgzgF4WbRY5yNSNxMmzZ6PuALYppzbBzQetadEKMY2DvnCNypFRAf5N02nPF86Wp8a5AVBJEjxwgQBS9hPNVo4k7X2duo=,iv:+ddDScNMImUWpa7O206esJMpv3gMyaUjxm28fATNjoQ=,tag:GMGxtkdWl1cLzb82mNzaAA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-redis
+  namespace: argocd
+spec:
+  encryptedData:
+    auth: AgAMk6c3Vl2S2cdvp1C+PzaZDrGfcn34h5JU4qGraLW9/R66v2+4ik53FGXeQp9Petd5IoFGd3TfODFPz0ulPnAHZYdIWG3RiEOSilXppgwksqgPr1hI8uRm8SwCQPA/oJM0rPxLX7Yb7qkWmQ3+PSyXazlfgZNap/uf99BwO8/MkOXs8BGD8SQBf00G3HFtNLgcXRZoDp3bGXd5KTfbHTIYn1PR/XcQNw2DjxtRQF7zQOukpspE78uFV9IK8fzzyCa1y9EozXjD7w9ICHCyGw+aJV6rp+gzqxMGi5orhsA5Hr4+x7AZO3MgsQSJdnPepETATLY2zlGml3NqxEn9/hFLlQqgzDeHdzTSxjJkREMe0HRJ8+kzosHC9NaS/BTJxntDse6yg6Jav42I7pgRiGTOhWAfUk4Nczv25+Cxu4WBywiapfgmBULVqcDrhHd7PhahphT2u0ECGnshNFV6BYWZVUUvOTXo29ArUUuZKYHXZU9+9IHxhvrYAfsad9XKx6/Z5IluOR+y3BOiX0N3SUxzgh/stgu2Ms1yeD8clbKd5A+LATCUl1FqEOdzooSWCkDmj602BjhziNbCifWRAkPunNYiWXcoc+4/ylsVWbICYTX3Exr8GBxezY93E1/lU09xEupn8ZqkmTVgWRmtgFZEDZV7XaTvynbOdUYYMCwrq7yuA8rvrENGThIMb4lQ0wyRY2Axn5zpj/mKf7oh59Tac5ujV5Mko9oO7SOWp2AQ
+  template:
+    metadata:
+      name: argocd-redis
+      namespace: argocd
+    type: Opaque
@@ -1,29 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:0Dk=,iv:MBWmnkHji7VXquHkJIuzpSTHDsTmN6OuvtGq1BIyeyM=,tag:JFW/1HOaByUdx+gXE/z5gA==,type:str]
-kind: ENC[AES256_GCM,data:3xOGEszG,iv:LHUezglyWj7/zCdJtk12iBZoAO3fL7J3iN5fJgirXVU=,tag:ByU5f2TfIcPy1dvyQeiTRA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:hzVHdyJNqK4L763uoA==,iv:frXtAV6aGIKKtdBfESHTla24kqJ4tWadJyPOniZLQY8=,tag:U/7mylj9q+tdn3zy71CG0w==,type:str]
-    namespace: ENC[AES256_GCM,data:ChUXhzu1,iv:Ha5cKWFVdk1vByysEpg1weZ4APJL8mCXUhySoKrvrFM=,tag:K0rAPI1cCKAa1s3grwk20A==,type:str]
-    labels:
-        app.kubernetes.io/name: ENC[AES256_GCM,data:goqINPH4t07kdDGySQ==,iv:681ojmz83BAMcpDBZ1/Q7vh+HKGCaCsSnFUTXAmeX+E=,tag:fcjXO+BB5NNGMUPTmRODow==,type:str]
-        app.kubernetes.io/part-of: ENC[AES256_GCM,data:SLtRJ/GB,iv:4eHOqd/0FHjdNC5pAg1rRU4RM9GH6V4/28g8AcWfT5M=,tag:Y4O58iWeUi9zOrn4loNrlg==,type:str]
-    annotations:
-        kustomize.config.k8s.io/behavior: ENC[AES256_GCM,data:gU3w9y8=,iv:6Ktt02hCJtAC4WycmLl7/kHMPoAnDa7OSX32teOfcRA=,tag:xAz3NkBxInS0HU80kcCRog==,type:str]
-type: ENC[AES256_GCM,data:kkRWsfy7,iv:x8tBB4mO2Yl/By53IPgadKsmtbLXyitXs885tk4+bOU=,tag:b6yYiS1d17D8kFSE29uc8w==,type:str]
-stringData:
-    admin.password: ENC[AES256_GCM,data:n/F+kRLtOct4ZfZ8+5eQjwjLDjT6paDUSYKupAcN41+wdvdYHXEKG7xh92N5lycUYlb2FKCQUvQtQIx0,iv:zL7koqBy7j2N68Vg8MU7k7rL3OfgmS578WZIyJ3Uk+w=,tag:xjdVzaky5cR/6lP4MvlqJQ==,type:str]
-    server.secretkey: ENC[AES256_GCM,data:U8HySATKld5H+1qiY3l+p5h3VAOnA2HIbdoGU4e+rxJc0D7WVBJc/s9qqoI=,iv:nAVWcA1lBIruOKkJ39/E/2eYqFKj8KEmk8GaXYNJ2e4=,tag:XGSl3SpVbNcSeEMaavfbVA==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQm1Bd3VIU2NRU0NQbEx0
-            elRJTC93ZGNBeFVIZmxmL2ZOUmUxa3R1WVhZCkhOZnJGOVdQM3A2ZGNFTm5HK2tW
-            NEsrbnI5alFiY2xUUGlLWjV0ZFBidm8KLS0tIHBTSFlyMkpJR2JZY0lOcS9NQzJC
-            VmtYNy9FOW5zTEtGNVFhclJXejBWejAKMNd9TpbVKcMWCCbXVIIqrw2lalsiIH3Q
-            yZoCIszujQMpomaHtPgRYSBdfqa2/WWgxNO0jE9EWEClW6awOce1/w==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:41:25Z"
-    mac: ENC[AES256_GCM,data:6U5XlgHdnojCNXZGjP7bmm8MKQGgA9CJNuR+muJ87D6HQxaiCv3vii6WDf4bSkKoewZ8/NX5+ISPg+ntKra9dS5Ggr7QFT09xzL4wuDVm5StPZcUwbYeJnrGuMd0cGhHbTSCJEFnFDHk+pb4SMa3KojfNJHmCMIvzLAjmEv9eWU=,iv:PbU58ASf1ltuaoCYsg8nCk1jnlC51zmuhMoIuqnvec8=,tag:wltrBLCx3bI5vnKBUusIPw==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
@@ -0,0 +1,21 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-secret
+  namespace: argocd
+spec:
+  encryptedData:
+    admin.password: AgA4x2f8MvNXgK5bk74U6dPfV+q1Hi2+02S5jIIvfqixgkQUSrjE4P4zgh9zfPUvNn3uYaJK194MPlCtqbU/tYe4/BCBJrsOf6uFL/pnJ1GFf/C7sOjfI9SSrKuV9FdUwWNeAcpZd9qeJHPcPQ4J98xCRe2empuWKSNX/Hyox8nnSvDR/gqk4PqwJ4BTMcsML3HZbj1I7tCPmDDxdSuwUhI+yZcwhWS00mrSuks62nvuDA1QR2TW5WKpPWrnDKIxvP/TKY7tjFY9uPz/8JALSrVtbV9MXmWutecJ9s1OH/mZ7QvN2XCz3o+AtHKe4d4miB9Z3iX72CdM/cCynx3RA6MGQTLB6R0gTU3/GEWEbiqubJjl1FjxRGIw/4FO9WEWyzsr0mxBJTCNAke2ylq1Ia0KW0n8u5K9QQvQ8TGJ5XvI0QVEt4nxI6wvNedN+nRbukHpme3GPX+oK4RcnJhJKQAAsoF9PBjpPKM8lh2qHnaFEZYvfvxWqNvJt9LyjGlB3WPGEJT41M8e0ezlrijCmLzQzuyqGWi+lqNjJRdoLB3yqq5yEfK6enqzpdXiF2iUexRzXwDZGq3cNu6SOg0t9G6xi9iTP+cb7VVQ6OfYeSNfRQIXa8iHIG+09w0UlQCj9r2Qs7ucEQsKaAYxdkHmqm96Vil2Vifl+eFcy8OE4lAww1NkRGfSkFggVjfkXD40KlH8t/FziLCPTUf5n6LrVLya/vZOb6ezr8WoH3rAuludfa3YRVSw1V9B9xUcDx77D3LLzfBQWXdnqdQy5AQ=
+    oidc.auth.clientSecret: AgAeEzIPv3apBuBUR7J/z1+IRxxcSravt18amaSzQP4RHNa8fOwFsKB67Zu1uPdfLBEueMmRBbACysprHPVXpY0ipFrbGUP5IM1sVQKZxRrJ6jd4sqJZRQNwpY7EKj6EPJAhDDcW2hJtB1DSgRa7yc1jiIW3WdaThBAoYepIgRKzKOlkBnGQ4T1BMoGdcVu6Wxn6itMa4EQV4SeTVlO/ijYzVE9tDzbdjtmIH2nNXepCMIrUlqHxYTBR4GaVpTrJJrzTlouTYsYYGA1hYfnyF4yvaVU+aeOQLit57y/BcVOQ6HYtyNUQlXV6oP3NEzDz6xvt80H/PztbvI7JRtQXXTNdcBam+v/m7jT5Nfz5gf5PwtTCKjcO1oa79E3X3EDJ8MNOo9Nd7CBOdcWgqp5QdsmgObaHbSiuI+XiJILoz4m1lk53Bm2cNPcmRP19uKIhzh57RARhAVDty82qcev9Zy7bwulfm0HGIV9qzWsVvSltnpWK7jNsHvK/T3uvwUqTi0N8w9JleHm3jBa7Tr5WoA0+Ekx1AjQgd5sRIlpHraPjcfBNPBbsrQWj81R7spSGfJ3BbrsNuCBvn46R4UaBhpkoXcJqQ6XBqQMgdTSZmot5yWszNy3LidHxbF8IB7VFJobhUjmkXY930GW24hj1tw54bATdqZFCn7jS8psWfn47A3N/J37mNR3Aqd3If/+K+QjFeMdMnmgWF9BA79/oIxcMkcWRxjw55F/y/hKmcMJrYNdUvlC4GTHx0y4wZ/VlPwi6cnzki421mmdulDw8alBt
+    server.secretkey: AgBQSgd6B35KLuAYQwz0awzOi5YeFTuhpgEB8aUcC6jHBBnxu0pktEnDOZhTt+6oTdOnh+NwCYP+5NexkEPwe8fs+POXgfy4cXeGt05M5P4T+P9gyrQEdiStK+jXv/Pu0msMgjK3GNYiB1nOf7rSHWRgWb/SE/nJEEvnPgUZ02TRJCyQ6x3Zp/8urYKudwYgGCDJsu9QxDJFrwSREI6CAdTVZCjTGk9JZS63U+h/4jsbey5Eb0zkzLz76mFd0jmTDKDC9WOWV3tBXYa4I69bBSAIt7a/ikqTgjsbcSCd4T8GMHSr/jXXarzYrtbVkCRWMnf8NDoUxj2Vm4k4i30f2vlp1qFJeT+ixwDcavlgmOgwsoNhbwGIsx3ssdsGtAm2Li32u9CUauHMSebpHuCthqFRoWIsKVRrNPdbSpfgQKop5Cx9ITk74ENNcvgC7gfgfk290xtpoVga82RceutlTPLzfwh+a8hjQDj/pLEejG+JeqV/gSDw+tWTQoGmyGt6fA1roWeTSj9v0hHypS87LxYNMyK7tJBQyoq7VIrkIjS8PQ0B/zBlJqiGMWuaPAijVymr8h6FRMftJXFZibQ4n2NednEZEiNAtQhXmMbR1IxtJmDXMyhIgj0YkzoV5Nj8Q7BEp45JuI6jRwKPjIlgEGLxBoHFp4fCsr7edrrbDMiw7tbtudUkMvkFcuNSezixlPfMJBD4Hw2IYQEgIKzou7ECiEh+sq1fKHl2eqgJddTS7HuQxkUEeIiHDq1H1w==
+  template:
+    metadata:
+      annotations:
+        kustomize.config.k8s.io/behavior: merge
+      labels:
+        app.kubernetes.io/name: argocd-secret
+        app.kubernetes.io/part-of: argocd
+      name: argocd-secret
+      namespace: argocd
+    type: Opaque
@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ksops-cmp-config
-  namespace: argocd
-data:
-  plugin.yaml: |
-    apiVersion: argoproj.io/v1alpha1
-    kind: ConfigManagementPlugin
-    metadata:
-      name: ksops
-    spec:
-      version: v1.0
-      discover:
-        find:
-          glob: "**/ksops-generator.yaml"
-      generate:
-        command:
-          - kustomize
-          - build
-          - --enable-alpha-plugins
-          - --enable-exec
-          - .
@@ -1,16 +0,0 @@
-apiVersion: viaduct.ai/v1
-kind: ksops
-metadata:
-  name: argocd-secret-generator
-  annotations:
-    config.kubernetes.io/function: |
-      exec:
-        path: ksops
-files:
-  - ./argocd-age-key.enc.yaml
-  - ./argocd-redis.enc.yaml
-  - ./argocd-notifications-secret.enc.yaml
-  - ./argocd-gitea-token.enc.yaml
-  - ./argocd-secret.enc.yaml
-  - ./repo-creds-internal.enc.yaml
-  - ./repo-creds-external.enc.yaml
@@ -6,8 +6,13 @@ namespace: argocd
 resources:
  - ../../base
  - argocd-cmp-cm.yaml
-  - ksops-cmp-config.yaml
  - ingressroute.yaml
+  - argocd-gitea-token.sealed.secret.yaml
+  - argocd-notifications-secret.sealed.secret.yaml
+  - argocd-redis.sealed.secret.yaml
+  - argocd-secret.sealed.secret.yaml
+  - repo-creds-external.sealed.secret.yaml
+  - repo-creds-internal.sealed.secret.yaml

 patches:
  - path: argocd-cm-patch.yaml
@@ -17,7 +22,7 @@ patches:
  - path: repo-server-patch.yaml
  - path: disable-bundled-redis-patch.yaml

-# KSOPS decrypts secret.enc.yaml at render time.
-# The presence of ksops-generator.yaml activates the KSOPS CMP plugin.
-generators:
-  - ksops-generator.yaml
+# # KSOPS decrypts secret.enc.yaml at render time.
+# # The presence of ksops-generator.yaml activates the KSOPS CMP plugin.
+# generators:
+#   - ksops-generator.yaml
@@ -1,28 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:1wE=,iv:ficrVUo+uP8C5J/iXKy8+h1O26XVRDOI+ZYK0+LFbnY=,tag:Nv6smBHA9KXzCV5V/xMhdA==,type:str]
-kind: ENC[AES256_GCM,data:ROFGmJxz,iv:pT/eVSwFvFU7Yh7jt9KsT9ZUXPgt2YI8w0miXjqg9oo=,tag:qIv3AetT6B/68sP52OHXOQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:492q0gdP9XAl01Xpdr0JSRWqRBo/4UTuRQ==,iv:t0dtGisAlzR6REQEagDs7WKvNkTFxvd69MhxKE1wsUo=,tag:WSlH05eYMLg1vXahnGvxsw==,type:str]
-    namespace: ENC[AES256_GCM,data:eXTVlw6u,iv:xfaxh28LpCSIAplxZ8epORxk0jbkkceYMNs5w9ojiYU=,tag:zR/OVbIyJzlu9ZtYaIyfTw==,type:str]
-    labels:
-        argocd.argoproj.io/secret-type: ENC[AES256_GCM,data:2vzzPNyKXYnPxQ==,iv:JIzBGW2vIK7v507zFSmfHsQigZsw8ZQwBWzsQfqEvqc=,tag:qt8Kp8kB5LGxE+TDNNnVSQ==,type:str]
-type: ENC[AES256_GCM,data:J7FpF6wc,iv:GZYqsHm7NYGVYwDEzrFI0Py5xjGQ9IIRm4Ms5FYZIqM=,tag:WaCIIDDK8K9fKhVw/CWuqA==,type:str]
-stringData:
-    url: ENC[AES256_GCM,data:NDdACSJI+bnYwZuVXbfuCDpoyrX6jw9WMcrd,iv:IYQCC5G7/uPqPPeusrwcEjNpD3M4zrFcyecMejwazu0=,tag:1gy+wmjSKmcfhZZEVcWdVw==,type:str]
-    type: ENC[AES256_GCM,data:Yssu,iv:s/VoPna0rykWa0Yotl277UYx+SQfTOl2MQocQDdXaiY=,tag:m7yYbCGFiTAsSRf1nD/89w==,type:str]
-    username: ENC[AES256_GCM,data:TBk4XpEi,iv:CDjD/YwCFCeH8zG1dXIM8UwbTWwkpL886NWdXp0/nIc=,tag:nLyX1vFRCDTe/qZAtY3EtQ==,type:str]
-    password: ENC[AES256_GCM,data:MUnIsZIwWrhlNiqw+gy8tJrXyeMIrVFef3muGflMJkNve9amPMqPpg==,iv:PfCRY8eVhRCO4ysRdgH5j72kT4RF/kthGdAgedxHiUc=,tag:9FN5cgxFouJ9/t5nLeuFEw==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPdmRDdFFNby9iV2lFVUhJ
-            THEzOElYRlpTSVNtWldKSzhYTmJRdnorOFZJCmIzSVgyZiszWURMckxrL3BBLzAx
-            djhpL0o5V2F5c0ZjaHQ1TFlqYm5pZGcKLS0tIE9RWXJaUXdKK2ptdlJ3cTdyUnBx
-            c0tNUStCTWtwNWVEN2Mvc09QdzhRWlEKjZUDiIndwFcXkoO19bjaSxcJpOuwt84k
-            52pIF+PX+mrQIxT9Jc352ZZ0dw/pca/wy3/t9OzCOw9shdVUyO9PGw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-26T17:28:56Z"
-    mac: ENC[AES256_GCM,data:vmQNle032FXN6zQ/KEiwFJKQZKPoLCHEjrn8w4Kdk1MEohK3i3NnSiyL3vut1TYhJGIKTHNMDTP/+jV0oughkQwM3eXMOStF7IE2Lf4Rq0CRA1YcMOVUQvwJ4wwT8O6DwIBCtZRlfT9Na/4RevY4yvk29+gR5es4SLvf8UAU1fo=,iv:RFKitAjWfRrAtNyb3fqFba3BoMoHniES6IDCJbuyDs8=,tag:3apP07EpncSCOkw1fHskSg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-creds-gitea-external
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgBWn1SRqyssTnLmLR4EaINdP1uQJiiQnnc7/cXhewbEc0Jk4sLLVgb6AKM75aq8EwVmK7mnjPGSjWbk9yBQ2OC90XAfBw3onqmp7sx7wcJcVJKCmfcNrfRf7MjLXUt5S2CxtxsbvXdRRHmEwu6DvsajErvBLMxEiJB0uSyLsraM+uoZGLsiU+nAjC81vRP/aFMne0hFg3/3SrbE8rAKRnTkuUr1gysEZc/0RINR1H7JpzcBtsJj8VVdlAKv3ZT/SLkg7ecvM3WfNFoBgZSoWro9S5N1m4JZFu+AazJxRkYL0mk1YdDOLcgcWE97uOLvfCbTVJwXt/gI9Mpv1ZgYH0x3gJN361FwcNsRTHrRovR5GvrO56Eo2xcjGuDte5vorqBee+tnLIATfh6Myi/0Xq7/KrD6E85LpHuOZ0zKqp2WIm0zf+K5Qek8QFiMoCjEc0JTY+v1acOkSAGdd9m8WvEESjC2o+UJLpFDszPCwen3EJ+Zak7ZWCUJNI1h5bwSDpf/7o72Iw2DGJTlWbKd4jpZSTk/njebdj5fSn6YDl5lDN08nSq4K1xEn9fyBDm6p0RgnYRS06HhSzvDh0hNc1tUqmgdsSLmUj+yf9kCaU9sqBmC/3aFe7Ug7c478Jphszam5Pl0dgWY/RJQOphbcqxhzxrNdRfBwiZkXWG3O1GsLuEK/z7ihZjb7e9UVtjZZDmrLtahFKP7JypDLJjvWOZgatEyGmhASJTL3bOeh4HQC0b+P958z/pU
+    type: AgAD1bzjj2lwlUv0ldBi57e4qoEov4Xpyek/r0lKvrGlXqCb5wden52aL/P0Qn9gCi4ZAEksymBd1khVEonPzfkLpdXkZDZP4QeNUaO+SF6moycXk7IDjurhf/IFNEMKu6R0vZ59TqZkxzaUn7ldLvHU2zsacw3OnoGImvcohIw3MrdRylVN8zi7MDFdmR3wD+bTkyLol8uJFYRqtGKCQvKoPb6F7TkSs9RofTF6uqxS/aNJNkgBw9Kj55EP9VQ55Z+vqclRQE7NT03Wp9gXSg+a6dWzKIF6YHE9pTXU9BpqHU++WpluEgN0TrSUOTO3lUalXX/jZ37NTKDoEbxZLppGtVZpfkofx1fTWaW8Jusk+luBbEMlDNAeynKS1P9k09VyRSoxBYqzT7XT4+HWMwkGLYXZ0sSvkP72681C5iLmuY3+noLM0Ew8WI4Rbrc9i3HCM1UM7wZfvx+INVSnVjyyOiJSnmrZEXUvLoxA0ivW2rf4O6saH0KKAujvdBi7wx4VeoDqhBdRNoMaXEbB/LawxqvhvvakC4SpyByb5DAyeQ3DeraOAU0AbVLEcZaSVohAS2R8/ECFRTbgjkYOtZ4yBfvB84nXkiM9FKVRIRyUxAbDW9yZUv2oTXfbpbQHmYaaM00OJH732fn2EBZOJSYWvkKNdgDZlg0UDZalKHt/iHA3WL+ZPcio+bAvprEDY0Jypig=
+    url: AgATolwThJhFEfmZSdGYrJJbalF736jGCKkV5JEAZorbQmVuRe2rFKBWCtcoYoVbz8TuYnDadzUrFxRc79VfOlVghYduNq9GuCph5zAoCAeRqQOUQLmsQy1Lcg/CylH9LWQXbl1VjPZZLaDfpDIpkyikFQADwfIO5/Ab/U+8S22R5M+Uw8zqyyCkPs32iAMOTtYGpecrVlbFGxR4T42g3dJksH28pt1zaoycq9N1cAwFxnCFznaIul3XF7aNUgNflHFvmnqRsSYsSynoOgBsKJA1OERYHCAmpzByQmOQEjtKBHlFFrFZTz4PU+yIqUbg4HAKFgC+0l/saGBCZ70n7IPzmXIzq4rG332ArSf824+vwEjTXpEmy24aYguQls9KmMHQVJT/7L+1JKEZnSNg9GXT8E1mh2jIfCa/oRWiAWK5n0kogV6cIc554bMkoSOJOn4U9zecE57SmDoXbeHhyu6L+Au26X4UgdwkuD7EhfT1Hakb1ym5KoQPd1wUBCSBN9InZ184gVOqE7jSX3CbdE9YVoEz1vJsaamep3hmcWzCMfIlKwrfxScvPQ9RCvYB7/yq0D/lkQGe7ZX8pc/BLH04txjlkA4krEfSlmNa3oHl60oikmeQFbD+mzLvpcOnN7ZdwI21H6uKruSMThc814goQAKYhVgFHUToTJfNu7qso8/lfLFFDJ9nBz/RU04MS139KBfBocoR9G8PrjOxGcOQC24+UB+rDooXb/I=
+    username: AgAZ9K23111h5j+X2cg3kYIh9gH5AURCxKdjnpWsRISe6r21pxHsSYhdOp1WPYqYvEA4WkzVaT2BItoQVFWKyc89X1Q7L2Vp1zMmMHeRF5odc2sFZR7VzK83NmOIZjU3W17RcY7HIuFV+y21L28Nx8wortbQVV9/3s6k/vRsRWaR/IdWCl+4+ofsrBntTZPUbMct9t/b1v3ynuq0/gJiXGJ+OyhaFW537cvSrlUV+EMjtYRe8GsNHjxqfK5aFxYav7DjLHkzW7A/lX7/mlSRS6z9xX4K04gQKyDCjxY9+tfCiSM4wZmoEpUFY/5R08dHwcmpuIgYvEEnB9JdCzFSXzOg/7t4qX3QkFkQOAdYYB0Zz886m0splTrmPeEVeUXOV9KBrWi3kFcXBJqMfmWElZ5oJFlx/NdXLjXhb98dccXC4pS5HIBEIrGN548BjsMBx9mvGRJrE5Ydw4n3NwYD8YuO2yto1s70EQaaTP+NRp/CP2ej0v5ggcyBg4H1sgt4ub2IEUkOSp9Ay49h1Argx0y1rgJ23kWguNwKNTYKaT0NL1sw66ZmW8rWoxijpTDXKzFZyefCzJfVoMhUfqLymVW9/O3Swka9qGwIE4oMCnBHS6u9niGqZAIiJAxtvQFltfz2fY+S9B94AkfcPDrlGfZ/kt3/lacmyjEvafDX7SCkAHKKG7aBBUBvQ6emVX/LjR2smJNOHyA=
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repo-creds
+      name: repo-creds-gitea-external
+      namespace: argocd
+    type: Opaque
@@ -1,28 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:4aQ=,iv:76qiONBk3QpJ7Tz60YNpHgxebIlzMsDhS6k0rw6v8ns=,tag:auUNlBQuYen3MpBnTNR1Eg==,type:str]
-kind: ENC[AES256_GCM,data:ormNIbHH,iv:4JnS6tLJKeAecL2rbX9umKpEGvcsn411+sO8/wtCakc=,tag:adFmPv6raMnWaVdikPjC0Q==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:yolAoLPQ3kK+iVyLFxzipmy+A+xHig==,iv:yI6O2s1jTzaSKnkKTEt7EVLzAmfIjd/ekvcpdz0NRTk=,tag:dUt+A5DGoSf5z76wJTV46A==,type:str]
-    namespace: ENC[AES256_GCM,data:bcPmoGEm,iv:Zx50hY7eG4jD3aYzTiUyEunAd0tVILlmJ0Hf0IaBYO4=,tag:5EUNdJE1l0FmpHO2w/bJlw==,type:str]
-    labels:
-        argocd.argoproj.io/secret-type: ENC[AES256_GCM,data:/QstfuDU9t3Ixg==,iv:vk7XQ/KQeMYL0QnWhu2a5PikU80hPRG1BqS4CBUigCs=,tag:GMDiftPBtJOa1ZrnEyJixA==,type:str]
-type: ENC[AES256_GCM,data:HEnT/QcZ,iv:miDP2Xk+g65eeZ8pKSFFXILSDcJmer87Oj8jOLZxeE8=,tag:Z9DhDdoxQL3rIZYdvvw72g==,type:str]
-stringData:
-    url: ENC[AES256_GCM,data:c7LN77QqOmMKGqJWRXL3u0jgGIaGxn3cSUIPETI8TUnzR3s9,iv:d+hiyvEq+DI5nGryHeKYKd/4H5rngcGg69UPY+w4Qms=,tag:1n22xhONic3Rzmks2H+sJw==,type:str]
-    type: ENC[AES256_GCM,data:59g7,iv:n3g1uxZSUmxRTuDB2vz07vhZlOCag7MUqywwHi4mhOw=,tag:qZjthGZ+oxuEknHw0zDgfg==,type:str]
-    username: ENC[AES256_GCM,data:CnszfxeQ,iv:8lUSmnZitX8TKKAn9CBUocGZJqRsa3cUknywk96u/Tg=,tag:XTqipJPG5e3f/yeYotHc7Q==,type:str]
-    password: ENC[AES256_GCM,data:BBxrsEYlTGtgQKxrixLrMg2GdOOdUzKdF+it2A9ryrEOPjDN2cLzXQ==,iv:nvls/EJ+P67AlyNvVs2w/1b2h3NcKGJQHf6/0AakZjU=,tag:X9abzAzbUJLcgdSWwmlCjA==,type:str]
-sops:
-    age:
-        - recipient: age1s0gzgh8c00tgnkgxrqyz2nu0k56xvc9ev3jdenkmu90egux9xfmsxvvj43
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjdXVCUnFVL1c1bzVaYXVh
-            SjVlb0t1OE5zc2Fpc3lnQXZYSGkzWXl5MmtRCmUvVGNsSWcyd0pIVmMyNHFTaERj
-            ZEp1T2U3OURNL2FiOGlyMlBVdU1jaGMKLS0tIHpDSThaaDI2anl3UXRZU0VnZ2dj
-            cDlzZ0I5Q2Z5R2dSZnBUZXFaRndjY28KGEMm55rzNJcUm0/F39f6zg82WUEBZyY4
-            7Ckmw+ZzrN0tDg8mTvbRpPdubZUSKqPko6LPpx7LK178uAuVBsARkA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-19T22:38:11Z"
-    mac: ENC[AES256_GCM,data:d9ZJON0ZhuU/Ols5YYYvRk/fHuzHG3p/JEeOB1jTA8E97sp8dQAHpd6dkBU7YMwKdhYnYkcpHIh1tHn8VHu9SbDtCH5yqTXzQk2cE+b9YIrDkNMLstkgKdHUv3kZXOLq3xlH9STGXcX43/4jFG+nwUlCMgmxhLVQPIv4/yWooME=,iv:f/NqJL+sdACShLdstQEAfa5IwMKmN8KEVQSqTCi+5LI=,tag:iExFIJMOBLNoubp9HTsPjg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2
@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-creds-gitea-olb42
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgCSnvBOzWdB9MFodhvIzUanfLZTV7/EPfctf/7cP8/WR/nh0apNfjjRUBT8hRZJMNs1FYIoWHGJarbea4ccrLL8nZQS9bOE9RjXoTcfVhRrs3WUgL2D7bfwfpdOyi9YjIcuruPmLy9A1urkLPK07Ys0wBz3OEAwU7xFXz7sBpuCGW3aWbJlrtODTycY/HKZCwQCCG9dsmqSmn5I/pCAWHWjZ8Ylrw0ZR3LNyvpUAdAmD8V0SL2qdAby62aZboosppo556X46NL2FhzJIkCh/p95Dg8+dBVjNzJWlfOEdPOwzC5TIiqGxEkY+TWw3KPIhPvmo3nQupxPKAAUVqUmidHc4WRqWzHOhfQrsDDehiFg55LqujlT2OFxaWDo2lCduuX7+Ljhq6PZBt7B/+ShixqDcrNy5Aa9aO1GU8nmTiCfl6R/c6T517ikOc3Mx9NWPUS13WVIiYEHUmzGEyyAXrTuaSV3Vhy6ePFvevIaDKyjroBc2s+O39OyxbS58KS/sTQoNhFioEmrZvIUh0QmiRLUpyxtcQRATJ3+sR0296kWuHwzRIuzORCOiJDaEDqxKb5Zekl/wfgDXjb6IBlEQxQwF2zURXHhTpjJq3czmjAZbSgNX26K77ltDJWicWfXrNRzw1htQ9qsC0LklXCjCtNdb1yV97SJsM/cvWNR9K4mllxs3D9eM2J6twn6Bv/I7/cmSzG7IHf4MID/YVrMGCoGGbDw9ukuh4Xa4POWdKiFX/BHY5RbTVBT
+    type: AgAtNwA2NIdIv4kb8SOmZKkSgpkqnwd2Pp4Dr70fvLd1lBQQia0Go8V+SG7DEaHzIdJqDHS4r9rk29DoiU57sH7s7g8AG35bP0/d2KNGCG3F9ZIV9qp1sOJzi563StHIQD9mTvxsRoI3AV+Y3yD+hHDDgIGvBmAv5A4zwbFkT4pRQxEa+eljBLoThryoUaV4OAW/nISp4xS2yn+54XfYHBPCcb/nuNDPDESNQUm/SSu10so0O55wi5PUuwWgGVlHNzbJiydi4U7PO+HaTWuASufpt26tJkXyBkbYP+ifp3DTToYwFQzzd8kHPfCN543RmlMX9/yjuU8jzCEnhL/yWmA+acVrXPmTEyoJrACACHr5PuVPCSP4EvfDMjEtDFVb4Mpj9Ufjznl+Nr+lWYrwV3OG1C3gVQSSnbvSN55lFrdgjmNbjI0oDfjKGepGvtJlYWxfAkEw9FO/5/Ax5pZnWAvCITA3VTeaQHOZF3H1N2fvTl+3lQc8go2hMJgtE9XgYBiNCpxH+V//gLPMKUgGK2PnqZMd1xU3dfPEAoGKXtgfpQE6wGxE3YGSpXIPXZd6CxXCvmEvMsqqWnIl6RwNa65gDaYttlptHgImp5u2+wOM/NbSHjARCd8MK/gimLXBmNtN/wGadVoYA5G4gS5HeOElOF1Q2JYvz5fB2FOnSHZT62h9HrVUa63/jGnd/X4u+34Y61g=
+    url: AgCCzBlfjQs4CbGYj7R35Gb997homqFGc/f5CILQYgA+ogGC4aIv11iq7c9OlJyJ0t+8VNoZOnaJ4sBHG6SbqtGc3U0ugqwca1zYWB2ZfwzagZeCVOCfcHWcQXK1UuJ7z4PNiFll0NMjs12+mwEFovGNYRJ4Jyh93Wx5muGjn4YLe5zDp5DVRme9E58PrIJJgW2KBEAAPPAy8EDoGgPA3VvULUCs1MSUiAos0SvHYKa8sZ77wNWkxl82wvYi9tBEGO0CxWnKJm+UspFBkhLX7UKcXAQ8yAdb05DaNKaQYTHZCkDuba2rMev4gJFEt4/OKu3Kl3PNvOTPonh8OgfA+/k04C4PVBCOBcFXCL2oYt8K+1iulpbmv6iIcwPg2Ek9HoXD7HJcodcrRNsErTO5qNympWefGMzbGLoM+Ya7Zbz7UbFpsX9kEWl2lH/AFVOJ7cu1kJMqrtPyPF633h6dBhBzjbdY9RVl8hAqjosae1HkFtiLCjwNYXS6/Fck3vbg5BQYIwWre0Zqq2MujvnpcngOgah5weoMLx8jDWiIgYRP4glChpKwRWs7XBjEq3/6aZjWUcmNp23+uFbTGc85wUxe5C7Iye1SeFIr9+vR/Z57I7pY08kIPOQXznBb/GCwTyhK06MujGvganU6K2mOJX6fpi56IkN5jdSSKVyFsOJ084BVx9H04pLY6HB5gl5pTLrRylhJdHjL8fbQMoiAKWIs1ej5nr5HQOUgX4AqsMTBEtWrdEc=
+    username: AgBfdvyg4zvYcqInD5ZV5mjkeE6OmYE507YFyYaL8gGwuoKjY/S2spLMHPhGOalbIMzFPL4jIiR7sOdbbR+9ytCZ20GvJGIMtFUZa9EV/4/9b3y2TaSqahENpBh9b+HyN6rkCXE3Tm6uArjHTs0+Ky1J+xfvqkSaCi9G3npJgRxGCrvtPCb4Bvy4fvq0byeu4/oAvCSgHj1Rwmnbi/U9JpqHlRpV1QNqA79PvKKEuM9Hr1/8qHsqjgV9djoe7O0wNlrgvBpkBrk+GHN9g1bfVpQcUTOYgjMN09iBVPYDuDZ8sY3gGaw9OSVYxczSZvBM8Retinwlcqc6AxrZ4VhP1vfaSjMWX/moszeFq5dXcW7AUwDhJCV8ppodi93Iag/oYAX+8Gg8OHrrzu55epjA9G1Kht95v5tV6ROo3fafQFizg+jmafruRl7r5VPIjn/PYBY2m3ETkxY5AFI8x/xHjw7WL/Ehjbk0isCqsLs0tP86Nl8bOOBWckCiM4jcBzFN+KpkP3kwlcgpGNbY+o1I0sW4eydjl2GOXYRqmoMmwyXMaVNzMRQca4MKf+jXDeT6PdP/vB/zgds165OB2X1eeKVfgeU6mLBjSW7ZBLf4kJu2afMoPUW+MhOghCd6h274v4uqdjMySt9lvUVNs8Vit10++nOpd9p60whfPhEC7U8LNHXiY0kj3STglFcsMHZ2uavFG4KJ8yI=
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repo-creds
+      name: repo-creds-gitea-olb42
+      namespace: argocd
+    type: Opaque