HOMELAB-966: feat(sops-operator): Helm values + age-key bootstrap runbook #185

Merged

aaron merged 1 commit from plane/HOMELAB-966-sops-operator into live

2026-04-24 21:47:01 +00:00

aaron commented

2026-04-24 21:45:46 +00:00

Owner

Summary

Introduces the isindir/sops-secrets-operator Helm values and a runbook for its one-time age-key Secret bootstrap. This is the declarative replacement for prod/scripts/bootstrap-eso-secrets.sh, which has been the corruption vector for source Secrets in the secrets namespace (HOMELAB-959 null-string incident, rediscovered today while unblocking HOMELAB-958).

core/charts/platform/sops-secrets-operator/values.yaml — cluster-wide watch, age key mounted from Secret/sops-age-key-file, defaultEnforceOwnership: true so the operator takes over the existing same-named source Secrets.
docs/runbooks/sops-operator-age-key-bootstrap.md — single kubectl apply that seeds the age key (same tier as the initial kubeconfig seeding).

Nothing deploys from this PR alone — the ArgoCD Application lives in the prod repo (separate PR) and only starts reconciling once that merges.

Test plan

Merge this + companion prod PR.
kubectl apply the age-key Secret per runbook.
Verify sops-secrets-operator pod Ready in the sops-secrets-operator namespace.
Verify SopsSecret CRD registered (kubectl get crd sopssecrets.isindir.github.com).
Follow-up PR: migrate the 12 existing SOPS source files to SopsSecret CRs and add a source-secrets ArgoCD Application.

🤖 Generated with Claude Code

## Summary Introduces the `isindir/sops-secrets-operator` Helm values and a runbook for its one-time age-key Secret bootstrap. This is the declarative replacement for `prod/scripts/bootstrap-eso-secrets.sh`, which has been the corruption vector for source Secrets in the `secrets` namespace (HOMELAB-959 null-string incident, rediscovered today while unblocking HOMELAB-958). - `core/charts/platform/sops-secrets-operator/values.yaml` — cluster-wide watch, age key mounted from `Secret/sops-age-key-file`, `defaultEnforceOwnership: true` so the operator takes over the existing same-named source Secrets. - `docs/runbooks/sops-operator-age-key-bootstrap.md` — single `kubectl apply` that seeds the age key (same tier as the initial kubeconfig seeding). Nothing deploys from this PR alone — the ArgoCD Application lives in the prod repo (separate PR) and only starts reconciling once that merges. ## Test plan - [ ] Merge this + companion prod PR. - [ ] `kubectl apply` the age-key Secret per runbook. - [ ] Verify `sops-secrets-operator` pod Ready in the `sops-secrets-operator` namespace. - [ ] Verify `SopsSecret` CRD registered (`kubectl get crd sopssecrets.isindir.github.com`). - [ ] Follow-up PR: migrate the 12 existing SOPS source files to `SopsSecret` CRs and add a `source-secrets` ArgoCD Application. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

aaron added 1 commit

2026-04-24 21:45:47 +00:00

HOMELAB-966: feat(sops-operator): Helm values + age-key bootstrap runbook

CI Review / pr-title (pull_request) Has been cancelled

Details

Lint & Validate / terraform-validate (pull_request) Has been cancelled

Details

Lint & Validate / yaml-lint (pull_request) Has been cancelled

Details

Lint & Validate / shellcheck (pull_request) Has been cancelled

Details

CI Review / helm-validate (pull_request) Has been cancelled

Details

CI Review / ai-review (pull_request) Has been cancelled

Details

4c84d7cb3b

Add chart values for isindir/sops-secrets-operator and a runbook for the
one-time age-key Secret bootstrap. The operator will replace the imperative
prod/scripts/bootstrap-eso-secrets.sh by reconciling SopsSecret CRs declaratively.

Values: cluster-wide watch, age key mounted at /etc/sops-age-key-file/keys.txt,
enforceOwnership=true so the operator can take over the existing same-named
source Secrets currently in the 'secrets' namespace.

Bootstrap runbook documents the single manual kubectl apply (age key seed)
required before the operator can decrypt anything. --from-file is used
rather than --from-literal to preserve the age key's trailing newline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>