argocd で ksops を使った secret の復号をする

# 鍵生成
# この後使う sops はデフォルトで ~/.config/sops/age/keys.txt を見に行くのでそこに生成しておく
age-keygen -o ~/.config/sops/age/

# クラスタにsecret複合用の鍵を登録する
kubectl create secret generic sops-age-key -n argocd --from-file=/home/HOGE_USERNAME/.config/sops/age/keys.txt

# secret の暗号化
# -i で暗号化したいファイルを指定する。この後は git にコミットしても良い
sops -e -i cloudflared/overlays/PIYO/secret.yaml

# もし複合するならこれ
sops -d -i cloudflared/overlays/PIYO/secret.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-repo-server
spec:
  replicas: 2
  template:
    spec:
      volumes:
        - name: custom-tools
          emptyDir: {}
        - name: sops-age
          secret:
            secretName: sops-age-key
      initContainers:
        - name: install-ksops
          image: viaductoss/ksops:v4.3.3
          command: ["/bin/sh", "-c"]
          args:
            - echo "Installing KSOPS...";
              mv ksops /custom-tools/;
              mv kustomize /custom-tools/;
              echo "Done.";
          volumeMounts:
            - mountPath: /custom-tools
              name: custom-tools
        - name: install-sops
          image: alpine/curl:8.12.0
          command: ["/bin/sh", "-c"]
          args:
            - echo "Installing SOPS...";
              curl -L https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64 -o sops;
              chmod +x sops;
              mv sops /custom-tools/;
              echo "Done.";
          volumeMounts:
            - mountPath: /custom-tools
              name: custom-tools
      containers:
        - name: argocd-repo-server
          volumeMounts:
            - mountPath: /usr/local/bin/kustomize
              name: custom-tools
              subPath: kustomize
            - mountPath: /usr/local/bin/ksops
              name: custom-tools
              subPath: ksops
            - mountPath: /usr/local/bin/sops
              name: custom-tools
              subPath: sops
            - name: sops-age
              mountPath: /home/argocd/.config/sops/age/

configMapGenerator:
  - name: argocd-cm
    behavior: merge
    literals:
      - kustomize.buildOptions="--enable-alpha-plugins --enable-exec"