Kubernetes secrets, third alternative: peak-scale/sops-operator

.gitignore

@@ -21,3 +21,11 @@ talosconfig
 kubeconfig
 
 .agents/
+
+# secrets/clusters/ holds only committed .pub keys and .sops/.sops.*
+# ciphertext — a safety net against a stray manual decrypt getting added.
+/secrets/clusters/*/**
+!/secrets/clusters/*/**/
+!/secrets/clusters/*/**/*.pub
+!/secrets/clusters/*/**/*.sops
+!/secrets/clusters/*/**/*.sops.*

.sops.yaml

@@ -13,6 +13,31 @@ creation_rules:
       AAAAC3NzaC1lZDI1NTE5AAAAILkFKxaxcAS/tQuS8Gfk8xaHSLDAm1VCPHo8M7umUdVJ 
       root@node1
   path_regex: secrets/hosts/node1/.*
+- key_groups:
+  - age:
+    - ssh-ed25519 
+      AAAAC3NzaC1lZDI1NTE5AAAAIAcnmLrPeTJeKsasfU0qn4sP4lBNeOUgRG4iZDS8nyEo 
+      kid@vulkan
+    - ssh-ed25519 
+      AAAAC3NzaC1lZDI1NTE5AAAAIHIM3nsk3HxvEcplSqwynh9V2NzlYdI10mrR746SiJZb 
+      kid@fw13
+    - age1crlwx4k0eaq666fa8dqpq3k9rhkm8qvwf3ewuum8s8hmrzrm55fsl3tk8h
+    - ssh-ed25519 
+      AAAAC3NzaC1lZDI1NTE5AAAAILkFKxaxcAS/tQuS8Gfk8xaHSLDAm1VCPHo8M7umUdVJ 
+      root@node1
+  path_regex: secrets/clusters/prd/.*
+- encrypted_regex: ^(data|stringData)$
+  key_groups:
+  - age:
+    - ssh-ed25519 
+      AAAAC3NzaC1lZDI1NTE5AAAAIAcnmLrPeTJeKsasfU0qn4sP4lBNeOUgRG4iZDS8nyEo 
+      kid@vulkan
+    - ssh-ed25519 
+      AAAAC3NzaC1lZDI1NTE5AAAAIHIM3nsk3HxvEcplSqwynh9V2NzlYdI10mrR746SiJZb 
+      kid@fw13
+    - age1crlwx4k0eaq666fa8dqpq3k9rhkm8qvwf3ewuum8s8hmrzrm55fsl3tk8h
+  mac_only_encrypted: true
+  path_regex: manifests/prd/.*SopsSecret-.*\.ya?ml$
 - key_groups:
   - age:
     - ssh-ed25519 

flake.nix

@@ -46,6 +46,10 @@
     };
     nixos-anywhere.url = "github:nix-community/nixos-anywhere";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     treefmt-nix = {
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";

manifests/prd/apps/Application-sops-operator.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sops-operator
+  namespace: argocd
+spec:
+  destination:
+    namespace: sops-operator
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: ./manifests/prd/sops-operator
+    repoURL: https://github.com/kid/home-ops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

manifests/prd/cert-manager/SopsSecret-cloudflare-dns-api-token.yaml

@@ -0,0 +1,46 @@
+apiVersion: addons.projectcapsule.dev/v1alpha1
+kind: SopsSecret
+metadata:
+  name: cloudflare-dns-api-token
+  namespace: cert-manager
+spec:
+  secrets:
+    - name: cloudflare-dns-api-token
+      stringData:
+        token: ENC[AES256_GCM,data:hQzD38Hx8LeIb8zGwOpILWKFNk89o5vazC0y,iv:XVZXDEinyf484QxrBFM62yyyoBpNk30D90WhG7TKZuo=,tag:McKm0itp4fqzySNfb05ygQ==,type:str]
+sops:
+  age:
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFE1WkIwUSA5WnlT
+        NUE5aE5uV2QvM2V5Q2t4bFpMMHNKL1FkcG9acUdtdjY4aHczQWhBCnZJcEZuUGVt
+        d0s3b21VNWMrWWxDbk1mZXYwVWlkOHVLa09wdDhaaVdxUmcKLS0tIGZNaFFXUE1P
+        UXIxaWtLOFJqMk5aeURJUkdBQm4yTkFINVVCRGcyOENDMU0Kcjf/yljRtARGRS2F
+        lwaFrKgBVsgXkrlELE7N/qsOm60tcxIUrNAGci2DvKTgiwbSzopxnjHp11sR9v1u
+        +yqQGg==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcnmLrPeTJeKsasfU0qn4sP4lBNeOUgRG4iZDS8nyEo kid@vulkan
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE1Wa1kxQSBjd01M
+        OFphdStaVGp1VzZtSi9xamFZVXJQMzZXQ2VQWEsyS0pUNEY0ZHg4CkEvUWoxeFJt
+        MmZsWC9DS28rUmMybGxVL2xaTEVtbUF5cmNGdnRHcVRCRW8KLS0tIGYrMTlFbXZr
+        YU4wMkV3dHF0SjlZZENSbXRITDh1bmVMU3ZGMFY3TERjdUEKu6DSfMkV9m/5yTq4
+        kEPklIGO9IbiPjPQDu2epK1+qmOzqvCt7WPOoafLEtahnGOElAKWYHCpbaACNLwu
+        JoAXkQ==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHIM3nsk3HxvEcplSqwynh9V2NzlYdI10mrR746SiJZb kid@fw13
+    - enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrR2crZTU2eUp6MnJLOEY0
+        ZmZNTit3dXNET2JhOHA2QzYxUTdoWnY4TFNzCjdUaitZTjZ2QWlKbWxpalJqM0pQ
+        azBCQ09SWFNGWUs0MFhKUGJhVlFNNE0KLS0tIGs3M3EzdlRJbkpiRmtQZFdINTVp
+        NHhJTTFGN2xkSTM3ZHFhL3R1dWdsUm8K2UJVwI5mfh33plbLL/AUockAkhD77Aa4
+        EiVORvGk06f3XOmaoCdXk5li3Kqzzg05XZ8CyxsAtEoLeWYocdKTLQ==
+        -----END AGE ENCRYPTED FILE-----
+      recipient: age1crlwx4k0eaq666fa8dqpq3k9rhkm8qvwf3ewuum8s8hmrzrm55fsl3tk8h
+  encrypted_regex: ^(data|stringData)$
+  lastmodified: "2026-08-18T15:46:40Z"
+  mac: ENC[AES256_GCM,data:0IWfzMejoGR/COhBuoF6zhyQylEq+2w86HQcJaDAu8H+YFf8TKqRTGF82ImJeZT7FY5NRJyWbCZGkDxsj5e/LgB2w7neVEBel29VgPXr7KIToS/NmQpPhHn+Vp88YwdQjE8bGTFzga1oMpL+F4QAGTzIeBhEhHiwSacmefJfhwQ=,iv:ixsboKEr2miR1oOBHPwMz4mx+DjKqTsbQ5ZybxJxNIg=,tag:DpkffL2Up6J6ba6+wQEOSA==,type:str]
+  mac_only_encrypted: true
+  version: 3.13.3

manifests/prd/sops-operator/ClusterRole-sops-operator-controller.yaml

@@ -0,0 +1,42 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: sops-operator
+    app.kubernetes.io/name: sops-operator
+  name: sops-operator-controller
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - '*'
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+    verbs:
+      - list
+      - watch
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - list
+      - update
+      - create
+      - patch
+  - apiGroups:
+      - addons.projectcapsule.dev
+    resources:
+      - sopsproviders
+      - sopsproviders/status
+      - sopssecrets
+      - sopssecrets/status
+      - globalsopssecrets
+      - globalsopssecrets/status
+    verbs:
+      - '*'

manifests/prd/sops-operator/ClusterRole-sops-operator-crds.yaml

@@ -0,0 +1,29 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "-3"
+  labels:
+    app.kubernetes.io/component: crd-install-hook
+    app.kubernetes.io/instance: sops-operator
+    app.kubernetes.io/name: sops-operator
+  name: sops-operator-crds
+  namespace: sops-operator
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - jobs
+    verbs:
+      - create
+      - delete
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - create
+      - delete
+      - get
+      - patch

manifests/prd/sops-operator/ClusterRoleBinding-sops-operator-controller.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: sops-operator
+    app.kubernetes.io/name: sops-operator
+  name: sops-operator-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sops-operator-controller
+subjects:
+  - kind: ServiceAccount
+    name: sops-operator
+    namespace: sops-operator

manifests/prd/sops-operator/ClusterRoleBinding-sops-operator-crds.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-weight: "-2"
+  labels:
+    app.kubernetes.io/component: crd-install-hook
+    app.kubernetes.io/instance: sops-operator
+    app.kubernetes.io/name: sops-operator
+  name: sops-operator-crds
+  namespace: sops-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: sops-operator-crds
+subjects:
+  - kind: ServiceAccount
+    name: sops-operator-crds
+    namespace: sops-operator