♻️ migration externalsecrets

kubernetes/apps/actions-runner-system/actions-runner-controller/app/externalsecret.yaml

@@ -0,0 +1,18 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: actions-runner-controller-auth
+  namespace: actions-runner-system
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: actions-runner-controller-auth-secret
+    creationPolicy: Owner
+  dataFrom:
+    - extract:
+        # github_app_id, github_app_installation_id, github_app_private_key
+        key: actions-runner-controller

kubernetes/apps/actions-runner-system/actions-runner-controller/app/kustomization.yaml

@@ -4,5 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: actions-runner-system
 resources:
+  - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./secrets.sops.yaml

kubernetes/apps/actions-runner-system/actions-runner-controller/app/secrets.sops.yaml

@@ -1,30 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: actions-runner-controller-auth-secret
-    namespace: actions-runner-system
-stringData:
-    github_app_id: ENC[AES256_GCM,data:wrVw0yVs,iv:ZGfJy6C3yRdnXonhN5xIVVqFtycW1MI000WdUTzghRM=,tag:F+Z8+BpJrV+dGtW+A0298w==,type:str]
-    github_app_installation_id: ENC[AES256_GCM,data:xli7LTqZGEs=,iv:BRRVqsjBUqzr8YsWpG0uJ/Xau8D3vkWCNv1DxJCf5nY=,tag:Q6+cGhUYOt+O2nO/vNZd1A==,type:str]
-    github_app_private_key: ENC[AES256_GCM,data:5rqd/MsKMMDGVZFCs9NALjBDlVbCUJGdRntKevw7DxoNqxnY9ZWI60ie6j+YrhPpm02ltK7xmtHkjmkAheJ5jRAPm0rFyGyleVKOGfCHOcUiODbS0LsTxYbb23cg4JHNDO2LyET9/U2iKg5QRqIQizxNV+xEa6ia9WybID7Fl+OyP1WISJXugxY7BoeE1TtiNn14Awv8uBNnJ5sZ2A6PVnsCfz5rGfln9H8apLF/yuO/PHsL/lrlfeLqRLplPNCA799lpoMk8ZOgIIv+VPT+j/o8aFNJczI8Gicfw4+Uz+z4XHRcNO4QcEp26HL0UP0F7fgJtBtfC9Bl9aqRKh4eN/PAIB85lYewt3vAVDeuc9SXmhUscwpomIxnucs3A+75UR58uPglRVpvb6JmfiXbchDZW2JvNTQX21XkD5ysqFJec/guB//DXDdLYmor1wN6vWvolMMQYGSvOql79Up5JoRMrWa+5rLErqIBMQH5CdbFXjNvOAWP4LwnUYGTGQdk80R/xTEHnxmcZkbydyB/oeiFjWEHTNlI36dJq392tnDbf//86pL/rEbG9Xreio6efzqYat43xpofeXwPKTDrZjF8VRLUHk/rdQaJ1XeD0tkm07D4ADxNURqwUMPswMa/Bpm4AC8/MprTofxUIzNPtEIecIaMnid1zUAzXDSHh0fE8MBFbJdIJMZww8AA5A/D4fNg/icIBEaZUMw2BJ9KT3TaC1lfVEBy0Q8XDACQi0k3bpVHHOLHjxLt9EJsNT8ouNxxsNmOxYJ2tii6LquXqExIWf8grGPrggclQyrlOc2a5KatjQYyHrpHb80trHxxtHiNrAiTViiAuNxW6VmmMLfMuzy4o4osPYKxFQ5Ano4YaoUWi0e5PpHpHOjKIAdMwRbHVql/qb6rNkeS+7FK07qFyFx/4jaxkZxMh8pjUBSyWN66t7cEW2QMf1/DVO64pv0E0vFTTYg7BP2RAOkJJq9jF0exV1IYrRgw4nLk2wJWQhx//kF3wvhj17iCMqOYmgULXym5Yev3hGy2kypfX8fgkJXSHa4+i9Np3t26sPcAt+BEdKroyEQe1D86QFDbC1Kmljn0SvP18NfqqFnqetuNo4iQRbztxiW3sqMOZKnK0ynoyBSqoI53/ki6VbYD/HkmgOFUAPiGFoNGaxrICkKsNuo23v5gSqza9eeCeld/FcWQB18hTq7DiG9XAQSocV3RryebHbWJ79GxSGVZD0zSZxA2PDjAK0/Sudiza305nMnxnIcZ+Egf5wHlHwGKxejaBYs1NCZ9KwOaQvoqBiTSQqASUt1suXYIlysQl6v1hKmuJek6UpCM7744boHs8UGaKgLPwproXjBuxl4iOgXHObSxrzcFjTlf8kDHwGowRYCz+qrXHsQIvjlKjatOP4dcZc8PNWkfb6jHsCaIHiHwwI9vAZnD/Q70I438qhtdJ2ZQJLQ3hn7cCz6R+SCxUOSoxPFHFHIrUzaEX1ISsWiAJFsxgA9uLvOXwWbaJNeJTIVEm9/rdfA0efaW5AJwDioTflX18fE4aQ6tbP6Vf3XkXFZA0jrY4n8geoXsARV3drEDPl81PL7lxFgYyQXqGxmN1Lv31IwQYZwpk0TGqsuAoMc9ctjGW7qMn2dUjPBnNfo1gcqfOPZJZwBd1ElFecGMGlZM4v1bTHCGf17bV1EseypmpXHnFHmgItSUeL6INpwlaOO0jT7qgH0BPNOh8xvTU038ggS4TrMQgwnKsjTeqN5WdRyLVu3k1G8HMq+UYCF1Hl+Q+n8r1ltMKVBMhBaq6myDtrZnulPPRtXvec3ImtgBUdjhpemevyMf1kwjoprG0IWFEMYAXqdRbXL2uOTPg1hDa1u7kjCBQIyLNIwAArD0HdpNE6odWCkyITjwPq+faCZdtULdgbit+HhqEmjWW0qZcwlHBV0Ex+GRpmHZBcGh2vH6HRthk6a0ojFL12/oQ9ed5c8fbAbxOYTd+TEE8ikGPKC2kQrfrA0rpwOYMEQ2umSQ2LFBhp7gFCeF5csBddeZtDzrKzvItYs6x/VpXD9v6cDUoywZT2nAB4tf+UTiC8+NkLtxzE8YUNLt0FJqTY9/sPt2tIa1Vq0ZvgOKg+O63Pc+TV+FouIBKJM3C0b7UnmQP7tTBgWH0mcCDYRycxzxaZxCwLGOFR6K6DnJmXwwRSTX3g1RQ+QI1t1UTYXImZntMrKEWmSm8QCUeL7xqqFTsI8S2isiHjo=,iv:JAdFM1sQoNzB6vwi20NeaUpiUrUzvud1oyDtccCl75U=,tag:GvYrU6X19agbdG3dvWabhg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQmtZeUVvaWtSNzZBWHBx
-            VWxYMjY0MlFSVEN0cjhvQUFxVWNHbFB2cndzCkZURTNGQXBXSm8yT0hvWVR0aDVC
-            NmVhRDNaUFh4eWYyUTFqRTZIQ2o5QkUKLS0tIHhuM3lFREZyYnhlZ3JKQUJwVEdX
-            Z3d6U0dVUWhPTDBZcXY4cFNsRGM3cFUKdIPaiHrS/B4zNHpNaxi9zYrOv+HrZ/oP
-            NVkIbemYIYGKhcqSjRy53EQhIimu0q4oCxal6KkXahVB0edysD9JBQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-08T07:36:24Z"
-    mac: ENC[AES256_GCM,data:PekWhW0fxXTmE0yrFPfGuuigc9rxjYEH5Aqcy/PrwSu+Qv5sD33s3j3TzuNm8hFEndUnLU5jYfNwgrNaMPiUSLt4TNe7H0+GNYiBY/1DstvrGd3jNUZaarDvmKsDDTS2CIgw9q2rGscT1Px2eCJYUEtVGcFXh4Xxyp4TV7GrmLY=,iv:qRD0sdKNpzSNkxZxxB02ksI8UDKiS7iMh2tgUtFu0Lk=,tag:J2KiMJqf1MQ5ASejKlPJ1Q==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

kubernetes/apps/actions-runner-system/actions-runner-controller/ks.yaml

@@ -8,6 +8,8 @@ metadata:
   labels:
     substitution.flux.home.arpa/enabled: "true"
 spec:
+  dependsOn:
+    - name: cluster-apps-external-secrets-stores
   path: ./kubernetes/apps/actions-runner-system/actions-runner-controller/app
   prune: true
   sourceRef: