Posts tagged “sops”

Building Audiobookshelf through GitOps with a ConfigMap, retained storage, a non-root runtime and a Cloudflare Tunnel credential protected by SOPS.

Renaming the homelab repository was straightforward. Moving two live Grafana Secrets between Flux Kustomizations meant handing over ownership without letting pruning delete them.

Renovate's first run offered a Flux upgrade and three overlapping PRs. An hourly job, an encrypted token, and a useful reminder to read what the bot proposes.

I wanted to stop port-forwarding Grafana. Along the way: an overdue chart upgrade, encrypted credentials, and a certificate my browser quite reasonably refused to trust.

Using SOPS, age and Flux to make Kubernetes Secrets encrypted in Git, recoverable by the cluster and useful only where they are needed.