Migrate remaining secrets to ExternalSecrets #67

Merged

eblume merged 4 commits from feature/migrate-remaining-secrets into main

2026-01-28 20:41:45 -08:00

Author	SHA1	Message	Date
Erich Blume	8f4660915d	Fix argocd SSH key format for 1Password Connect 1Password Connect doesn't support ?ssh-format=openssh, so we need a separate Secure Note item with the OpenSSH-formatted key. Created new 1Password item: argocd-forge-ssh-key Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-28 20:31:16 -08:00
Erich Blume	9114aac8f6	Switch all ExternalSecrets to creationPolicy: Owner ESO now has full ownership of these secrets. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-28 20:27:16 -08:00
Erich Blume	dd6cf20d51	Remove obsolete secret templates - Delete 13 .yaml.tpl files replaced by ExternalSecrets - Update immich/README.md with direct CNPG secret copy instructions - Update miniflux/README.md with context flag and ESO note Only 1password-connect/secret-credentials.yaml.tpl remains (bootstrap). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-28 20:26:37 -08:00
Erich Blume	351528474c	Add ExternalSecrets for remaining k8s secrets Migrate 10 secret templates to ESO ExternalSecrets with 1Password Connect: - databases: eblume, borgmatic, teslamate passwords - tailscale-operator: OAuth client credentials - grafana-config: admin password, teslamate datasource - teslamate: db password, encryption key - forgejo-runner: runner registration token - argocd: forge SSH credentials All use creationPolicy: Merge for safe migration from existing secrets. Skipped: - miniflux/secret-db: Uses CNPG secret, not 1Password directly - immich/secret-db: Requires 1Password item creation first - 1password-connect: Bootstrap secret, must stay as template Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-28 19:50:38 -08:00