From ae949b4a0b000306b68c310389eca6d69124925a Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Wed, 14 Jan 2026 13:09:19 -0600 Subject: [PATCH] Remove secretGenerator from kustomization for GitOps compatibility Secrets are now managed directly in the cluster rather than generated from .envrc files. This fixes FluxCD reconciliation errors since .envrc is gitignored and cannot be used in GitOps workflows. All secrets have been backed up to 1Password for disaster recovery. --- k8s/README.md | 19 +++++++------------ k8s/kustomization.yaml | 7 ------- 2 files changed, 7 insertions(+), 19 deletions(-) diff --git a/k8s/README.md b/k8s/README.md index e27d7ab4..11b17911 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -2,20 +2,15 @@ ## Secrets Management -Secrets are stored in `.envrc` files (gitignored): -- Project root `.envrc` - Used by direnv for local development -- `k8s/.envrc` - Used by Kustomize for secret generation +Secrets are managed directly in the cluster and must be created before deploying the application. -Kustomize automatically generates the `towerops-sendgrid` Secret from `k8s/.envrc` using the `secretGenerator` in `kustomization.yaml`. +Required secrets in the `towerops` namespace: +- `gitlab-registry` - Docker registry credentials for pulling images +- `towerops-secrets` - Application secrets (RELEASE_COOKIE, SECRET_KEY_BASE) +- `towerops-db` - Database connection credentials +- `towerops-aws` - AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION) -Both `.envrc` files should contain: -```bash -# SendGrid Configuration -SENDGRID_API_KEY=your-api-key-here -export SENDGRID_API_KEY -``` - -The KEY=VALUE format works for both Kustomize and direnv. +For local development, the project root `.envrc` is used by direnv. ## Deploying diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml index e9366275..37dff34c 100644 --- a/k8s/kustomization.yaml +++ b/k8s/kustomization.yaml @@ -8,10 +8,3 @@ resources: - service-headless.yaml - certificate.yaml - ingressroute.yaml - -secretGenerator: - - name: towerops-aws - envs: - - .envrc - options: - disableNameSuffixHash: true