chore(secrets): adopt cloudflare-api-token + document exclusions #6

Merged

kblack0610 merged 1 commit from chore/secret-cleanup into master

2026-06-01 20:36:01 +00:00

kblack0610 commented

2026-06-01 20:36:00 +00:00

Owner

Phase 2e of full-cleanup plan. Adopts cloudflare-api-token (ACME DNS-01 credential) into Flux + documents runtime-managed secrets that intentionally live outside git.

kblack0610 added 1 commit

2026-06-01 20:36:00 +00:00

chore(secrets): adopt cloudflare-api-token + document runtime exclusions 4f28b45dfd

cert-manager/cloudflare-api-token is the credential for ACME DNS-01
challenge — kubectl-applied long ago, never in repo. Adopt now via the
standard pattern (kubectl export → strip → SOPS-encrypt → add to
kustomization). Filename includes 'secret' to match the .sops.yaml
creation_rules regex.

Adoption is non-destructive: the Secret's data field is identical to
what's already in the cluster, so cert-manager won't notice. The token
keeps working; from here forward it's source-controlled and any future
rotation can roll through git.

Also: delete two stale Secrets from the `apps` ns
(placemyparents-db-secrets, registry-placemyparents-registry) — old
leftovers from when placemyparents lived in the apps ns; not referenced
anywhere, not in repo. Done as ops, no manifest change needed.

Also: document runtime-managed Secrets in docs/excluded-from-flux.md
so the orphan-audit allowlist is reviewable (tailscale-state,
letsencrypt-dns-account-key, cert-manager-webhook-ca, *-tls,
sh.helm.release.*, kube-prometheus-stack-*).

Plan: ~/.claude/plans/plan-mode-continue-idempotent-pumpkin.md Phase 2e