secret.yaml (3618B)
1 # IMPORTANT: This file must be SOPS-encrypted before committing. 2 # After filling in real values, run from the gitops repo root: 3 # sops --encrypt --in-place apps/talos_cluster/proxmox-ccm/secret.yaml 4 # 5 # Proxmox API token for CCM (read-only is sufficient): 6 # pveum user add ccm@pve 7 # pveum role add CCM -privs "VM.Audit Sys.Audit" 8 # pveum aclmod / -user ccm@pve -role CCM 9 # pveum user token add ccm@pve ccm --privsep=0 10 # 11 # The 'config' key in valuesFrom must match the Helm chart's values structure. 12 # config.clusters entries correspond to Proxmox nodes; one per physical server. 13 apiVersion: v1 14 kind: Secret 15 metadata: 16 name: proxmox-ccm-values 17 namespace: kube-system 18 stringData: 19 values.yaml: ENC[AES256_GCM,data:p3jRZP1Iyi6pswnoXJXcKv6VQE09FG/VLi9yYZCBSb5TRLXAPjFX0xqVE3Q4PyzXnO2ir+AnRf+vVYk8LOqpqEE4frxSTHwTfXpX1TYL/4uU4AOOQmOVmMfrvmr6EM6urwIJrU5HL3c+3mlxQQ44f2JxTYsQv+W3gR2+IA9Uo1h54LMo1Yyi5RBNOvTtWOLWmTEhxs5I/jS6qkALF73dDD7QrIuojYf+2ur1q0VFkBdWxbeC9FpF08u7pqEpwGZNQIhy0AoVyRAX03SkmJXTXNboAAaiyebu/MdsSh9A1BexecOY8HU6mim5GC/pJaIHV7R+ultb8WF9fmL8ZQ6xzI2Fy42/EcbYWMobI+iMjfWsriroOZIOGC0xMlg5n/QW8gPIh3tHtWThPaO81ShdGNiqeSb1T+F/XXljNHLovOZnls3Rx/juzODpHW7anXrdDQahs9RP/xtt7i2TMlrGxD4GPBSZ35j3OIlMQIAM4rNUG/ofrclwnTdpjNBtPfsQlCP6T3dz2s+snE8tELv91dqYzlZZg7MlH9w/lYZNzJYXC63DZVJ1KOJcC2FL/fvsw9b8LBfwz2NAFQ==,iv:RHd6VizrmaVMnPIg3hhR55LDcSm3Yf9A9ZRh6uj9zXk=,tag:6PKgfxRnRPI8fH+9l2QbqA==,type:str] 20 sops: 21 kms: [] 22 gcp_kms: [] 23 azure_kv: [] 24 hc_vault: [] 25 age: 26 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 27 enc: | 28 -----BEGIN AGE ENCRYPTED FILE----- 29 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBseFRvRFl0eWcyZ2ZuTkZ3 30 MzhUcW84UW5WSk0vRVMycUVwb2gvOEk3SFdFClNHZjViZW5iVzZhVjBRMjdKMUxL 31 dU9jazhnU01BTy9tY0diYkZtcm03bmMKLS0tIHRMRmNBQ0gvM1BYSjNZNkxKdWJZ 32 KzA2cjMwYzY5KzBBMFFnblBEZGZXeU0KuMLAKs1gU/sNtglluNJCiUwKNvaQ7Av2 33 bI3eZ/wBMZhhLUxDpO56s6CQ0Hk2dUz1P/CYaUFrxdL5CGVYnIbXRw== 34 -----END AGE ENCRYPTED FILE----- 35 lastmodified: "2026-02-27T09:41:36Z" 36 mac: ENC[AES256_GCM,data:YvZOg43pPSQy5tejTByXARbYF23/06m5gPEYc2m369JfOxHfCzHWxYO2bt537imisfOZjL9raeLRUGfDhRPRO9gQZmTJiG/+Hsv+G0/EEL/GN6ISSf+pcFKGCD+7FqwUiMsGVxxzZlBHWSQZYLvpREHSedCN5pSio+upswluFNY=,iv:KdOrveWoYtkSyyNeCBcymeS3rjX8lDHQxz1+QDqI8j8=,tag:ILxPFtd91Lc46XVz415YHw==,type:str] 37 pgp: [] 38 encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ 39 version: 3.9.1