tegwick
16a93b8e5c
Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install helper, and ESO policy path for offsite lane so railiance01 workers can upload without workstation OIDC (RAILIANCE-WP-0016).
27 lines
679 B
Text
27 lines
679 B
Text
# Decrypted helm values — never commit plaintext secrets
|
|
helm/*.yaml
|
|
!helm/*.sops.yaml
|
|
!helm/*.yaml.template
|
|
!helm/openbao-values.yaml
|
|
!helm/openbao-middleware.yaml
|
|
!helm/openbao-ui-overlay-k8s.yaml
|
|
# Kubernetes manifests (no secrets) are safe to commit
|
|
!helm/*-cluster.yaml
|
|
!helm/*-networkpolicies.yaml
|
|
!helm/*-databases.yaml
|
|
|
|
# ArgoCD repository credentials — encrypt locally, never commit
|
|
argocd/repositories/*.repository.sops.yaml
|
|
!argocd/repositories/*.repository.sops.yaml.template
|
|
|
|
# Kubeconfig
|
|
*.kubeconfig
|
|
|
|
# Credential broker local lease/token material
|
|
.local/credential-leases/
|
|
*.openbao-token
|
|
|
|
# Python bytecode caches
|
|
__pycache__/
|
|
*.pyc
|
|
tools/vendor/bin/kubectl
|