infisical: bring self-hosted stack under GitOps (postgres, valkey, backend); secret.yaml excluded template

2026-07-16 21:47:28 +02:00
parent 1d026f8d57
commit 37737670b5
11 changed files with 248 additions and 30 deletions
--- a/infra/argocd/applications/infisical-application.yaml
+++ b/infra/argocd/applications/infisical-application.yaml
@@ -11,7 +11,9 @@ spec:
    targetRevision: HEAD
    directory:
      recurse: true
-      exclude: universal-auth-secret.yaml
+      # secret.yaml holds Infisical's own bootstrap secrets — applied out-of-band,
+      # committed here only as an emptied template. Never let ArgoCD apply it.
+      exclude: secret.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: infisical