proper secret handling

apps/kitchenowl/ingress.yaml

@@ -1,24 +1,24 @@
-# apiVersion: networking.k8s.io/v1
-# kind: Ingress
-# metadata:
-#   annotations:
-#     cert-manager.io/cluster-issuer: letsencrypt-prod
-#   labels:
-#     app: kitchenowl
-#   name: kitchenowl
-# spec:
-#   rules:
-#     - host: kitchenowl.tobru.ch
-#       http:
-#         paths:
-#           - path: /
-#             pathType: Prefix
-#             backend:
-#               service:
-#                 name: front
-#                 port:
-#                   number: 80
-#   tls:
-#     - hosts:
-#         - kitchenowl.tobru.ch
-#       secretName: ingress-cert
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  labels:
+    app: kitchenowl
+  name: kitchenowl
+spec:
+  rules:
+    - host: kitchenowl.tobru.ch
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: front
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - kitchenowl.tobru.ch
+      secretName: ingress-cert

apps/kitchenowl/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml
+  - pvc.yaml
+generators:
+  - secret-generator.yaml

apps/kitchenowl/secret-generator.yaml

@@ -0,0 +1,6 @@
+apiVersion: viaduct.ai/v1
+kind: ksops
+metadata:
+  name: secret-generator
+files:
+  - secret.sops.yaml