Add SOPS-encrypted Tailscale operator authkey secret

Replaces manual secret creation with a repo-managed encrypted secret.
Decrypted value contains the operator authkey for tailscale login.

infrastructure/controllers/base/tailscale/authkey-secret.enc.yaml

@@ -1,14 +1,23 @@
-{
-	"data" : "ENC[AES256_GCM,data:wnrfqw7ClV7ShqtOwPH6sylxB0/5QpwSp1cMp2V68WvqXowEhV5yXGCYwUuz+W9x4rYO5rCVlRqP7Ch0uEUrVAx8gBbGGDN9CnG56hkI9A7BC5Ozia7nOyleTLxiPrnC7eMBomDzx1B7jcAb8UsdflMm9wjzhCtVNvyNesyb1Q/N8WHOqPt9nVIWPHNAnLGCNSPevl3VlvNZIE484CBP8sPITQ35jJHRixyXCxYii0Oknt44waiv00LATuhrw00a8sPyGc9Dww7InIRVHQ7T2RDv4PpiHJ7eLi+OAq8+WKTA1CFEU1mhXAvdog2dvRN4bjYabI/2mzOUvX58PPbz9t9f6GHHUhK/SBGWTe5/4qn29RJ/ShKrvsj1C3qNoMjKLhiXpMAm5zobvzQi5OFdRbDJvtiuTh2CTTcye9turvCTvA35vou5dsbL50Y2EUbepz9QZTts8IJqPoRz9+mffZec8fKLRCCKd/ikgzIRpsTWymNN85LFgHzDlybUi8UWvpadFJMwDx3QAYhZHGSVhK66HnPVBPwrmci727YaizEe7i2CEPmYhLoqqC3/9SsDolvTnohEU7h/y1CL8TTyV79S0jOAF443u1reZ/mNR1lWIsnZtneJVT8tfhGtnTg9SDGwip1jZJtbSZb+3RG6cIJMFefLr8ATHy2foIzAUdUBDknrIVjMuLpBQ4mZ8KQ34yj2zqVMsg3DTiifdTkcy2PXMgMOQ3v3PM/kokZ0Qb4FEcRTtvW2FLTIE6B8JdNe3X8oe+uti/Fk3uDtKZ5xvaJYl3jlODPEulQeHT+3Q7axFoBrHbDvjfkcmtJWCXVajlrM6SruJngnQ5LXAC2/IyL5hNAEmJrvC2kUgkucnW1LzRL6buyPlYJOxI//MC0aQVAfYj4bboEYz6/DuYzoQ+yc8u+Th+FEqCCifhKbB3to33R0Gum7793naETahm5EqY+cju9znq9CnZnOaNO5yjWszVgFVr/fn2vKtBA+AL2QPZ8gb6q1GuqoRCjE1DI04ivf6vCzE6EWbqBW/TGuTGFSVjHxhABJczToFaBTfhXzsw9QfZBnyY9W1MYT9jOtW2rCGBIrIKhr8y4rSVjgYOMn/nR3wiKGz522auSTHwJmU/nRZ2Tmdgb6UBWlYrgobyll0PozfutkHkp71HKPgvxUV2Y+8FLNeq1bvOe0Yu6KFatpPkK/6n1B6zP96xdkQ9f12RCpFOUIj8Cr2pZYl5HUzeQ3E1lVEaesWm3UEF8Jj+9VhOLvDSxfUJM+EVyc89SKbECDGn8f/5ZSD/3DW6BTn+eBN8M9xpDdZkSq8RTPH7OfNQfD1ubz/k8GqjNgBMBUhRt4IvmucNu0hqN66CQrztBei9K8/7gVZkH89dHhGlgN+VTws4c/Netb5c1LoBvh+zihlZOxlvT2n96OxqaTk4XWl7YWaSondUeXZzte7Uc3pfLTYnf747KA6cORlDtKVs9oLt/WADjSR66VPPwBpCYp1RpG6lb/KWy9BurjimTVi96qC9B7C7evy7Pcw7yjPke/N7cTMupN+UQL2xPNZEHOJct3/Q/25cM/+suC4yL7LZKlknlRz8uRtUFtDUtUoh9lVcvC7PL0SU1hxotgCjhx4AsO1TJEeJTT2rdMrnPKT7s7DdaI7bp8BrYsMtpULSGYb+1tGEvjQ5547/DUjLWVSwLUGdf4mFbrSk7vYocEWb/dFTy97RbirYWIEnkB3nObjKnvtdWctNpgWeo/mkY53KNtQTGpuwyqaLiamRU/mVDrH/ljGaSJ5DSxCYXtb6SLDJT+XrV1AUPd7YNT87EA5H5aKpUYE/P8M6iXcpp96jjPjs17kdHwtT/My3VxLwb3c4cUMgW1ReuEduzMchYiW4FzQ3r/RG+JlVMSukLM8RK1KP/dWKxiPkBzEsY/Ouj0wTe75Q2+sKwhH9MSxir0SKTKB+Kbxgd5/Vm7YiDHG6/F4vfEPlXk3qHRllZE5vMlFU/0UrGNBVdVCHmDo3yScXipZUouPbY8eYBtaFgkE2WB6fxMQoi0euRFZWeaxfw6dN4sBs68Zc0GLHDx5SAAi5SxAtb0NM9HRIQspO8CqgsmxVIBhuj7zH70kUsCL2mfv/fo8M8KIyYUMclsdP7FzsgfmxaBePcblSi8KeTzkI7NsLsZ7acPehiZnnECX45v162aG3rYZWAjY3i3LZFXh0OoT+SlVVYxzS40LYoAIpUWfQWHrbWcRI3wQAGF3vUgG25cjE33HOEY8cA1YspeV4324WriJe+UBjLdwz+XljG+VNu9AU8hnhB3YlpY+EWF9cSzZ6GQ1mpPm2CjSmF18UDMn8lpR2tiRWiFNPuMxdptVDh/dHE/tZ1rVa/aje9ORx7F1CiN3VU7wwoxQSj6y1wRrFSByreTjTpAbSt9pmAr4l8DJS9ZGKFaaJLwpTtUwEgwIj45RCDos/PmplLGhWYwJEKhi+N2H0E=,iv:Usj+HX0mV48cv5CQ8N5zeseNYeX7v4JySSjfjbKGSbU=,tag:KOVZqnW+bL6kTK79qn1AJA==,type:str]",
-	"sops": {
-		"age": [
-			{
-				"recipient": "age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbHFIT1F2S3M1Yzk4Wisz\nOU80N0kxT1llQ3pTYjZweEhuaHNvditIem5jCk5KWTVnRmhWTzVNM3ZYYzlKT1R3\nKzVhbFhIL2N1a2Y0Uk5EVlJKVmFIMEkKLS0tIEs3cHAweC94bzVWaUhyekxKNWx5\nbHF3OHlOTEdPejc0cDFjRTVZLzlKTTgKBrP9XqTbaOzEzRv321EcY4mRVF3Eh2is\nNMVNEXa06Kij6nSSyzn6xLNlqhTdx8aGmxaLB0SkWiTtvHFidNVKgw==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2026-05-04T00:41:23Z",
-		"mac": "ENC[AES256_GCM,data:wBSb4LzfXDk3hdRk7o1HUBlpnpb8Ry5icBE0CKl0oj1WLhaH/n4JuWF4nIaYb/9caJGqrwNvwkw38ivJMfRWvU79wANc/1KoNaRFsA3b9Gb+hyXl9yMi7gD5N11rxc3XPzUqlWs69QvLUvx09hPbmx/9Jhl/K7GvTi+W7/vVm5A=,iv:jAwJe5rOSj8tK7jyHw1y4C8ooTbsrfcr5vkQsYq4ukQ=,tag:YYIOfjjvOipzJ9lz3vFaPg==,type:str]",
-		"version": "3.12.2"
-	}
-}
+apiVersion: ENC[AES256_GCM,data:RnI=,iv:8XkB3DGqi1C/kasS5GiQYudUFBMCA39P47f6ZrGXFfU=,tag:RbW4+ZJy23on1VHiVzB97A==,type:str]
+kind: ENC[AES256_GCM,data:vQxp8Yye,iv:NTnSCRy/ojgI6YxiNQ5hGTyyc6oI/bBXellOT3zPHC4=,tag:DyarSVGeW4V/ZWpgIGSprg==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:cqxm72lY889Hep3e4gvIGczUbg6b07ztbDw=,iv:EdtJiYsDOr0JI03Q1ppcUeR6mAiWCAoGcDgoeSuBWJc=,tag:hbNuhZ/2ADJ8JbB04IDpyQ==,type:str]
+    namespace: ENC[AES256_GCM,data:F5yrzxvlhG7r,iv:Bo6KQ5Jw//ujusHAKeFgbQZv9fiEjVGAcg2NfQoKkRQ=,tag:/7thf1cUYiXGpyJg+sB3sw==,type:str]
+type: ENC[AES256_GCM,data:gub4U7je,iv:9+2u9x1CTCorIp4o0f9RkmQQxmFFZzzamIFT4lvv3k4=,tag:SfHYbfwTCRnS9BXggD/lNg==,type:str]
+data:
+    authkey: ENC[AES256_GCM,data:MECFadN0uzQGUvHeTrFEF3DU4HhkvksqSu1XXUs4whDhvlHduwCsCpHSQIRP4TkEFmPnufaKwc3/PKNi82/h2EzA0p8ZsTlB5MHBS1xyk+FLZn6X,iv:+kyMjGtN+Snh0Gs4sGe+UOHTLHtMGODDkjDCYUnLpeA=,tag:29vMCubpg3hlw18/26azzQ==,type:str]
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiWFVseVR2ODNrUHJkUXp1
+            eis0dmRhVTE1Z1lBME0vL3U1ektWQXBxY0JzClljNG9Tb0pHc2EzV2oySk1nd2Q0
+            elgxdlpYK2JyOXR3SXdTSGJOR1ZHTUkKLS0tIEdDMUMzWDJ4VmZkN2Nxb1hCV1pS
+            bTJCNEpKWDhFS1lPNFNhZVNIdnZQRHcKr+RoZ8Aci5qx31XLgARMnuMOe9rYJa74
+            l0n1wSF6nO2u+TFEJ4CCSVZ8KiiZXgj1SI5RH0lB45RDX5TgiOsMVA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-04T03:09:08Z"
+    mac: ENC[AES256_GCM,data:XZUchEgndlDyUK9jUazTlBNqmtLe1NfSy2PR8MUsglcEfuGLopaORCsYBkINC5VfRiX7bxu9jEY7nlxwUNng8zHO6RVYo2c5l7ocbtbGafLcXmjUyVB1un2koMWZnk10PTKxq3+Tda1KztQ8+zvmdAZYsJFU8gyRuH5L5dK5B2o=,iv:uTOP9ByQIYUJXVdafgwE1XeR983QVHDjNDehVhYEEkk=,tag:HuV1QR6mav9SPE9eUQGrFA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2

infrastructure/controllers/base/tailscale/authkey-secret.enc.yaml.bak

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:R/0=,iv:PUqVQ0H2SZdXZkCiaSdz0ysy7wTTtE1+v25UqgXdX1c=,tag:j6+gB/gKyxuXBrsjt7OsHQ==,type:str]
-kind: ENC[AES256_GCM,data:p+MMCOMS,iv:rCfu2I31ot6oCqIHcr3FwimOYl2qDpifkTaCZmN3Ah0=,tag:dikURqRMZDS7m7kdbefa7w==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:6VEI/ZBaa3RmcuNNt8GRLanuvReC8P3FUSc=,iv:AI4A5cN20JV7Qdb/POLrJH3BUpfpAb9ybu6rABSEy/Q=,tag:fGZi0hQFpmT5jOnvVTvXvw==,type:str]
-    namespace: ENC[AES256_GCM,data:RvEu7ZA3W64Y,iv:wP45Ik04OW8Qz6DnyO3zymQMEQvJOyshTgVvLkqPUbU=,tag:PrdXhIVgnjRCNvv0c2uXGg==,type:str]
-type: ENC[AES256_GCM,data:X8Eu6/NT,iv:c6vQILIOdMZBJOzfDxOBfMZjBKyxgtHOCj6CIB9Mssc=,tag:3K38oNZpBzroLKetuFHSYQ==,type:str]
-stringData:
-    authkey: ENC[AES256_GCM,data:6bfaUzy0icgmy7panoJAIMtdhMl55ClYGi+VmBlnwrYTo1z5Cs18C0HAMozFDaevfGbaFGtEdmsyZVPKjg==,iv:g8z8QwCDA/IuUFGYNzyKW/MgqCZfaRWfWlTk65Hsvdc=,tag:irs0M4aUL35WdYUD+o2aCg==,type:str]
-sops:
-    age:
-        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFY1Vjd1p3M2Q4eFkwdE5i
-            SExndHAxSTByZmZYd0ZpS21DY1VGZlJxNVZnCllYcGpCY05FUzdXVXVuMHAreGMy
-            b0FDRCsxNmprQ0xZRlFKYjFCMW9MSVkKLS0tIDJBR0hwaXFBb3VMS0pta29nRWpv
-            di9LZ2NRMnhTT3RmZzgrbUV6eGNKVTgKpPITr4gtgEd+Sb4bqkBdGrHfmmSxp3pU
-            sA61aRNncplQRqcYiupDlxddM25kLgK95igM0D9bZMnf98esaMW0tQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-03T23:29:13Z"
-    mac: ENC[AES256_GCM,data:gdqeJQuzRC58jNwISj/UXrYFTy1HrgG1Br5bTUZ/4WT0fyraVlKyPcnl6GO7Ljf1YH8ZYeOnCDqA31/ufJuILUuTiGT77qtPRHgXy0AGtlcdFoXcSrqDUGDjyfMupCgAZGviEaIWARau1cN1/jO+IFnhTcCaAYF4sykc1k3QU3o=,iv:nzYIC1WqDijUeo/v/K1rxp/b4UgvsvEdNzcN7D0n5YQ=,tag:k7+I9dMRg+AMnCF0Zog9pg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2

infrastructure/controllers/base/tailscale/kustomization.yaml

@@ -4,7 +4,7 @@ resources:
   - namespace.yaml
   - repository.yaml
   - release-operator.yaml
- # - authkey-secret.enc.yaml
- # - tsproxy-rtx6000.yaml
+  - authkey-secret.enc.yaml
   - dummy0auth.yaml
+ # - tsproxy-rtx6000.yaml