Initial argo deployment

cluster/platform/external-dns/externalsecret.yaml

@@ -0,0 +1,29 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret — Technitium TSIG Secret
+# Pulled from 1Password, materialized in the external-dns namespace.
+#
+# In 1Password, store as item "technitium-tsig" with field "tsig-secret"
+# in the "mk-labs" vault.
+#
+# To generate a TSIG key for Technitium:
+#   tsig-keygen -a hmac-sha256 external-dns
+# Add the key to Technitium under Settings > DNS Settings > TSIG Keys
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: technitium-tsig-secret
+  namespace: external-dns
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  refreshInterval: "1h"
+  target:
+    name: technitium-tsig-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: tsig-secret
+      remoteRef:
+        key: technitium-tsig       # 1Password item name
+        property: tsig-secret      # 1Password field name