ArgoCD Kustomize Ksops: manipulations with encoded objects

[Dpoke]

Hello. I have problems in integration argoCD with kustomize ksop generator.

Workaround:

Initially, I had this file:

# secret.yaml
apiVersion: v1
data:
  token: NEJEMUNFMjMtRTNDMC00QkJGLUE3NUUtQUJBMTAzRUU5NUM5
kind: Secret
metadata:
  creationTimestamp: null
  name: app-secret
  namespace: default

It was encrypted with sops:
$ sops --encrypt --in-place -p <gpg_key_id> secret.yaml

So now it looks rather creepy:

# secret.yaml
apiVersion: ENC[AES256_GCM,data:WTs=,iv:7VUfDWPJnppCtDMRZdy77aLfrROPt/+XOldwPDtH82A=,tag:McA7liaIvV9ow4yoYmtkVg==,type:str]
data:
    token: ENC[AES256_GCM,data:ontcWSrsezdJLqjsF4cs23ESl4c6i45b7+1cFI9YCXjUTaQR3CqWtNWTMvUCHAhc,iv:IUrmRAUZjTHsIzKXUSO750E198NFSb07nrF61BWARHo=,tag:ceTu0zr37fgTb8InErvDmg==,type:str]
kind: ENC[AES256_GCM,data:RcOvVR4y,iv:ti9fMi0eDcpE8vLGc62gFN02apKEslPtNrXK+KdVMao=,tag:vvyHWYdrZ7F2LxBEbFF+OQ==,type:str]
metadata:
    creationTimestamp: null
    name: ENC[AES256_GCM,data:yUKYP6s2HxLiXg==,iv:j7BtRHCM1KNG5+tgGXRS/6yzdHtcNK5lv/DldeZQsVQ=,tag:HAF9Z0s4v4B6Cpu5cC789g==,type:str]
    namespace: ENC[AES256_GCM,data:lMnZfD22Bw==,iv:pywMa5RW14MduOmZtaU4b2nHvCtVmtKX9uSiCEeFhl8=,tag:0HHUh1dMC6dLPL6xnIbaPw==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age: []
    lastmodified: "2022-08-28T10:54:36Z"
    mac: ENC[AES256_GCM,data:4cbATJ5vKEDfQSDXvLTbUvkdcXT0lHntzRlc0BQpXZaj0+ugGFhDEwyw3HNMFsSBa1OpqR73QjcEKrzgGE22xuAUcROLQ57sBETyohhpd4yMa6wRbFiOHpC9KWBdPKIIgpl/uaXQFtD72esVJGNd3PDkedugXHqi1fSrfQmeZVY=,iv:1S6K4TiHI5lr6dc9RHMG5saW4R9YDM1ZsnUYc+bND78=,tag:zSoFpc0n7YiygpR1bYtAvg==,type:str]
    pgp:
        - created_at: "2022-08-28T10:54:36Z"
          enc: |
            -----BEGIN PGP MESSAGE-----
            ...
            -----END PGP MESSAGE-----
          fp: 158B8E2A9E9D58FBB77EC8F05F2E51F4C3BE179C
    unencrypted_suffix: _unencrypted
    version: 3.7.3

I also added some instructions for kustomize to deal with this secret

# kustomization.yaml
generators:
  - gen/secret-decoder.yaml

# gen/secret-decoder.yaml
apiVersion: viaduct.ai/v1
kind: ksops
metadata:
  name: ksops-secret-decoder
files:
  - ./secret.yaml

It all works for this command and shows the initial secret
$ kustomize build --enable-alpha-plugins .

Also it works with argoCD if I create an app without --directory-recurse:
$ argocd app create k8s-cluster-app --repo --path . --dest-server

However, I need --directory-recurse, but with this option ksops-secret-decoder appears inside k8s-cluster-app instead of being used for kustomize-ksops-decoding, and it all doesn't work.
So I have tried some ways in achieving the usage of --directory-recurse.

WAY # 1.

Try to exclude directory where ksops-secret-decoder is located.

$ argocd app create k8s-cluster-app --repo --path . --dest-server --directory-recurse --directory-exclude 'gen/*'

This results in having a strange undecoded secret in my k8s-cluster-app, with the name, exactly:
ENC[AES256_GCM,data:yUKYP6s2HxLiXg==,iv:j7BtRHCM1KNG5+tgGXRS/6yzdHtcNK5lv/DldeZQsVQ=,tag:HAF9Z0s4v4B6Cpu5cC789g==,type:str]

Seems like kustomize doesn't have an access to my excluded file with its instructions too. That's sad.

WAY # 2.

Try to integrate ksops-secret-decoder inside kustomization.yaml in hope that argoCD wouldn't create ksops-secret-decoder object and would let kustomize use it to decode the secret.

# kustomization.yaml
generators:
  - |-
    apiVersion: viaduct.ai/v1
    kind: ksops
    metadata:
      name: ksops-secret-decoder
    files:
      - ./secret.yaml

Locally, "kustomize build --enable-alpha-plugins ." still works fine.
But I recieve an error trying to create an app:

$ argocd app create k8s-cluster-app --repo --path . --dest-server --directory-recurse
FATA[0001] rpc error: code = InvalidArgument desc = application spec for k8s-cluster-app is invalid: InvalidSpecError: Unable to generate manifests in .: rpc error: code = FailedPrecondition desc = Failed to unmarshal "kustomization.yaml":

Why does it have an error? Is it a bug in argoCD?
I thought that argo use "kustomize build" command, but it seems I was wrong about it.
Which utility does it use for unmarshalling yaml files?
What else can I do?

Thanks in advance.