more updates

cmd/validate.go

@@ -144,8 +144,7 @@ func buildRequiredSecrets(cfg *config.KforgeConfig) []requiredSecret {
 		// Always required — org level
 		{Name: "DOCKER_USERNAME", Location: "Gitea org secret", Required: true},
 		{Name: "DOCKER_PASSWORD", Location: "Gitea org secret", Required: true},
-		{Name: "SOPS_AGE_KEY", Location: "Gitea org secret", Description: "Decrypts .kforge/secrets.enc.yml", Required: true},
-		{Name: "KFORGE_NODE_IP", Location: "Gitea org secret", Description: "MicroK8s node IP for DNS A records"},
+		{Name: "KFORGE_NODE_IP", Location: "Gitea org secret", Description: "Node IP written as the external-dns annotation target"},
 
 		// Always required — repo level
 		{Name: "KUBE_HOST", Location: "Gitea repo secret", Required: true},
@@ -153,27 +152,6 @@ func buildRequiredSecrets(cfg *config.KforgeConfig) []requiredSecret {
 		{Name: "KUBE_CERTIFICATE", Location: "Gitea repo secret"},
 	}
 
-	// DNS secrets
-	if cfg.DNS.Provider != "" && !cfg.DNS.SkipDNS {
-		secrets = append(secrets, requiredSecret{
-			Name:        "CLOUDFLARE_API_TOKEN",
-			Location:    "Gitea org secret",
-			Description: "Zone:Read + DNS:Edit permissions",
-			Required:    true,
-		})
-		for _, zone := range cfg.DNS.Cloudflare.Zones {
-			varName := "CF_ZONE_ID_" + strings.ToUpper(
-				strings.NewReplacer(".", "_", "-", "_").Replace(zone.Name),
-			)
-			secrets = append(secrets, requiredSecret{
-				Name:        varName,
-				Location:    "Gitea org secret",
-				Description: "Zone ID for " + zone.Name,
-				Required:    true,
-			})
-		}
-	}
-
 	// Per-environment infrastructure secrets
 	envKeys := config.EnvironmentKeys(cfg)
 	sort.Strings(envKeys)