chore: Update manifests after change

clusters/cl01tl/manifests/kube-prometheus-stack/Alertmanager-kube-prometheus-stack-alertmanager.yaml

@@ -26,7 +26,7 @@ spec:
   logLevel: "info"
   retention: "120h"
   secrets:
-    - alertmanager-config-secret
+    - alertmanager-ntfy-config
   alertmanagerConfigSelector: {}
   alertmanagerConfigNamespaceSelector: {}
   routePrefix: "/"

clusters/cl01tl/manifests/kube-prometheus-stack/Deployment-ntfy-alertmanager.yaml

@@ -21,13 +21,15 @@ spec:
       app.kubernetes.io/instance: kube-prometheus-stack
   template:
     metadata:
+      annotations:
+        checksum/secrets: 3c0d4bd47e7d4f71ba55611ddc7b74c5f3ec1cedcc474b15ac0a00daab9b791a
       labels:
         app.kubernetes.io/controller: main
         app.kubernetes.io/instance: kube-prometheus-stack
         app.kubernetes.io/name: kube-prometheus-stack
     spec:
       enableServiceLinks: false
-      serviceAccountName: default
+      serviceAccountName: ntfy-alertmanager
       automountServiceAccountToken: true
       hostIPC: false
       hostNetwork: false
@@ -43,6 +45,9 @@ spec:
               readOnly: true
               subPath: config
       volumes:
-        - name: config
-          secret:
-            secretName: ntfy-alertmanager-config-secret
+        - csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: ntfy-alertmanager-config
+          name: config

clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-alertmanager-ntfy-config.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: alertmanager-config-secret
+  name: alertmanager-ntfy-config
   namespace: kube-prometheus-stack
   labels:
-    app.kubernetes.io/name: alertmanager-config-secret
+    app.kubernetes.io/name: alertmanager-ntfy-config
     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ntfy_password
       remoteRef:
-        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
-        property: ntfy_password
+        key: / cl01tl/ntfy/users/cl01tl
+        property: password

clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-garage-metric-token.yaml

@@ -1,18 +1,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: garage-metric-secret
+  name: garage-metric-token
   namespace: kube-prometheus-stack
   labels:
-    app.kubernetes.io/name: garage-metric-secret
+    app.kubernetes.io/name: garage-metric-token
     app.kubernetes.io/instance: kube-prometheus-stack
     app.kubernetes.io/part-of: kube-prometheus-stack
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: token
       remoteRef:
-        key: /garage/token
-        property: metric
+        key: /ps10rp/garage/config
+        property: metrics-token

clusters/cl01tl/manifests/kube-prometheus-stack/ExternalSecret-ntfy-alertmanager-config-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: ntfy-alertmanager-config-secret
-  namespace: kube-prometheus-stack
-  labels:
-    app.kubernetes.io/name: ntfy-alertmanager-config-secret
-    app.kubernetes.io/instance: kube-prometheus-stack
-    app.kubernetes.io/part-of: kube-prometheus-stack
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ntfy_password
-      remoteRef:
-        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
-        property: ntfy_password
-    - secretKey: config
-      remoteRef:
-        key: /cl01tl/kube-prometheus-stack/ntfy-alertmanager
-        property: config

clusters/cl01tl/manifests/kube-prometheus-stack/ScrapeConfig-garage-https.yaml

@@ -20,4 +20,4 @@ spec:
     type: Bearer
     credentials:
       key: token
-      name: garage-metric-secret
+      name: garage-metric-token

clusters/cl01tl/manifests/kube-prometheus-stack/Secret-ntfy-alertmanager-ntfy-alertmanager-sa-token.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: ntfy-alertmanager-ntfy-alertmanager-sa-token
+  labels:
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kube-prometheus-stack
+    helm.sh/chart: ntfy-alertmanager-4.6.2
+  annotations:
+    kubernetes.io/service-account.name: ntfy-alertmanager
+  namespace: kube-prometheus-stack

clusters/cl01tl/manifests/kube-prometheus-stack/SecretProviderClass-ntfy-alertmanager-config.yaml

@@ -0,0 +1,19 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: ntfy-alertmanager-config
+  namespace: kube-prometheus-stack
+  labels:
+    app.kubernetes.io/name: ntfy-alertmanager-config
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/part-of: kube-prometheus-stack
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: ntfy-alertmanager
+    objects: |
+      - objectName: config
+        fileName: config
+        secretPath: secret/data/cl01tl/kube-prometheus-stack/ntfy-alertmanager
+        secretKey: config

clusters/cl01tl/manifests/kube-prometheus-stack/ServiceAccount-ntfy-alertmanager.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ntfy-alertmanager
+  labels:
+    app.kubernetes.io/instance: kube-prometheus-stack
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kube-prometheus-stack
+    helm.sh/chart: ntfy-alertmanager-4.6.2
+  namespace: kube-prometheus-stack
+secrets:
+  - name: ntfy-alertmanager-ntfy-alertmanager-sa-token