feat: separate secrets

clusters/cl01tl/helm/openbao/templates/external-secret.yaml

@@ -45,19 +45,15 @@ spec:
     - secretKey: ENVIRONMENT
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
     - secretKey: NODES
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
     - secretKey: TOKENS
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: TOKENS_1
+        property: tokens-1
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
 
 ---
 apiVersion: external-secrets.io/v1
@@ -76,19 +72,15 @@ spec:
     - secretKey: ENVIRONMENT
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
     - secretKey: NODES
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
     - secretKey: TOKENS
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: TOKENS_2
+        property: tokens-2
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
 
 ---
 apiVersion: external-secrets.io/v1
@@ -107,56 +99,41 @@ spec:
     - secretKey: ENVIRONMENT
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: ENVIRONMENT
+        property: environment
     - secretKey: NODES
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: NODES
+        property: nodes
     - secretKey: TOKENS
       remoteRef:
         key: /cl01tl/openbao/unseal
-        property: TOKENS_3
+        property: tokens-3
-    - secretKey: NOTIFY_QUEUE_URLS
-      remoteRef:
-        key: /cl01tl/openbao/unseal
-        property: NOTIFY_QUEUE_URLS
 
-# ---
+---
-# apiVersion: external-secrets.io/v1
+apiVersion: external-secrets.io/v1
-# kind: ExternalSecret
+kind: ExternalSecret
-# metadata:
+metadata:
-#   name: openbao-token
+  name: openbao-ntfy-unseal-config
-#   namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}
-#   labels:
+  labels:
-#     app.kubernetes.io/name: openbao-token
+    app.kubernetes.io/name: openbao-ntfy-unseal-config
-#     app.kubernetes.io/instance: {{ .Release.Name }}
+    {{- include "custom.labels" . | nindent 4 }}
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
-# spec:
+  secretStoreRef:
-#   secretStoreRef:
+    kind: ClusterSecretStore
-#     kind: ClusterSecretStore
+    name: openbao
-#     name: openbao
+  target:
-#   data:
+    template:
-#     - secretKey: token
+      mergePolicy: Merge
-#       remoteRef:
+      engineVersion: v2
-#         key: /cl01tl/openbao/token
+      data:
-#         property: token
+        NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
-#     - secretKey: unseal_key_1
+  data:
-#       remoteRef:
+    - secretKey: endpoint
-#         key: /cl01tl/openbao/token
+      remoteRef:
-#         property: unseal_key_1
+        key: /cl01tl/ntfy/users/cl01tl
-#     - secretKey: unseal_key_2
+        property: internal-endpoint-credential
-#       remoteRef:
+    - secretKey: topic
-#         key: /cl01tl/openbao/token
+      remoteRef:
-#         property: unseal_key_2
+        key: /cl01tl/ntfy/topics
-#     - secretKey: unseal_key_3
+        property: openbao
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_3
-#     - secretKey: unseal_key_4
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_4
-#     - secretKey: unseal_key_5
-#       remoteRef:
-#         key: /cl01tl/openbao/token
-#         property: unseal_key_5

clusters/cl01tl/helm/openbao/values.yaml

@@ -160,6 +160,8 @@ unseal:
           envFrom:
             - secretRef:
                 name: openbao-unseal-config-1
+            - secretRef:
+                name: openbao-ntfy-unseal-config
           resources:
             requests:
               cpu: 1m
@@ -176,6 +178,8 @@ unseal:
           envFrom:
             - secretRef:
                 name: openbao-unseal-config-2
+            - secretRef:
+                name: openbao-ntfy-unseal-config
           resources:
             requests:
               cpu: 1m
@@ -192,6 +196,8 @@ unseal:
           envFrom:
             - secretRef:
                 name: openbao-unseal-config-3
+            - secretRef:
+                name: openbao-ntfy-unseal-config
           resources:
             requests:
               cpu: 1m