feat: convert many

clusters/cl01tl/helm/immich/templates/_helpers.tpl

@@ -0,0 +1,14 @@
+{{/*
+Common labels
+*/}}
+{{- define "custom.labels" -}}
+{{ include "custom.selectorLabels" $ }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "custom.selectorLabels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: {{ .Release.Name }}
+{{- end }}

clusters/cl01tl/helm/immich/templates/external-secrets.yaml

@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: immich-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: immich-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: immich.json
-      remoteRef:
-        key: /cl01tl/immich/config
-        property: immich.json

clusters/cl01tl/helm/immich/templates/secret-provider-class.yaml

@@ -0,0 +1,18 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: immich-config
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: immich-config
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  provider: openbao
+  parameters:
+    baoAddress: "http://openbao-internal.openbao:8200"
+    roleName: immich
+    objects: |
+      - objectName: immich.json
+        fileName: immich.json
+        secretPath: secret/data/cl01tl/immich/config
+        secretKey: immich.json

clusters/cl01tl/helm/immich/values.yaml

@@ -4,6 +4,8 @@ immich:
       type: deployment
       replicas: 1
       strategy: Recreate
+      serviceAccount:
+        name: immich
       containers:
         main:
           image:
@@ -86,6 +88,10 @@ immich:
               gpu.intel.com/i915: 1
               cpu: 10m
               memory: 500Mi
+  serviceAccount:
+    immich:
+      enabled: true
+      staticToken: true
   service:
     main:
       controller: main
@@ -135,9 +141,13 @@ immich:
                 value: /
   persistence:
     config:
-      enabled: true
-      type: secret
-      name: immich-config-secret
+      type: custom
+      volumeSpec:
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: immich-config
       advancedMounts:
         main:
           main: