feat: add more

clusters/cl01tl/helm/karakeep/templates/external-secret.yaml

@@ -1,7 +1,26 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: karakeep-key-secret
+  name: karakeep-key
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: karakeep-key
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  data:
+    - secretKey: key
+      remoteRef:
+        key: /cl01tl/karakeep/key
+        property: key
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: karakeep-metric-token
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: karakeep-key-secret
@@ -9,38 +28,53 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
-    - secretKey: key
-      remoteRef:
-        key: /cl01tl/karakeep/key
-        property: key
     - secretKey: prometheus-token
       remoteRef:
-        key: /cl01tl/karakeep/key
-        property: prometheus-token
+        key: /cl01tl/karakeep/metrics
+        property: token
 
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: karakeep-oidc-secret
+  name: karakeep-meilisearch-key
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: karakeep-oidc-secret
+    app.kubernetes.io/name: karakeep-meilisearch-key
     {{- include "custom.labels" . | nindent 4 }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
+  data:
+    - secretKey: MEILI_MASTER_KEY
+      remoteRef:
+        key: /cl01tl/karakeep/meilisearch
+        property: master-key
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: karakeep-oidc-authentik
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: karakeep-oidc-authentik
+    {{- include "custom.labels" . | nindent 4 }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
   data:
     - secretKey: AUTHENTIK_CLIENT_ID
       remoteRef:
-        key: /authentik/oidc/karakeep
+        key: /cl01tl/authentik/oidc/karakeep
         property: client
     - secretKey: AUTHENTIK_CLIENT_SECRET
       remoteRef:
-        key: /authentik/oidc/karakeep
+        key: /cl01tl/authentik/oidc/karakeep
         property: secret
 
 ---
@@ -55,7 +89,7 @@ metadata:
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
-    name: vault
+    name: openbao
   data:
     - secretKey: ACCESS_KEY_ID
       remoteRef:
@@ -69,22 +103,11 @@ spec:
       remoteRef:
         key: /garage/home-infra/karakeep-assets
         property: ACCESS_REGION
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: karakeep-meilisearch-master-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: karakeep-meilisearch-master-key-secret
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: MEILI_MASTER_KEY
+    - secretKey: BUCKET
       remoteRef:
-        key: /cl01tl/karakeep/meilisearch
-        property: MEILI_MASTER_KEY
+        key: /garage/home-infra/karakeep-assets
+        property: BUCKET
+    - secretKey: ENDPOINT
+      remoteRef:
+        key: /garage/config
+        property: ENDPOINT_LOCAL

clusters/cl01tl/helm/karakeep/values.yaml

@@ -19,22 +19,28 @@ karakeep:
             - name: NEXTAUTH_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-key-secret
+                  name: karakeep-key
                   key: key
             - name: PROMETHEUS_AUTH_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-key-secret
+                  name: karakeep-metric-token
                   key: prometheus-token
             - name: ASSET_STORE_S3_ENDPOINT
-              value: http://garage-main.garage:3900
+              valueFrom:
+                secretKeyRef:
+                  name: karakeep-bucket-garage
+                  key: ENDPOINT
             - name: ASSET_STORE_S3_REGION
               valueFrom:
                 secretKeyRef:
                   name: karakeep-bucket-garage
                   key: ACCESS_REGION
             - name: ASSET_STORE_S3_BUCKET
-              value: karakeep-assets
+              valueFrom:
+                secretKeyRef:
+                  name: karakeep-bucket-garage
+                  key: BUCKET
             - name: ASSET_STORE_S3_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
@@ -52,7 +58,7 @@ karakeep:
             - name: MEILI_MASTER_KEY
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-meilisearch-master-key-secret
+                  name: karakeep-meilisearch-key
                   key: MEILI_MASTER_KEY
             - name: BROWSER_WEB_URL
               value: http://karakeep.karakeep:9222
@@ -67,12 +73,12 @@ karakeep:
             - name: OAUTH_CLIENT_ID
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-oidc-secret
+                  name: karakeep-oidc-authentik
                   key: AUTHENTIK_CLIENT_ID
             - name: OAUTH_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: karakeep-oidc-secret
+                  name: karakeep-oidc-authentik
                   key: AUTHENTIK_CLIENT_SECRET
             - name: OLLAMA_BASE_URL
               value: http://ollama-server-3.ollama:11434
@@ -126,7 +132,7 @@ karakeep:
           authorization:
             credentials:
               key: prometheus-token
-              name: karakeep-key-secret
+              name: karakeep-metric-token
   persistence:
     data:
       forceRename: karakeep
@@ -144,7 +150,7 @@ meilisearch:
     MEILI_ENV: production
     MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
   auth:
-    existingMasterKeySecret: karakeep-meilisearch-master-key-secret
+    existingMasterKeySecret: karakeep-meilisearch-key
   persistence:
     enabled: true
     storageClass: ceph-block