alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 12 Actions 1 Activity

tmp/secrets-9 #6167

Merged
alexlebens merged 6 commits from tmp/secrets-9 into main 2026-04-24 01:41:05 +00:00
Conversation 0 Commits 6 Files Changed 6 +43 -60
2 changed files with 43 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit d0bb9edbb0 - Show all commits

97
clusters/cl01tl/helm/openbao/templates/external-secret.yaml
View File

@@ -45,19 +45,15 @@ spec:
- secretKey: ENVIRONMENT
remoteRef:
key: /cl01tl/openbao/unseal
property: ENVIRONMENT
property: environment
- secretKey: NODES
remoteRef:
key: /cl01tl/openbao/unseal
property: NODES
property: nodes
- secretKey: TOKENS
remoteRef:
key: /cl01tl/openbao/unseal
property: TOKENS_1
- secretKey: NOTIFY_QUEUE_URLS
remoteRef:
key: /cl01tl/openbao/unseal
property: NOTIFY_QUEUE_URLS
property: tokens-1
---
apiVersion: external-secrets.io/v1
@@ -76,19 +72,15 @@ spec:
- secretKey: ENVIRONMENT
remoteRef:
key: /cl01tl/openbao/unseal
property: ENVIRONMENT
property: environment
- secretKey: NODES
remoteRef:
key: /cl01tl/openbao/unseal
property: NODES
property: nodes
- secretKey: TOKENS
remoteRef:
key: /cl01tl/openbao/unseal
property: TOKENS_2
- secretKey: NOTIFY_QUEUE_URLS
remoteRef:
key: /cl01tl/openbao/unseal
property: NOTIFY_QUEUE_URLS
property: tokens-2
---
apiVersion: external-secrets.io/v1
@@ -107,56 +99,41 @@ spec:
- secretKey: ENVIRONMENT
remoteRef:
key: /cl01tl/openbao/unseal
property: ENVIRONMENT
property: environment
- secretKey: NODES
remoteRef:
key: /cl01tl/openbao/unseal
property: NODES
property: nodes
- secretKey: TOKENS
remoteRef:
key: /cl01tl/openbao/unseal
property: TOKENS_3
- secretKey: NOTIFY_QUEUE_URLS
remoteRef:
key: /cl01tl/openbao/unseal
property: NOTIFY_QUEUE_URLS
property: tokens-3
# ---
# apiVersion: external-secrets.io/v1
# kind: ExternalSecret
# metadata:
# name: openbao-token
# namespace: {{ .Release.Namespace }}
# labels:
# app.kubernetes.io/name: openbao-token
# app.kubernetes.io/instance: {{ .Release.Name }}
# app.kubernetes.io/part-of: {{ .Release.Name }}
# spec:
# secretStoreRef:
# kind: ClusterSecretStore
# name: openbao
# data:
# - secretKey: token
# remoteRef:
# key: /cl01tl/openbao/token
# property: token
# - secretKey: unseal_key_1
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_1
# - secretKey: unseal_key_2
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_2
# - secretKey: unseal_key_3
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_3
# - secretKey: unseal_key_4
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_4
# - secretKey: unseal_key_5
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_5
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: openbao-ntfy-unseal-config
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: openbao-ntfy-unseal-config
{{- include "custom.labels" . | nindent 4 }}
spec:
secretStoreRef:
kind: ClusterSecretStore
name: openbao
target:
template:
mergePolicy: Merge
engineVersion: v2
data:
NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
data:
- secretKey: endpoint
remoteRef:
key: /cl01tl/ntfy/users/cl01tl
property: internal-endpoint-credential
- secretKey: topic
remoteRef:
key: /cl01tl/ntfy/topics
property: openbao

6
clusters/cl01tl/helm/openbao/values.yaml
View File

@@ -160,6 +160,8 @@ unseal:
envFrom:
- secretRef:
name: openbao-unseal-config-1
- secretRef:
name: openbao-ntfy-unseal-config
resources:
requests:
cpu: 1m
@@ -176,6 +178,8 @@ unseal:
envFrom:
- secretRef:
name: openbao-unseal-config-2
- secretRef:
name: openbao-ntfy-unseal-config
resources:
requests:
cpu: 1m
@@ -192,6 +196,8 @@ unseal:
envFrom:
- secretRef:
name: openbao-unseal-config-3
- secretRef:
name: openbao-ntfy-unseal-config
resources:
requests:
cpu: 1m