alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 12 Actions Activity

tmp/secrets-9 #6167

Merged
alexlebens merged 6 commits from tmp/secrets-9 into main 2026-04-24 01:41:05 +00:00
Conversation 0 Commits 6 Files Changed 6 +54 -69
6 changed files with 54 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
clusters/cl01tl/helm/grimmory/templates/external-secret.yaml
View File

@@ -1,10 +1,10 @@
apiVersion: external-secrets.io/v1 apiVersion: external-secrets.io/v1
kind: ExternalSecret kind: ExternalSecret
metadata: metadata:
name: grimmory-database-config name: grimmory-database-secret
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
labels: labels:
app.kubernetes.io/name: grimmory-database-config app.kubernetes.io/name: grimmory-database-secret
{{- include "custom.labels" . | nindent 4 }} {{- include "custom.labels" . | nindent 4 }}
spec: spec:
secretStoreRef: secretStoreRef:
@@ -33,11 +33,11 @@ spec:
- secretKey: access - secretKey: access
remoteRef: remoteRef:
key: /digital-ocean/home-infra/mariadb-backups key: /digital-ocean/home-infra/mariadb-backups
property: access property: AWS_ACCESS_KEY_ID
- secretKey: secret - secretKey: secret
remoteRef: remoteRef:
key: /digital-ocean/home-infra/mariadb-backups key: /digital-ocean/home-infra/mariadb-backups
property: secret property: AWS_SECRET_ACCESS_KEY
--- ---
apiVersion: external-secrets.io/v1 apiVersion: external-secrets.io/v1

4
clusters/cl01tl/helm/grimmory/values.yaml
View File

@@ -27,7 +27,7 @@ grimmory:
- name: DATABASE_PASSWORD - name: DATABASE_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: grimmory-database-config name: grimmory-database-secret
key: password key: password
- name: GRIMMORY_PORT - name: GRIMMORY_PORT
value: 6060 value: 6060
@@ -98,7 +98,7 @@ mariadb-cluster:
mariadb: mariadb:
rootPasswordSecretKeyRef: rootPasswordSecretKeyRef:
generate: false generate: false
name: grimmory-database-config name: grimmory-database-secret
key: password key: password
storage: storage:
size: 5Gi size: 5Gi

2
clusters/cl01tl/helm/matrix-synapse/values.yaml
View File

@@ -118,6 +118,8 @@ matrix-hookshot:
type: deployment type: deployment
replicas: 1 replicas: 1
strategy: Recreate strategy: Recreate
serviceAccount:
name: matrix-synapse
containers: containers:
main: main:
image: image:

97
clusters/cl01tl/helm/openbao/templates/external-secret.yaml
View File

@@ -45,19 +45,15 @@ spec:
- secretKey: ENVIRONMENT - secretKey: ENVIRONMENT
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: ENVIRONMENT property: environment
- secretKey: NODES - secretKey: NODES
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: NODES property: nodes
- secretKey: TOKENS - secretKey: TOKENS
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: TOKENS_1 property: tokens-1
- secretKey: NOTIFY_QUEUE_URLS
remoteRef:
key: /cl01tl/openbao/unseal
property: NOTIFY_QUEUE_URLS
--- ---
apiVersion: external-secrets.io/v1 apiVersion: external-secrets.io/v1
@@ -76,19 +72,15 @@ spec:
- secretKey: ENVIRONMENT - secretKey: ENVIRONMENT
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: ENVIRONMENT property: environment
- secretKey: NODES - secretKey: NODES
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: NODES property: nodes
- secretKey: TOKENS - secretKey: TOKENS
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: TOKENS_2 property: tokens-2
- secretKey: NOTIFY_QUEUE_URLS
remoteRef:
key: /cl01tl/openbao/unseal
property: NOTIFY_QUEUE_URLS
--- ---
apiVersion: external-secrets.io/v1 apiVersion: external-secrets.io/v1
@@ -107,56 +99,41 @@ spec:
- secretKey: ENVIRONMENT - secretKey: ENVIRONMENT
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: ENVIRONMENT property: environment
- secretKey: NODES - secretKey: NODES
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: NODES property: nodes
- secretKey: TOKENS - secretKey: TOKENS
remoteRef: remoteRef:
key: /cl01tl/openbao/unseal key: /cl01tl/openbao/unseal
property: TOKENS_3 property: tokens-3
- secretKey: NOTIFY_QUEUE_URLS
remoteRef:
key: /cl01tl/openbao/unseal
property: NOTIFY_QUEUE_URLS
# --- ---
# apiVersion: external-secrets.io/v1 apiVersion: external-secrets.io/v1
# kind: ExternalSecret kind: ExternalSecret
# metadata: metadata:
# name: openbao-token name: openbao-ntfy-unseal-config
# namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
# labels: labels:
# app.kubernetes.io/name: openbao-token app.kubernetes.io/name: openbao-ntfy-unseal-config
# app.kubernetes.io/instance: {{ .Release.Name }} {{- include "custom.labels" . | nindent 4 }}
# app.kubernetes.io/part-of: {{ .Release.Name }} spec:
# spec: secretStoreRef:
# secretStoreRef: kind: ClusterSecretStore
# kind: ClusterSecretStore name: openbao
# name: openbao target:
# data: template:
# - secretKey: token mergePolicy: Merge
# remoteRef: engineVersion: v2
# key: /cl01tl/openbao/token data:
# property: token NOTIFY_QUEUE_URLS: "{{ `{{ .endpoint }}` }}/{{ `{{ .topic }}` }}/?priority=4&tags=vault,unseal&title=Vault+Unsealed"
# - secretKey: unseal_key_1 data:
# remoteRef: - secretKey: endpoint
# key: /cl01tl/openbao/token remoteRef:
# property: unseal_key_1 key: /cl01tl/ntfy/users/cl01tl
# - secretKey: unseal_key_2 property: internal-endpoint-credential
# remoteRef: - secretKey: topic
# key: /cl01tl/openbao/token remoteRef:
# property: unseal_key_2 key: /cl01tl/ntfy/topics
# - secretKey: unseal_key_3 property: openbao
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_3
# - secretKey: unseal_key_4
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_4
# - secretKey: unseal_key_5
# remoteRef:
# key: /cl01tl/openbao/token
# property: unseal_key_5

6
clusters/cl01tl/helm/openbao/values.yaml
View File

@@ -160,6 +160,8 @@ unseal:
envFrom: envFrom:
- secretRef: - secretRef:
name: openbao-unseal-config-1 name: openbao-unseal-config-1
- secretRef:
name: openbao-ntfy-unseal-config
resources: resources:
requests: requests:
cpu: 1m cpu: 1m
@@ -176,6 +178,8 @@ unseal:
envFrom: envFrom:
- secretRef: - secretRef:
name: openbao-unseal-config-2 name: openbao-unseal-config-2
- secretRef:
name: openbao-ntfy-unseal-config
resources: resources:
requests: requests:
cpu: 1m cpu: 1m
@@ -192,6 +196,8 @@ unseal:
envFrom: envFrom:
- secretRef: - secretRef:
name: openbao-unseal-config-3 name: openbao-unseal-config-3
- secretRef:
name: openbao-ntfy-unseal-config
resources: resources:
requests: requests:
cpu: 1m cpu: 1m

6
clusters/cl01tl/helm/vault/templates/external-secret.yaml
View File

@@ -93,7 +93,7 @@ spec:
data: data:
- secretKey: BUCKET - secretKey: BUCKET
remoteRef: remoteRef:
key: /digital-ocean/home-infra/vault-backup key: /digital-ocean/home-infra/vault-backups
property: BUCKET_PATH property: BUCKET_PATH
--- ---
@@ -197,8 +197,8 @@ spec:
property: token property: token
- secretKey: NTFY_ENDPOINT - secretKey: NTFY_ENDPOINT
remoteRef: remoteRef:
key: /cl01tl/ntfy/users/cl01tl key: /cl01tl/ntfy/config
property: endpoint property: internal-endpoint
- secretKey: NTFY_TOPIC - secretKey: NTFY_TOPIC
remoteRef: remoteRef:
key: /cl01tl/ntfy/topics key: /cl01tl/ntfy/topics