apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: authentik-key-secret namespace: {{ .Release.Namespace }} labels: app.kubernetes.io/name: authentik-key-secret app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/part-of: {{ .Release.Name }} spec: secretStoreRef: kind: ClusterSecretStore name: vault data: - secretKey: key remoteRef: conversionStrategy: Default decodingStrategy: None key: /cl01tl/authentik/key metadataPolicy: None property: key --- apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: authentik-cloudflared-secret namespace: {{ .Release.Namespace }} labels: app.kubernetes.io/name: authentik-cloudflared-secret app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/part-of: {{ .Release.Name }} spec: secretStoreRef: kind: ClusterSecretStore name: vault data: - secretKey: cf-tunnel-token remoteRef: conversionStrategy: Default decodingStrategy: None key: /cloudflare/tunnels/authentik metadataPolicy: None property: token --- apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: authentik-postgresql-17-cluster-backup-secret namespace: {{ .Release.Namespace }} labels: app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/part-of: {{ .Release.Name }} spec: secretStoreRef: kind: ClusterSecretStore name: vault data: - secretKey: ACCESS_KEY_ID remoteRef: conversionStrategy: Default decodingStrategy: None key: /digital-ocean/home-infra/postgres-backups metadataPolicy: None property: access - secretKey: ACCESS_SECRET_KEY remoteRef: conversionStrategy: Default decodingStrategy: None key: /digital-ocean/home-infra/postgres-backups metadataPolicy: None property: secret