SmokyZoneandClaude Sonnet 5
2ee46ceb4a
- Deployment/Service for the app, StatefulSet/Service for Postgres 17 - Secrets (DB password, session secret, Google client, allowed e-mails) via ExternalSecret from OpenBao - Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres - Nightly pg_dump CronJob - Optional OpenBao OIDC provider setup script Co-Authored-By: Claude Sonnet 5 <[email protected]>
75 lines
2.8 KiB
YAML
75 lines
2.8 KiB
YAML
# Both Secrets are created by External Secrets Operator from OpenBao (KV v2).
|
|
# If a referenced key is missing in OpenBao the ExternalSecret reports an error and the
|
|
# Secret is not created - so pods wait in CreateContainerConfigError until it exists.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: expense-tracker-db
|
|
namespace: {{ .Values.namespace.name }}
|
|
labels:
|
|
app.kubernetes.io/name: expense-tracker
|
|
{{- include "expense-tracker.labels" . | nindent 4 }}
|
|
spec:
|
|
refreshInterval: {{ .Values.externalSecret.refreshInterval }}
|
|
secretStoreRef:
|
|
kind: {{ .Values.externalSecret.storeKind }}
|
|
name: {{ .Values.externalSecret.storeName }}
|
|
target:
|
|
name: expense-tracker-db
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: POSTGRES_PASSWORD
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.db.remoteKey }}
|
|
property: {{ .Values.externalSecret.db.properties.password }}
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: expense-tracker-app
|
|
namespace: {{ .Values.namespace.name }}
|
|
labels:
|
|
app.kubernetes.io/name: expense-tracker
|
|
{{- include "expense-tracker.labels" . | nindent 4 }}
|
|
spec:
|
|
refreshInterval: {{ .Values.externalSecret.refreshInterval }}
|
|
secretStoreRef:
|
|
kind: {{ .Values.externalSecret.storeKind }}
|
|
name: {{ .Values.externalSecret.storeName }}
|
|
target:
|
|
name: expense-tracker-app
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: SESSION_SECRET
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.app.remoteKey }}
|
|
property: {{ .Values.externalSecret.app.properties.sessionSecret }}
|
|
- secretKey: ALLOWED_EMAILS
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.app.remoteKey }}
|
|
property: {{ .Values.externalSecret.app.properties.allowedEmails }}
|
|
{{- if .Values.auth.google.enabled }}
|
|
- secretKey: GOOGLE_CLIENT_ID
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.app.remoteKey }}
|
|
property: {{ .Values.externalSecret.app.properties.googleClientId }}
|
|
- secretKey: GOOGLE_CLIENT_SECRET
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.app.remoteKey }}
|
|
property: {{ .Values.externalSecret.app.properties.googleClientSecret }}
|
|
{{- end }}
|
|
{{- if .Values.auth.openbao.enabled }}
|
|
- secretKey: OPENBAO_CLIENT_ID
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.app.remoteKey }}
|
|
property: {{ .Values.externalSecret.app.properties.openbaoClientId }}
|
|
- secretKey: OPENBAO_CLIENT_SECRET
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.app.remoteKey }}
|
|
property: {{ .Values.externalSecret.app.properties.openbaoClientSecret }}
|
|
- secretKey: openbao-ca.crt
|
|
remoteRef:
|
|
key: {{ .Values.externalSecret.app.remoteKey }}
|
|
property: {{ .Values.externalSecret.app.properties.openbaoCaCert }}
|
|
{{- end }}
|