Added prom-stack

k8s-ng/core/prom-stack/external-secrets.yaml

@@ -0,0 +1,125 @@
+# Read-only access to the Grafana database credentials in the psql namespace.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: db-credentials-reader
+---
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: psql-credentials
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: psql
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: db-credentials-reader
+---
+# A local break-glass account. OIDC remains the normal login path.
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: grafana-admin
+spec:
+  length: 40
+  digits: 10
+  symbols: 0
+  noUpper: false
+  allowRepeat: true
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grafana-admin
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: grafana-admin
+    template:
+      type: Opaque
+      data:
+        admin-user: admin
+        admin-password: "{{ .password }}"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: grafana-admin
+---
+# Grafana's database credentials come from CNPG. The existing Grafana Keycloak
+# client remains in Vaultwarden; item UUIDs are retained so no secret migration
+# or rename is required.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grafana-env
+spec:
+  refreshInterval: 1h
+  target:
+    name: grafana-env
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        GF_DATABASE_USER: "{{ .db_username }}"
+        GF_DATABASE_PASSWORD: "{{ .db_password }}"
+        GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ .client_id }}"
+        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ .client_secret }}"
+  data:
+    - secretKey: db_username
+      remoteRef:
+        key: grafana-db
+        property: username
+    - secretKey: db_password
+      remoteRef:
+        key: grafana-db
+        property: password
+    - secretKey: client_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 6a03357b-616e-4973-897a-93ccd675ddcb
+        property: fields[0].value
+    - secretKey: client_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 6a03357b-616e-4973-897a-93ccd675ddcb
+        property: fields[1].value
+  secretStoreRef:
+    kind: SecretStore
+    name: psql-credentials
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: alertmanager-telegram
+spec:
+  refreshInterval: 1h
+  target:
+    name: alertmanager-telegram
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        bot-token: "{{ .bot_token }}"
+  data:
+    - secretKey: bot_token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: eca0fb0b-3939-40a8-890a-6294863e5a65
+        property: fields[0].value