From 5d4d6206818db6b93a5bac3d0ddd0e9c1aa85a7a Mon Sep 17 00:00:00 2001
From: AB-UK <ab@hexor.cy>
Date: Sun, 28 Dec 2025 12:54:06 +0000
Subject: [PATCH] Fixed KHM desktop

---
 k8s/desktop/khm/external-secrets.yaml   | 33 +++++++++++++++++++++++++
 k8s/desktop/khm/khm-client-cronjob.yaml | 28 +++++++++++++++------
 k8s/desktop/khm/kustomization.yaml      |  2 +-
 3 files changed, 54 insertions(+), 9 deletions(-)
 create mode 100644 k8s/desktop/khm/external-secrets.yaml

diff --git a/k8s/desktop/khm/external-secrets.yaml b/k8s/desktop/khm/external-secrets.yaml
new file mode 100644
index 0000000..01f43ea
--- /dev/null
+++ b/k8s/desktop/khm/external-secrets.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: khm-client-creds
+spec:
+  target:
+    name: khm-client-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        USERNAME: |-
+          {{ .username }}
+        PASSWORD: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 19c06480-0814-4d1f-aa80-710105989188
+        property: login.username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 19c06480-0814-4d1f-aa80-710105989188
+        property: login.password
diff --git a/k8s/desktop/khm/khm-client-cronjob.yaml b/k8s/desktop/khm/khm-client-cronjob.yaml
index 1628011..ddf5b7f 100644
--- a/k8s/desktop/khm/khm-client-cronjob.yaml
+++ b/k8s/desktop/khm/khm-client-cronjob.yaml
@@ -40,14 +40,26 @@ spec:
                   memory: "256Mi"
                   cpu: "200m"
               command:
-                - /usr/local/bin/khm
-                - --known-hosts
-                - /host-ssh/known_hosts
-                - --host
-                - https://khm.hexor.cy
-                - --flow=work
-                - --basic-auth=ultradesu:JiMkWGaA0UZRkzzqtdPvvE0D5vIMCrH7LZGvK2Ux6eGSWECrPlh7UH1khdEm
-                - --in-place
+                - /bin/sh
+                - -c
+                - |
+                  /usr/local/bin/khm \
+                    --known-hosts /host-ssh/known_hosts \
+                    --host https://khm.hexor.cy \
+                    --flow=private \
+                    --basic-auth="${USERNAME}:${PASSWORD}" \
+                    --in-place
+              env:
+                - name: USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: khm-client-creds
+                      key: USERNAME
+                - name: PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: khm-client-creds
+                      key: PASSWORD
               volumeMounts:
                 - name: known-hosts
                   mountPath: /host-ssh/known_hosts
diff --git a/k8s/desktop/khm/kustomization.yaml b/k8s/desktop/khm/kustomization.yaml
index 97d14ce..44bb8cb 100644
--- a/k8s/desktop/khm/kustomization.yaml
+++ b/k8s/desktop/khm/kustomization.yaml
@@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - app.yaml
+  - external-secrets.yaml
   - khm-client-cronjob.yaml