Restore authenticated secret reader in current cluster

k8s-ng/core-state/values.yaml

@@ -75,6 +75,12 @@ apps:
     namespace: web-petting
     wave: 5
     skipDryRunOnMissingResource: true
+  - name: k8s-secrets
+    project: apps
+    path: k8s/apps/k8s-secrets
+    namespace: k8s-secret
+    wave: 6 # after secret-stores and auth-proxy
+    skipDryRunOnMissingResource: true
   - name: llamacpp
     project: apps
     path: k8s-ng/apps/llamacpp

k8s/apps/k8s-secrets/app.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: k8s-secrets
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: k8s-secret
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/k8s-secrets
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-

k8s/apps/k8s-secrets/deployment.yaml

@@ -16,11 +16,12 @@ spec:
     spec:
       serviceAccountName: secret-reader
       nodeSelector:
-        kubernetes.io/os: linux
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
       containers:
       - name: secret-reader
         image: ultradesu/k8s-secrets:0.2.1
-        imagePullPolicy: Always
+        imagePullPolicy: IfNotPresent
         args:
           - "--secrets"
           - "openai-creds"
@@ -28,7 +29,6 @@ spec:
           - "k8s-secret"
           - "--port"
           - "3000"
-          - "--webhook"
         ports:
         - containerPort: 3000
           name: http

k8s/apps/k8s-secrets/external-secret.yaml

@@ -1,44 +1,32 @@
----
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: openai-creds
 spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vaultwarden-login
   target:
     name: openai-creds
     deletionPolicy: Delete
     template:
       type: Opaque
       data:
-        USER: |-
-          {{ .user }}
-        PASS: |-
-          {{ .pass }}
-        TOTP: |-
-          {{ .totp }}
+        USER: "{{ .user }}"
+        PASS: "{{ .pass }}"
+        TOTP: "{{ .totp }}"
   data:
     - secretKey: user
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
       remoteRef:
-        key: a485f323-fd47-40ee-a5cf-40891b1f963c
+        key: k8s/openai/creds
         property: login.username
     - secretKey: pass
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
       remoteRef:
-        key: a485f323-fd47-40ee-a5cf-40891b1f963c
+        key: k8s/openai/creds
         property: login.password
     - secretKey: totp
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
       remoteRef:
-        key: a485f323-fd47-40ee-a5cf-40891b1f963c
+        key: k8s/openai/creds
         property: login.totp
 

k8s/apps/k8s-secrets/ingress.yaml

@@ -5,12 +5,8 @@ metadata:
   name: auth-proxy
 spec:
   forwardAuth:
-    address: http://auth-proxy.auth-proxy.svc:80/auth
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-Auth-Request-User
-      - X-Auth-Request-Email
-      - X-Auth-Request-Groups
+    address: http://auth-proxy.keycloak.svc:80/auth
+    trustForwardHeader: false
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute

k8s/apps/k8s-secrets/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service-account.yaml
+  - rbac.yaml
+  - external-secret.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

k8s/apps/k8s-secrets/rbac.yaml

@@ -5,7 +5,8 @@ metadata:
 rules:
 - apiGroups: [""]
   resources: ["secrets"]
-  verbs: ["get", "list"]
+  resourceNames: ["openai-creds"]
+  verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding